Tag
62 articles tagged #DevOps.
P.01CISA gave federal agencies until Sept 12 to patch a Citrix NetScaler auth bypass and a critical FortiOS RCE tied to a live PivotC2 malware campaign.
P.02MikroTik patched three RouterOS bugs after CISA confirmed active exploitation of two: which CVEs to prioritize and how to check your router for compromise.
P.03CVE-2026-49869 lets unauthenticated attackers hit any Kestra path ending in /configs, skip login, then run shell commands as root via script plugins.
P.04A phantom join key in JFrog Artifactory's auth service let attackers forge admin tokens days after disclosure. Affected versions, what to check, and the patch.
P.05Cloudflare logged 13 incidents between August 7 and 14, touching R2, Durable Objects, and Workers KV. What that means for building on one edge provider.
P.06Kubernetes 1.37 shipped August 26 with 67 enhancements. What actually graduated to stable, what's worth testing in beta, and what to leave alone for now.
P.07Argo Rollouts replaces a Deployment with a controller that shifts traffic gradually and rolls back on bad metrics. Real manifests, plain Deployment to canary.
P.08Every rolling deploy drops a few requests and the errors look like client noise. The shutdown sequence, the race behind it, and the code that fixes it.
P.09macOS 27 deprecates hdiutil and points disk image work at diskutil image. The subcommand mapping, what's missing, and updating a DMG build without breaking CI.
P.10Deployment frequency, lead time, change failure rate, time to restore. What each measures, the tiers that separate elite teams, and where teams misuse them.
P.11An unauthenticated attacker can inject through a GitLab GraphQL directive and delete public projects and user data. CVSS 9.4, patched in 19.2.4.
P.12A log line that's just a sentence is fine until you search a million at 2am. How structured logging works, threading a correlation ID, and what to skip.
P.13The keyv attack poisoned 2,234 package versions in a day, and it won't be the last. The checklist for install scripts, provenance, lockfiles, and CI tokens.
P.14A compromised maintainer account turned keyv and cacheable into a self-propagating npm worm that stole cloud, CI, and GitHub credentials. How to check.
P.15A deserialization flaw in TeamCity's agent polling protocol lets an attacker with no credentials run commands as the build server. CISA confirmed August 5.
P.16Researchers showed an untrusted GitHub issue reaching CI runner secrets in Claude Code, Gemini CLI, and Codex. Gemini CLI's flaw scored a perfect 10.0.
P.17One checkout request touches five services and nobody knows which is slow. How trace IDs, spans, and context propagation fix that, with OpenTelemetry code.
P.18An SLA is a promise with a penalty. An SLO is the internal target that keeps you inside it. An error budget is what's left. The math, on a real example.
P.19A one-line control-flow change meant to patch CVE-2026-29146 quietly broke Tomcat's cluster encryption. CISA confirmed exploitation on August 4. The fix.
P.20Four philosophies for one problem: moving a schema from what it is to what it should be, safely, in a team. How they differ and which fits your stack.
P.21A 3-hour-33-minute CloudFront VPC Origins failure knocked out ten unrelated services worldwide. The cause was a single-ingress design worth checking for.
P.22Kubernetes 1.36 shipped 70 enhancements with no headline rewrite, just years of work reaching stable. What changes for platform teams, and what to skip.
P.23Enforcement of actions/checkout's pull_request_target protections landed July 20, closing the hole the AsyncAPI attack used six days earlier. What to check.
P.24A unit-pricing bug sent some AWS customers cost projections in the billions on July 16. Invoices were fine; automation wired to those estimates wasn't.
P.25Trusted publishing lets GitHub Actions and GitLab CI publish via short-lived OIDC tokens instead of a stored npm token. The setup, and the May 2026 change.
P.26A hacker claimed 35GB from Accenture including RSA and SSH keys and Azure tokens. The code isn't the risk; the credentials next to it are. The audit to run.
P.27Platform engineering has its own hiring cluster now, distinct from DevOps, SRE, and cloud architecture. How to screen for product thinking over ticket-taking.
P.28npm v12 blocks preinstall, install, and postinstall scripts, Git dependencies, and remote tarballs unless allowed. What breaks, and how to migrate.
P.29Chaos engineering injects failure into a running system to find weaknesses before an outage does. What it involves, what tools help, and when to skip it.
P.30DevSecOps is distinct from DevOps and from security engineering. What the role covers, what to screen for, and why supply chain security is now the core.
P.31SRE is a discipline, not DevOps with a pager. How to define the role, screen for reliability math, and avoid hiring an ops generalist by accident.
P.32Both tools keep your dependencies current automatically. Here is how they actually differ, where each one breaks down, and which to choose based on your team's setup.
P.33The DevOps engineer title now covers three jobs: platform engineer, SRE, and CI/CD specialist. What each does, what to screen for, and what the market pays.
P.34Setting up metrics with Prometheus and dashboards with Grafana: what to instrument, what to skip, and what a dashboard should show during an incident.
P.35Dev Containers define your entire dev environment in a devcontainer.json file, so new teammates are productive in minutes. Here's how to set them up.
P.36Vulnerability scanning catches known CVEs in your base images and dependencies before they reach production. Here's how to set up Trivy and Snyk, understand their output, and act on what they find.
P.37Multi-stage Docker builds cut image size by 80-90%, speeding up pulls, cold starts, and CI, while shrinking your attack surface and registry bill.
P.38Every cloud decision locks you in somewhere; the real question is which lock-in costs less. A practical framework for when to abstract and when to accept it.
P.39Vercel dominates frontend hosting. AWS dominates enterprise infrastructure. Between those two extremes, Fly.io and Railway are the most practical choices for backend-heavy full-stack apps in 2026.
P.40Git worktrees give you multiple branches checked out in separate directories at once. No stashing, no context switching, no losing your place.
P.41Blue-green and canary deployments give you a way to release software without taking down your service or discovering a bug when it's already affecting everyone. Here's how they work and when to use each.
P.42Structured commit messages unlock automatic changelogs, version bumps, and release notes. The full setup, from commitlint hooks to shipping in CI.
P.43eBPF lets you attach programs to any kernel hook — network packets, system calls, function calls — without patching the kernel or rebooting. Here's what application developers actually need to know.
P.44Tailscale is a mesh VPN giving distributed teams private networking between laptops, servers, and office machines in about 30 seconds, no VPN hardware needed.
P.45Multi-cloud usually costs more in engineering time than the lock-in risk it prevents; most teams do better on one cloud with deliberate exceptions.
P.46OpenTelemetry is the observability standard now. Most tutorials show you how to install the SDK and emit traces. Fewer explain which signals actually matter for web applications and which add noise without helping you debug anything.
P.47HPA scales on CPU and memory. But most production workloads don't scale well on those signals. KEDA, VPA, and Goldilocks fill the gaps that HPA leaves open.
P.48k6 is a load testing tool with JavaScript scripting and CI integration. Writing meaningful tests, reading the results, and catching regressions early.
P.49CodeRabbit, GitHub Copilot code review, and similar tools have changed the first-pass review. Here's what they actually catch, where they fail, and the workflow that combines both effectively.
P.50From .env files to Vault to AWS Secrets Manager: a practical guide to storing credentials, API keys, and certificates without waking up to a breach notification.
P.51A practical incident response process for small teams: severity tiers, on-call rotations, better alerting, and blameless postmortems, no SRE org required.
P.52Leaked credentials are the most preventable breach category. When you need a real secrets manager, which one to pick, and what to do if you're still on .env.
P.53Service meshes promise secure, observable microservice communication. But most teams that adopt one do so before they need it. Here is how to decide, and what each option actually costs you.
P.54Running unscanned containers in production is like shipping without tests. Here's how teams scan images, generate SBOMs, and add runtime protection.
P.55Most teams treat their CI pipeline as a black box that occasionally fails. A few hours of optimization can cut your CI time by 40-60% and your GitHub Actions bill by a similar margin. Here's exactly how to do it.
P.56HashiCorp's 2023 BSL relicensing split Terraform into OpenTofu, while Pulumi took a code-first approach. Here's how to choose between them in 2026.
P.57Data-driven analysis of platform engineering adoption in 2026. Compare Backstage, Port, and Cortex IDPs, golden paths, self-service infrastructure, and how to measure platform success with DORA metrics.
P.58EditorPickEveryone said Wasm would kill Docker. Two years later they coexist, and teams running both ship faster: a reality check on Wasm, containers, and the containerd shim.
P.59Trunk-based, Git Flow, GitHub Flow — we have tried them all. Here is the simple Git workflow that works for teams under 10 and the mistakes to avoid.
P.60GitOps adoption hit 64% in 2025, and the next evolution is integrating real-time cost visibility into every infrastructure pull request. We break down why GitOps plus FinOps is the operational model serious teams are adopting in 2026.
P.61Monorepos are mainstream, but choosing between Turborepo, Nx, and pnpm workspaces is confusing. Here's a practical guide to picking the right tool for your team.
P.62Most agencies disappear after deployment. Here is our exact 90-day post-launch process — from day-one monitoring to month-three handoff — with the checklists, tools, and escalation paths we use for every project.