tag: Security · 103 items
- Platform/SRE — Plan: New GA capability worth evaluating this quarter: enabling automatic SDK integration on existing CloudFront web ACLs that use Bot Control (targeted), ATP, or ACFP rule groups eliminates per-application script-tag maintenance and reduces misconfiguration risk. Review your WAF web ACLs and enable the setting via Console, CLI, CDK, or CloudFormation.
- CI/CD — Skip
- Leader — Learn: This reduces recurring per-application engineering overhead for teams protecting many CloudFront-fronted properties with advanced WAF rule groups — useful context when assessing operational cost of the WAF managed-rule investment, but no strategic decision is required.
- Platform/SRE — Learn: Frames agentic AI risk as a platform design question — what tools and permissions are exposed to agents defines the blast radius. Worth reading as platform teams start exposing internal APIs to AI agents.
- CI/CD — Skip
- Leader — Learn: CNCF perspective on why AI agent safety is a platform governance problem, not just an ML one — useful context for leaders setting AI adoption policy or evaluating internal developer platform expansion to agentic tooling.
- Platform/SRE — Skip
- CI/CD — Learn: AI-assisted code review in pipelines can produce hallucinated vulnerabilities and harmful remediation steps; worth understanding the containment and verification patterns before integrating coding agents into release workflows.
- Leader — Learn: Illustrates the risk profile of deploying coding agents without human verification gates — useful context when setting standards or policy around AI-assisted development tooling adoption.
- Platform/SRE — Skip
- CI/CD — Plan: Evaluate enabling Dependabot reachability analysis to triage which vulnerable dependencies are actually callable from your code, reducing alert noise and helping the team focus remediation effort on real exposure.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: This public preview extension lets engineers triage code scanning alerts inside the Copilot app; worth evaluating as a developer experience improvement, but it’s pre-GA so no pipeline action needed yet.
- Leader — Skip
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised, enabling potential MITM against any service trusting those CAs; upgrade Envoy to v1.40.1 now to remove trust in those CAs from the proxy trust store. If running Istio, also review the peer metadata label-fallback behavior change, which affects source_app/destination_app attribution in telemetry.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.40 EOL 2027-10-13
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised, meaning any Envoy instance still trusting those CAs is exposed to forged-certificate MITM attacks; upgrade Envoy to v1.39.5 now to remove trust of the affected roots from docker images and the Hickory DNS-over-TLS/HTTPS resolver.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised — Envoy instances running older versions still trust those CAs, leaving upstream TLS connections exposed to potential MITM via fraudulent certificates. Upgrade Envoy to v1.38.8 to remove trust in the compromised CAs; Envoy 1.38 is supported until 2027-04-23 so the upgrade path is available now.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23
- Platform/SRE — Plan: Removes trust for compromised eMudhra CA private keys from Envoy’s trust store; any 1.37.x deployment trusting those CAs is exposed to fraudulent cert acceptance. No KEV listing or confirmed active exploitation, so cap is Plan — schedule patching to 1.37.10 this sprint; 1.37 itself EOLs 2027-01-13.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.37 reaches EOL in 79d (2027-01-13)
- Platform/SRE — Plan: Teams using Cloud SQL Auth Proxy must upgrade to 2.26.3+, Cloud SQL Proxy Operator to 1.8.4+, and Ops Agent to 2.73.0 to address this Go root-certificate vulnerability (GCP-2026-071); managed Cloud SQL instances are auto-patched during scheduled maintenance. CVE is not KEV-listed and EPSS is 0.00, so no active exploitation warrants immediate emergency action, but proxy upgrades are concrete tasks to schedule this sprint.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-111943 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Act: CVSS 9.2 pre-auth RCE in the PHP engine itself with a vendor-confirmed attack path on Apache/mod_php and no application-level workaround; upgrade every web-serving host or container to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 now (patch released 2026-10-21).
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, reported by 2 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, reported by 2 collected sources
- Platform/SRE — Plan: If you self-host GitLab, schedule an upgrade to the relevant patched branch (19.5.1, 19.4.3, 19.3.6, etc.) this sprint; GitLab’s ‘Critical’ designation signals high-severity CVEs, but no KEV listing or active exploitation is confirmed in the signals, so this is urgent planned work rather than a drop-everything hotfix.
- CI/CD — Plan: Teams running self-hosted GitLab CI should upgrade to the appropriate patched version for their minor branch; a critical security fix in the CI/CD platform itself is a supply-chain risk that warrants scheduling an upgrade this sprint, even without confirmed exploitation.
- Leader — Skip
- Signals: major release (19.0)
- Platform/SRE — Learn: Pre-GA preview of short-lived, auto-refreshing OAuth tokens in gh CLI; worth tracking if your teams use GitHub CLI for scripted infra workflows, but no action warranted until GA.
- CI/CD — Learn: Expiring tokens would improve credential hygiene for pipelines that invoke gh CLI, but this is public preview — evaluate once it reaches GA before updating pipeline auth patterns.
- Leader — Skip
- Platform/SRE — Plan: CVE-2026-78669 affects Terraform’s HTTP/2 stack but is not KEV-listed (EPSS 0.01) and requires a compromised provider/module registry to exploit; schedule an upgrade to 1.16.6 in the next routine Terraform maintenance window.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found) · CVE-2026-78669 — CISA KEV: not listed, EPSS 0.01
- Platform/SRE — Plan: Upgrade OpenTofu to v1.12.8 to address a CPU exhaustion vulnerability reachable via attacker-controlled HTTP/2 servers during
tofu init; no KEV listing or active exploitation reported, so no hard deadline, but schedule patching this sprint. - CI/CD — Plan: If pipelines run
tofu initagainst untrusted or external registries, upgrade to v1.12.8 to close the HTTP/2 CPU exhaustion vector; no confirmed exploitation or pipeline-breaking deadline, so plan within current cycle. - Leader — Skip
- Platform/SRE — Plan: Three containerd security fixes ship in this patch: two crash-on-pull vectors and a disk-exhaustion flaw (GHSA-hc94-p972-ch66) that could drain host storage on malicious image pulls. None are KEV-listed or actively exploited, but any team running Docker Engine or raw containerd in production should schedule an upgrade to 29.9.1 this sprint.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-95839 — CISA KEV: not listed, EPSS n/a, reported by 2 collected sources
- Platform/SRE — Plan: Four CVEs patched (including IAM/SCIM and OAuth2 fixes), none KEV-listed and EPSS scores are effectively zero — no active exploitation, but Grafana is standard in the observability stack; schedule an upgrade to 13.2.4 this quarter.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-15577 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-33374 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-92539 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Grafana sits in most Platform teams’ observability stack; this patch fixes four CVEs (including an IAM/SCIM Enterprise fix), but none are KEV-listed and EPSS scores are near zero — no active exploitation confirmed. Schedule an upgrade to 13.1.8 this sprint rather than treating it as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-15577 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-33374 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-92539 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Four CVEs fixed including OAuth2 header leakage and an IAM/SCIM endpoint flaw; none are KEV-listed and EPSS scores are near zero, so no active exploitation anchor, but teams running Grafana 13.x in production should schedule an upgrade to 13.0.11 this sprint.
- CI/CD — Skip
- Leader — Skip
- Signals: major release (13.0) · CVE-2026-15577 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-33374 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-92539 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: CVE-2026-95839 is a security fix in the container runtime underlying every Kubernetes node, but it is not KEV-listed and carries no public exploitation signal, so this does not meet the Act bar. Plan to upgrade containerd to 2.4.2 across node pools this quarter.
- CI/CD — Skip
- Leader — Skip
- Signals: containerd 2.4 EOL 2027-05-16 · CVE-2026-95839 — CISA KEV: not listed, EPSS n/a, reported by 2 collected sources
- Platform/SRE — Learn: Conceptual overview of AI agent attack surfaces — prompt injection, overprivileged identities, credential leakage — useful for shaping how platform teams constrain agent workloads on shared infrastructure, but no specific CVE or deadline to act on.
- CI/CD — Learn: Credential exposure and excessive autonomy patterns described here are relevant as AI agents increasingly run inside pipelines, but this is advisory content with no concrete pipeline action or deadline attached.
- Leader — Learn: Useful framing for assessing organizational risk posture as teams adopt AI agents, but no licensing, cost, or vendor-risk trigger requiring a leadership decision now.
- Platform/SRE — Plan: If your platform automation still uses classic PATs for GitHub API access, schedule a migration to fine-grained GitHub Apps tokens this quarter — fewer broad credentials reduces blast radius from a compromised token.
- CI/CD — Plan: Pipelines relying on classic PATs for repo access or triggering workflows should be migrated to GitHub Apps with scoped permissions; no hard deadline, but this hardening step fits a Q4 supply-chain hygiene project.
- Leader — Skip
- Platform/SRE — Learn: Practical technique for air-gapping or mirroring the pause container image — relevant to clusters that need to avoid external registry dependencies, but no deadline or active issue drives immediate action.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: New AI Scan metrics in GitHub’s security overview give pipeline owners visibility into how many AI-generated findings are being surfaced and resolved in PRs — worth reviewing if your org uses GitHub Advanced Security.
- Leader — Learn: Org and enterprise admins can now track AI Scan effectiveness in security overview, providing data to assess whether GitHub Advanced Security’s AI features are delivering measurable vulnerability reduction.
- Platform/SRE — Plan: Four HTTP/2 CVEs in the Docker daemon (daemon crash, memory exhaustion, flow-control bypass, CPU spike) are fixed in this release; none are KEV-listed and EPSS scores are near zero, so no active exploitation clock, but schedule an upgrade to v29.9.0 if running Docker Engine on cluster nodes or VM fleets.
- CI/CD — Plan: If Docker-in-Docker or a Docker socket is part of your build runners, the same HTTP/2 daemon vulnerabilities apply; plan to update the Docker Engine version in runner images or host provisioning to v29.9.0, no hard deadline but meaningful DoS risk in shared build infrastructure.
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found) · CVE-2026-56857 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-78659 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-78663 — CISA KEV: not listed, EPSS 0.01
- Platform/SRE — Plan: Two GHSA-tracked crash vulnerabilities in the oauth2 and api_key_auth filters (triggered by CONNECT requests lacking a :path header) are patched in 1.39.3; no KEV listing or active exploitation reported, but operators using either filter should schedule the patch within the current sprint. Envoy 1.39 is supported until 2027-07-14.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14
- Platform/SRE — Plan: Two crash-inducing security fixes (GHSA-8vc2-jrm4-835w, GHSA-47vj-9r25-wv5j) affect Envoy’s oauth2 and api_key_auth filters when handling CONNECT requests; no KEV listing or active exploitation reported, so schedule an upgrade to 1.38.6 this sprint if either filter is in use.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23
- Platform/SRE — Plan: Patch Envoy to 1.37.9 this quarter to resolve CVE-2026-54786 (not KEV-listed, EPSS 0.00) and three worker-thread race conditions in AWS request signing, local rate limiting, and SDS secret handling that could cause instability under RDS route updates; no forced deadline, 1.37 EOL is 2027-01-13.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.37 EOL 2027-01-13 · CVE-2026-54786 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Four CRITICAL CVEs patched — including RCE via Kustomize remote refs and Jsonnet imports in the repo-server, plus an AppProject restriction bypass — with no KEV listing or confirmed active exploitation. Schedule upgrade to v3.4.10 this sprint; none of the exploits have a forced deadline, but CRITICAL severity in a GitOps control plane warrants prompt action.
- CI/CD — Plan: The HIGH-severity command injection via SSH Git repository proxy URL (CVE-2026-55797) and the AppProject hook bypass directly affect the deploy path managed through Argo CD. No active exploitation is confirmed, but teams running Argo CD for GitOps deployments should plan an upgrade to v3.4.10 before end of current sprint.
- Leader — Skip
- Signals: Argo CD 3.4 supported · CVE-2025-61560 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-55797 — CISA KEV: not listed, EPSS 0.02 · CVE-2026-77459 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Four CRITICAL-severity vulnerabilities patched, including repo-server command execution via Kustomize and AppProject restriction bypass — none are KEV-listed and EPSS scores are near zero, so no confirmed exploitation, but schedule upgrade of Argo CD to v3.3.15 this sprint given the RCE class of findings.
- CI/CD — Plan: Argo CD v3.3.15 patches CRITICAL command-execution flaws in the GitOps deployment tool; coordinate with the platform team to schedule a cluster upgrade to v3.3.15, prioritizing any environments where untrusted Kustomize or Jsonnet sources are in use.
- Leader — Skip
- Signals: Argo CD 3.3 supported · CVE-2025-61560 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-55797 — CISA KEV: not listed, EPSS 0.02 · CVE-2026-77459 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Argo CD 3.5.4 fixes four CRITICAL CVEs including arbitrary command execution in the repo-server via Kustomize and Jsonnet, plus an AppProject restriction bypass. None are KEV-listed and EPSS is very low, but CRITICAL severity in a core GitOps component warrants patching this sprint — upgrade clusters to 3.5.4 promptly.
- CI/CD — Plan: The CRITICAL command-injection paths (Kustomize remote refs, Helm home, Jsonnet imports) run inside the repo-server that processes your GitOps manifests, making this directly relevant to the deploy path. Schedule an upgrade to 3.5.4; no active exploitation confirmed yet but the attack surface is in build artifact processing.
- Leader — Skip
- Signals: Argo CD 3.5 supported · CVE-2025-61560 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-55797 — CISA KEV: not listed, EPSS 0.02 · CVE-2026-77459 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Critical patch releases in GitLab warrant upgrading if you self-host; review CVE details in the release notes and schedule the upgrade to the applicable branch (19.4.2, 19.3.4, or 19.2.8) this sprint. No exploitation confirmed in signals, so Act ceiling is not reached.
- CI/CD — Plan: If GitLab CI is your pipeline platform and you run a self-managed instance, plan an upgrade to the patched version matching your branch; critical patches can affect runner availability and API stability. No hard deadline or active exploitation in signals.
- Leader — Skip
- Platform/SRE — Plan: If any Docker Hub personal accounts were converted to organizations in your org, PATs used for image pulls in infrastructure tooling may have been re-assigned to unintended owners. Audit and rotate affected Docker Hub PATs; no hard deadline but treat as a near-term security hygiene task.
- CI/CD — Plan: Docker Hub PATs are widely embedded in CI/CD pipelines for registry auth; if any team converted a personal Docker Hub account to an org, those tokens may have changed hands. Identify any converted accounts and rotate all associated PATs in pipeline secrets before they can be leveraged.
- Leader — Skip
- Signals: CVE-2026-105445 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Learn: Introduces a design principle for safely integrating AI agents into platform operations — propose state changes rather than granting direct execution rights. Worth reading when evaluating AI-assisted runbooks or autonomous remediation tooling.
- CI/CD — Skip
- Leader — Learn: Relevant framing for leaders setting guardrails around AI agent adoption in the platform: a mental model for where autonomous execution is safe versus where human approval gates are required.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Copilot’s local sandboxing GA adds a meaningful security layer for orgs with Copilot rollouts; worth noting when defining AI-assisted coding policies, but no immediate strategic decision is required.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Learn: GitHub org/enterprise admins can now see which repos have AI Scan for PRs enabled in the security overview — useful context when auditing pipeline security coverage, but no pipeline change required.
- Leader — Learn: This visibility feature lets platform leaders quickly assess AI-assisted code scanning adoption across repos, supporting supply-chain security posture reviews at the org or enterprise level.
- Platform/SRE — Plan: Prometheus 3.13.4 patches a gRPC HTTP/2 memory-exhaustion vulnerability (GO-2026-6348) and fixes federation corruption of float native histograms — schedule an upgrade to 3.13.4 this sprint for any federated Prometheus deployment.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Upgrade OpenTofu to v1.12.7 to address CVE-2026-78662 and CVE-2026-56855, which allow an attacker-controlled SSH server to deadlock remote-exec/file provisioner connections; neither CVE is KEV-listed and EPSS scores are near zero, so schedule within the next IaC toolchain maintenance cycle rather than treating as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-56855 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-78662 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: CVE-2026-17106 allows a crafted tar archive to write outside the extraction directory in the Docker engine — real exposure for any host running Moby/Docker, but not KEV-listed and EPSS is 0.00 with no active exploitation evidence. Schedule an upgrade to v25.0.18 this sprint rather than treating it as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: major release (25.0) · CVE-2026-17106 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Upgrade Grafana to 13.1.7 to remediate CVE-2026-13719, CVE-2026-13720, and CVE-2026-81841; none are KEV-listed and all carry EPSS 0.00, so schedule the patch this sprint rather than treating it as an emergency response.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-13719 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-13720 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-81841 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: CVE-2026-35189 fixes a remote DoS in TLS certificate parsing via BoringSSL; not KEV-listed and EPSS is near-zero, so no evidence of active exploitation — schedule an upgrade to v1.39.2 this sprint rather than treating it as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14 · deprecation mentioned (no explicit date found) · CVE-2026-35189 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Skip
- CI/CD — Learn: The ConfigPoisoning class — attacker-controlled execution via .git/config and .gitattributes — is worth understanding when hardening pipelines that clone external or untrusted repos; the specific exploit requires the DeepSeek-Reasonix desktop client, but GitLab notes multiple coding agents share the same root flaw.
- Leader — Plan: GitLab’s research found the ConfigPoisoning class affects multiple widely-used AI coding agents, not just DeepSeek-Reasonix; if the org is standardizing on AI coding assistants, add security vetting of approved tools to the golden-path policy before broad rollout.
- Signals: CVE-2026-102437 — CISA KEV: not listed, EPSS 0.01
- Platform/SRE — Plan: A new GA feature in Secrets Manager surfaces rotation gaps and encryption-key misconfigurations directly in the console at no extra cost; schedule a pass through your secrets inventory this quarter to act on flagged items before they become findings in a security review.
- CI/CD — Learn: Console-based recommendations don’t change how pipelines execute, but the rotation and key-management nudges are relevant context for teams auditing how pipeline secrets are stored in Secrets Manager.
- Leader — Learn: A free capability improvement to an existing standard-stack service; no pricing, licensing, or vendor-risk decision required, but worth noting as reinforcement for a secrets-rotation policy or security posture standard.
- Platform/SRE — Skip
- CI/CD — Learn: GitHub’s scheduled code scanning now requires a prior push or PR to activate weekly scans, which may silently drop coverage on dormant repos; review which repos rely on scheduled-only scanning to avoid gaps.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Local sandboxing in the Copilot app limits file, network, and credential access during AI-driven command execution — worth noting as the org evaluates Copilot’s security posture and acceptable-use policy for developer workstations.
- Platform/SRE — Plan: Three CVEs patched in Grafana — none KEV-listed and all with near-zero EPSS scores, so no active exploitation, but teams running Grafana in their observability stack should schedule an upgrade to 13.1.6 this sprint.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-15815 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-76154 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-79656 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Grafana is a common observability-stack component; 13.0.9 patches three CVEs, none KEV-listed and EPSS scores are negligible (0.01, 0.00, n/a), so no forced-action clock exists — schedule an upgrade to v13.0.9 this sprint as a routine security hardening step.
- CI/CD — Skip
- Leader — Skip
- Signals: major release (13.0) · CVE-2026-15815 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-76154 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-79656 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Grafana is a standard observability component in Platform’s stack; four CVEs are patched in 12.4.11, but none appear in CISA KEV and EPSS scores are near zero, so schedule the upgrade this sprint rather than treating it as an emergency hotfix.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-12704 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-15815 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-76154 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Skip
- CI/CD — Learn: AI Scan can now be enabled on repos that haven’t configured CodeQL default setup, lowering the barrier to adding automated security scanning to pull request workflows — worth revisiting if teams have been blocked on CodeQL prerequisites.
- Leader — Skip
- Platform/SRE — Plan: If you run Google Cluster Toolkit for HPC workloads, review the linked security bulletin and apply Slurm patches; no KEV or active exploitation signal, but a vulnerable job scheduler carries real risk. All other items (AlloyDB audit monitoring, MCP) are minor or pre-GA.
- CI/CD — Skip
- Leader — Learn: The Public Preview of MCP support in API Gateway is an early signal for orgs evaluating AI-agent integration patterns — it shows GCP moving to expose REST APIs as agent tools without backend changes, worth tracking as the feature matures toward GA.
- Platform/SRE — Plan: If your org runs ECS and uses IAM SCPs or permission boundaries to govern resource allocation, update your IAM policies to enforce ecs:task-cpu and ecs:task-memory on RunTask and StartTask — this closes a gap where those controls were previously bypassable at launch time.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Useful framing for leaders overseeing OSS projects or inner-source programs — outlines a lightweight vulnerability disclosure process suitable for non-security-specialist maintainers.
- Platform/SRE — Learn: Beta (pre-GA) cap applies, but this is worth evaluating: running kubelet and container runtimes in a Linux user namespace reduces blast radius of node-component CVEs like cr8escape and the 2023 runc procfs bypass; test in non-production clusters before v1.38 targets GA.
- CI/CD — Skip
- Leader — Learn: Rootless-node mode reaching beta signals a maturing Kubernetes security posture option; relevant context for teams in regulated industries evaluating host-isolation requirements, but no adoption decision warranted before GA.
- Signals: Kubernetes 1.37 EOL 2027-10-28 · Kubernetes 1.22 is past EOL (2022-10-28, 1408d ago) · pre-GA (alpha/beta/RC/preview) · CVE-2019-19921 — CISA KEV: not listed, EPSS 0.00 · CVE-2022-0811 — CISA KEV: not listed, EPSS 0.19 · CVE-2023-27561 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Enterprise admins can now enforce content exclusion policies in Copilot app and CLI, which matters for orgs managing sensitive codebases; worth confirming your exclusion rules extend to these surfaces if Copilot is in the standard toolchain.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: Audit build scripts, custom GitHub Actions, and any Node.js-based pipeline tooling for vm2 usage; if found, update to 3.11.7 and disable require.external — the blog post describes a working exploit path (CVSS 10.0), so exposure is concrete even without a KEV entry. No forced deadline, but the publicly documented exploit makes this a near-term project, not a watch item.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Conceptual framing on trust and governance for AI agents as org adoption grows; useful for shaping early policy on AI tooling in the platform, but no actionable decision required now.
- Platform/SRE — Plan: CVM node pools on AKS are now GA, enabling sensitive workload isolation at the hardware level; evaluate whether regulated or high-sensitivity workloads in your clusters warrant migrating to CVM node pools this quarter.
- CI/CD — Skip
- Leader — Learn: GA confidential compute on AKS is a new capability relevant to compliance and data-sovereignty positioning, but no immediate strategic decision is required unless the org has active regulated-workload requirements on Azure.
- Signals: GA announcement
- Platform/SRE — Plan: v1.39.1 fixes multiple CVEs in Envoy’s HTTP/3 (UAF, CVE-2026-73512), HTTP/2 (process termination, CVE-2026-73513), and connection-handling paths — real data-plane exposure for any Istio, Contour, or Envoy-based ingress deployment. None are KEV-listed or confirmed exploited, so schedule patching this sprint rather than treating it as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-73511 — CISA KEV: not listed, EPSS n/a · CVE-2026-73512 — CISA KEV: not listed, EPSS n/a · CVE-2026-73513 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Envoy is a common data-plane component in service meshes and ingress layers; this patch addresses a use-after-free in HTTP/3, process-termination bugs in HTTP/2, and multiple URL-normalization bypasses. No KEV listing or known active exploitation, so no hard deadline, but upgrade to v1.38.4 should be scheduled this sprint for any fleet running Envoy.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-73511 — CISA KEV: not listed, EPSS n/a · CVE-2026-73512 — CISA KEV: not listed, EPSS n/a · CVE-2026-73513 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Nine CVEs addressed including a UAF on HTTP/3, abnormal process termination on HTTP/2 trailers and ext_authz CONNECT requests, and a shared upstream connection-poisoning bug via HTTP upgrade — none are KEV-listed but the severity warrants scheduling an upgrade to v1.37.6 this sprint for any cluster running Envoy as ingress or data-plane proxy.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-73511 — CISA KEV: not listed, EPSS n/a · CVE-2026-73512 — CISA KEV: not listed, EPSS n/a · CVE-2026-73513 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Backstage is IDP infrastructure platform engineers commonly operate; this patch carries security fixes with no CVE details or KEV/exploitation data in the signals. Schedule upgrade to 1.49.6 within the current patch cycle — no hard deadline anchors Act.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If you self-host Backstage as your internal developer platform, schedule an upgrade to 1.50.5; the release is flagged as a security fix recommended for all 1.50 users, though no specific CVE or active-exploitation evidence is provided in the signals to anchor an Act verdict.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: CVE-2026-14978 (Unicode normalization in go-slug) can cause files to leak into HCP Terraform/TFE runs despite .terraformignore rules; not KEV-listed and EPSS 0.00, but worth upgrading Terraform to 1.15.9 in the next maintenance window if you upload sensitive files via remote runs.
- CI/CD — Plan: If pipelines run Terraform remote operations against HCP Terraform or Terraform Enterprise, the .terraformignore bypass in CVE-2026-14978 could leak secrets or config files into run uploads; pin Terraform to 1.15.9 in CI pipeline tooling during the next scheduled update.
- Leader — Skip
- Signals: CVE-2026-14978 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Act: OpenTofu 1.11 hit EOL on 2026-08-19 and this is its final patch; the credential-leak via OCI HTTP redirect and the DoS via crafted remote-state URLs are both active security risks in IaC runs. Upgrade to a supported OpenTofu release series (1.12+) now that EOL has passed.
- CI/CD — Act: The credential-leak bug affects
tofu initwhen pulling modules or providers from OCI registries — a standard pipeline step — and could expose registry credentials to a redirect target. Upgrade the OpenTofu version pinned in CI pipelines from 1.11.x to a supported series immediately; 1.11 is already EOL. - Leader — Skip
- Signals: OpenTofu 1.11 is past EOL (2026-08-19, 5d ago)
- Platform/SRE — Plan: Two security fixes affect IaC workflows: credentials intended for an OCI registry origin can leak to HTTP redirect targets, and tofu init can be forced into high CPU/memory usage via crafted URLs from an attacker-controlled state backend or registry. Upgrade OpenTofu to 1.12.6 in your IaC toolchain this sprint; no KEV listing or confirmed active exploitation, but both issues are directly triggerable in adversarial environments.
- CI/CD — Plan: If tofu init runs in your pipelines against external module/provider registries or remote state backends, both the credential-leak and resource-exhaustion issues apply there too. Pin the OpenTofu version in your pipeline tooling to 1.12.6 as part of your next dependency update cycle.
- Leader — Skip
- Platform/SRE — Plan: CVE-2026-17183 is patched in 13.2.0; EPSS is 0.00 and it is not KEV-listed, so there is no emergency, but schedule an upgrade of self-hosted Grafana this quarter to pick up the security fix and the alerting notifications API migration to v1beta1.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-17183 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: CVE-2026-17183 is fixed in this patch for Grafana, which is common observability infrastructure. Not KEV-listed and EPSS is 0.00, so no forced urgency, but schedule an upgrade to 13.0.7 this sprint as standard security hygiene.
- CI/CD — Skip
- Leader — Skip
- Signals: major release (13.0) · CVE-2026-17183 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Grafana 12.4.9 includes a security fix for CVE-2026-17183 (not KEV-listed, EPSS 0.00 — no active exploitation). Schedule an upgrade to 12.4.9 in your next maintenance window; no emergency action required.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-17183 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Teams self-hosting GitLab should note that 19.3 reaches EOL 2026-11-19 (~90 days); plan an upgrade to 19.4 or later before that date to stay on a supported version.
- CI/CD — Learn: GitLab 19.3 GA adds bulk false-positive dismissal and agentic SAST remediation for existing vulnerability backlogs — worth evaluating if your pipelines already produce GitLab SAST findings, but no urgent action is required.
- Leader — Skip
- Signals: GitLab 19.3 reaches EOL in 90d (2026-11-19)
- Platform/SRE — Skip
- CI/CD — Learn: New dismissal reason in GitHub Code Scanning lets teams mark alerts as mitigated by external controls (e.g., WAF), reducing noise without falsely closing vulnerabilities — worth noting if you manage GHAS alert triage workflows.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: A historical framing of data sovereignty principles that may shape thinking on where workloads run and how cloud-native architectures handle jurisdictional data controls — no decision required, but relevant context for platform strategy.
- Platform/SRE — Learn: Useful new GitHub admin capability for scoping credential revocation by token type during incidents, but no infra dependency or deadline — worth knowing for incident runbooks.
- CI/CD — Plan: Scope incident response playbooks to leverage token-type revocation for PATs, OAuth tokens, and GitHub App tokens; audit current credential hygiene and update runbooks to use this targeted revocation before the next supply-chain incident.
- Leader — Skip
- Platform/SRE — Learn: The incident data on 17,600 attacker actions is a useful framing for why platform-level controls (observation, constraint, blast-radius limiting) matter for agentic workloads, but there is no deployment action or deadline here — useful for teams beginning to run AI agents on shared infrastructure.
- CI/CD — Skip
- Leader — Learn: Relevant context for leaders setting AI adoption standards: the argument that agent governance requires systemic controls, not per-action review, shapes how to frame agentic AI policy, but no licensing, cost, or vendor decision is forced by this piece.
- Platform/SRE — Plan: v3.3.14 patches CLI secret-mask spoofing and fixes secrets leaking in last-applied-configuration annotations; CVE-2026-49978 (DOMPurify) is not KEV-listed and carries EPSS 0.00, so no emergency — schedule the upgrade within the quarter.
- CI/CD — Plan: Argo CD is explicitly in scope as the GitOps delivery layer; the server-side diff secret-mask spoofing fix could expose sensitive data in pipeline contexts — plan the upgrade to v3.3.14 this quarter.
- Leader — Skip
- Signals: Argo CD 3.3 supported · CVE-2026-49978 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Skip
- CI/CD — Learn: If pipelines use GitHub OAuth Apps for automation or registry auth, expiring tokens and refresh support may require updates to credential flows — worth evaluating when authoring new integrations.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Defining least-privilege and containment boundaries for enterprise AI agents is a real governance gap; this Docker framework sketches six security outcomes worth comparing against internal AI adoption standards, even accounting for its vendor-blog origin.
- Platform/SRE — Plan: Role manager can simplify onboarding new AWS services by auto-generating least-privilege starter roles, but teams with strict IaC discipline should evaluate whether console-created roles conflict with Terraform/CDK-managed IAM. Schedule a review of how role manager interacts with existing role governance before enabling org-wide.
- CI/CD — Skip
- Leader — Learn: Role manager lowers the barrier to correct IAM role setup for console-driven workflows, which may reduce misconfiguration risk across teams; worth noting as a governance tool but no immediate strategic decision required.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: Jenkins 2.576 ships multiple security fixes; review the 2026-08-05 security advisory and plan an upgrade of any self-hosted Jenkins controllers to this weekly build or wait for the next LTS incorporating these patches.
- Leader — Skip
- Platform/SRE — Plan: Grafana 13.1.2 fixes CVE-2026-13438 in software Platform teams commonly operate; schedule the upgrade this sprint. No forced timeline — the CVE is not KEV-listed and no active exploitation is reported.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-13438 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Patch includes dependency updates for CVE-2026-56852 and GHSA-hrxh-6v49-42gf (neither KEV-listed nor actively exploited) plus a PromQL SIGBUS crash fix on full disks; schedule an upgrade to 3.13.2 this maintenance cycle.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-56852 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Upgrade Docker Engine to v29.7.0 to patch CVE-2026-17106 (go-archive archive-traversal fix) and resolve two daemon panic bugs in container network cleanup paths; the CVE is not KEV-listed so no hard deadline, but schedule this within the current sprint.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-17106 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Skip
- CI/CD — Learn: Describes an integration pattern where Claude flags issues at authoring time and GitLab enforces controls through merge, dependency update, and infra change stages; worth tracking as AI-assisted supply-chain governance matures, but no concrete pipeline change to make today.
- Leader — Learn: Outlines a governance model for agentic coding at scale — pairing Claude security guidance with GitLab policy enforcement — relevant for leaders setting standards around AI-assisted development, but no licensing or cost decision is triggered here.
- Platform/SRE — Learn: If you run Cortex for long-term Prometheus/OTel storage, review the published audit findings to check whether any discovered issues affect your deployment configuration.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: GitHub now holds potentially malicious workflow runs for review in public repositories; audit your org’s Actions approval settings and ensure maintainers understand how to review held runs before merging external contributions.
- Leader — Learn: GitHub’s new default protection against credential-stealing workflow attacks reduces supply-chain risk for orgs using public repos; worth noting as a positive vendor-risk signal when assessing GitHub Actions dependency.
- Platform/SRE — Skip
- CI/CD — Plan: Enable or verify Dependabot alerts are active across your repos to benefit from the expanded OpenSSF malicious-package coverage; no deadline, but this materially improves supply-chain detection in your dependency pipeline.
- Leader — Plan: Broader malware signal coverage from OpenSSF integration strengthens your software supply-chain posture — confirm Dependabot alerts are enabled org-wide as a policy standard this quarter.
- Platform/SRE — Skip
- CI/CD — Learn: CodeQL 2.26.1 brings improved framework coverage for Go and better analysis accuracy; worth noting if you run GitHub code scanning in pipelines, but this is a patch-level quality improvement with no breaking changes or deadline.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: GitHub now holds unproven workflows pending approval on public repos — review your repository settings and approval workflows to ensure this protection is enabled and fits your release process.
- Leader — Learn: A new GitHub platform-level control targeting supply chain attacks via compromised credentials; worth noting as a defense-in-depth signal for orgs that rely on GitHub Actions for public repositories.
- Platform/SRE — Plan: A security fix for an ECH pre-shared key identity leak in OpenTofu v1.11.x warrants upgrading to v1.11.13; no KEV listing or active exploitation reported, so this is a planned patch rather than an emergency — schedule the upgrade this sprint.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Act: If you operate GitHub Enterprise Server, review the new security requirements for support bundle uploads and ensure your GHES instance is compliant before August 18, 2026, or uploads will be rejected, hampering incident troubleshooting.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: A panel of enterprise security leaders sharing governance frameworks for agentic AI is worth a read for leaders thinking through AI policy; no concrete product or standard to act on yet.
- Platform/SRE — Learn: An interesting open-source SIEM/XDR option using eBPF monitoring and high-throughput ingestion; worth evaluating as an observability and security pipeline component, but no EOL pressure or operational urgency.
- CI/CD — Skip
- Leader — Learn: A nascent open-source SIEM/XDR project worth watching as a potential alternative to commercial SIEM vendors, but too early (60 stars, no enrichment signals) to drive a platform strategy decision.
- Platform/SRE — Plan: v1.39.0 patches several CVEs across ext_authz, ext_proc, gRPC stats, and HTTP/2/HTTP/3 DoS vectors, but none are KEV-listed and EPSS is 0.00 — no hard deadline. Plan the upgrade this quarter, and validate the breaking TLS enforcement change and OpenTelemetry sampling behavior shift in staging before rolling to production.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found) · breaking-change flagged · CVE-2026-47204 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-47205 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-47207 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Five CVEs fixed in Docker Engine including a command injection via git bundle checkout and a directory traversal that can wipe /tmp — no KEV listing or known active exploitation, but the severity warrants scheduling an upgrade to 29.6.2 this sprint.
- CI/CD — Plan: If Docker Engine runs on self-hosted CI runners or build hosts, the git-bundle command injection (CVE-2026-15793) and local-source upload bypass (CVE-2026-15789) are directly relevant to build-time workloads; plan to update runner environments to Docker 29.6.2.
- Leader — Skip
- Signals: CVE-2026-15788 — CISA KEV: not listed, EPSS n/a · CVE-2026-15789 — CISA KEV: not listed, EPSS n/a · CVE-2026-15791 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Learn: A case study on AI agent risk in production environments; useful for thinking about isolation and least-privilege patterns when AI tooling has infra access, but no operational change required.
- CI/CD — Learn: Relevant to teams integrating coding agents into build/deploy pipelines; the scoped-identity and sandboxed-execution patterns are worth evaluating before granting agents pipeline credentials.
- Leader — Learn: A concrete incident narrative illustrating the risk of ungoverned AI agent access to production systems; useful context for setting policy on AI tooling permissions before broader rollout.
- Platform/SRE — Learn: Useful pattern for air-gapped or registry-mirrored clusters: configure kubelet to use an internal mirror for the pause/infra image instead of registry.k8s.io. No deadline, but worth evaluating if egress control is a concern.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Public-preview slash command that surfaces security findings on in-flight changes within the Copilot app; worth monitoring as it matures, but pre-GA status caps this at Learn with no pipeline action today.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: GitHub’s AI-powered security detections now surface on PRs for languages CodeQL doesn’t cover — worth enabling to broaden supply-chain and vulnerability coverage in existing GitHub Actions workflows.
- Leader — Learn: Expanded AI security coverage on PRs broadens GitHub’s appeal as a unified code-security platform, relevant if evaluating whether GitHub Advanced Security covers the org’s language portfolio.
- Platform/SRE — Learn: Post-quantum crypto migration is a long-horizon concern for platform teams managing secrets and TLS; no deadline or concrete action is anchored in this item, so monitor evolving standards and evaluate Vault’s roadmap when NIST PQC finalization timelines solidify.
- CI/CD — Skip
- Leader — Learn: Signals an emerging strategic risk around long-lived cryptographic assets, but no vendor mandate or licensing consequence is present yet — worth adding to the security strategy roadmap as a future planning item.
- Platform/SRE — Plan: Prometheus is core observability infrastructure; upgrade to v3.5.5 to patch CVE-2026-53606 in the UI’s sanitize-html dependency. Exploitation risk is low (EPSS 0.00, not KEV-listed), so this is routine patching rather than an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-53606 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Skip
- CI/CD — Plan: Two deserialization restrictions (COWL/PersistedList and Object fields by default) are meaningful security hardening in the Jenkins controller; review whether your instance is affected and schedule an upgrade within your normal maintenance window.
- Leader — Skip
- Platform/SRE — Learn: Grafana’s PIR confirms no customer production impact and no Grafana Cloud compromise from the TanStack npm attack; useful background on how supply chain attacks can reach observability vendors, but no operational change is required.
- CI/CD — Learn: The report details how a compromised npm package triggered a ransom incident and exposed a missed credential rotation — valuable for evaluating the depth of your own supply chain audit and rotation runbooks, even though Grafana’s customer pipelines were unaffected.
- Leader — Learn: Grafana’s independently audited transparency report (Mandiant confirmed no code tampering or repository poisoning) is useful context for assessing vendor security maturity; no strategic action is required since customer exposure was ruled out.
- Platform/SRE — Skip
- CI/CD — Learn: If your pipelines parse or display GitHub secret scanning output, the renamed detector type labels may affect dashboards or tooling that filters by those names — low urgency, no deadline.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: If pipelines run CodeQL scanning on Kotlin 2.4.0 codebases, upgrade to CodeQL 2.26.0 this quarter to maintain scan coverage; the new AI prompt injection queries are worth enabling if building LLM-integrated apps.
- Leader — Skip