verdict: Act · 27 items
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised, enabling potential MITM against any service trusting those CAs; upgrade Envoy to v1.40.1 now to remove trust in those CAs from the proxy trust store. If running Istio, also review the peer metadata label-fallback behavior change, which affects source_app/destination_app attribution in telemetry.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.40 EOL 2027-10-13
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised, meaning any Envoy instance still trusting those CAs is exposed to forged-certificate MITM attacks; upgrade Envoy to v1.39.5 now to remove trust of the affected roots from docker images and the Hickory DNS-over-TLS/HTTPS resolver.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised — Envoy instances running older versions still trust those CAs, leaving upstream TLS connections exposed to potential MITM via fraudulent certificates. Upgrade Envoy to v1.38.8 to remove trust in the compromised CAs; Envoy 1.38 is supported until 2027-04-23 so the upgrade path is available now.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23
- Platform/SRE — Act: CVSS 9.2 pre-auth RCE in the PHP engine itself with a vendor-confirmed attack path on Apache/mod_php and no application-level workaround; upgrade every web-serving host or container to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 now (patch released 2026-10-21).
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, reported by 2 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, reported by 2 collected sources
- Platform/SRE — Skip
- CI/CD — Act: The
businessfield insecret_scanning_alert.*andsecret_scanning_push_protection.bypassaudit log events changes on November 12, 2026; audit any automation, SIEM integrations, or compliance scripts that parse these events and update field references before that date. - Leader — Skip
- Platform/SRE — Act: Envoy 1.36 reaches end-of-life on 2026-10-14 — apply v1.36.13 now (includes CVE-2026-54786 wasm fix and three race-condition fixes) and immediately begin upgrading to a supported Envoy minor version before that date.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.36 reaches EOL in 2d (2026-10-14) · CVE-2026-54786 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Skip
- CI/CD — Act: Any pipeline referencing the macOS 14 runner label will fail when GitHub begins pre-retirement disruption runs, then permanently break on November 2, 2026. Audit all workflow files and replace ‘macos-14’ with ‘macos-15’ (or another supported image) before that date.
- Leader — Skip
- Signals: deprecation/EOL deadline mentioned: November 2, 2026
- Platform/SRE — Act: If your org uses GitHub Enterprise Cloud with data residency, audit any internal tooling, Terraform GitHub provider clients, or API automation that may negotiate TLS using only X25519 before October 7 — connections from those clients will break.
- CI/CD — Act: Verify that CI runners and pipeline scripts connecting to GHE.com with data residency use a TLS stack that offers multiple key-agreement algorithms, not X25519 exclusively; the hard cutoff is October 7, 2026.
- Leader — Skip
- Platform/SRE — Act: The NVv4-series VM SKUs were decommissioned on 2026-09-30 — any workloads or node pools still using these SKUs are now unsupported; migrate to a current GPU-capable series (e.g. NVadsA10 v5) immediately.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation/EOL deadline mentioned: September 30, 2026
- Platform/SRE — Act: The NVv3-series retirement deadline was September 30, 2026 — audit all Azure subscriptions immediately for remaining NVv3 instances and migrate to NVv4 or NVadsA10 v5 series before Azure force-deallocates any remaining VMs.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation/EOL deadline mentioned: September 30, 2026
- Platform/SRE — Skip
- CI/CD — Act: Minimum version enforcement for self-hosted runners on GitHub Enterprise Cloud took effect September 28, 2026; audit all self-hosted runner instances immediately and upgrade any falling below the new minimum version to prevent pipeline failures across every team using them.
- Leader — Skip
- Platform/SRE — Act: The GCP Legacy Monitoring agent has officially reached end of support with all maintenance and bug fixes ceased; audit GCP VM instances for legacy agent usage and migrate to Ops Agent or OpenTelemetry now. A breaking Cloud Logging change also restricts billing account log writes to GCP platform services only — audit any custom logging pipelines writing to billingAccounts/…/logs/… paths and update them.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found)
- Platform/SRE — Skip
- CI/CD — Act: Node 20 is already gone from GitHub Actions runners and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION escape hatch is also removed, meaning any JavaScript actions still targeting Node 20 are broken now. Audit all JavaScript actions in your pipelines and update them to Node 24 compatibility immediately.
- Leader — Skip
- Platform/SRE — Act: P100 GPU instances are already shut down as of September 15, 2026 — audit immediately for any affected workloads. T4 and P4 GPUs reach EOS on August 1, 2027; begin migration planning to G2 (L4) or G4 (RTX PRO 6000) machine series before that date.
- CI/CD — Skip
- Leader — Plan: T4 and P4 GPU EOL on August 1, 2027 blocks new 3-year CUD purchases and renewals for those SKUs; review any committed GPU spend and revise infrastructure roadmap to target supported machine series (G2/G4) within this planning cycle.
- Signals: deprecation/EOL deadline mentioned: September 22, 2026; September 15, 2026; August 1, 2027
- Platform/SRE — Skip
- CI/CD — Act: Unauthenticated GitLab.com API requests will be hard-capped at 60/hour per IP starting October 19, 2026 — automation running against paid accounts without credentials is also affected. Audit all pipelines and scripts for unauthenticated GitLab.com calls and ensure they use authenticated tokens before October 19; a preview enforcement window runs October 7 and 14.
- Leader — Plan: Rate limits will align with subscription tier (Free on October 19, Premium/Ultimate in January 2027), which may expose gaps in how teams authenticate automation or whether the org’s tier is adequate. Schedule a review of GitLab.com subscription tier and org-wide authentication standards before October 19.
- Platform/SRE — Act: If running the containerized SAP data connector, the images are removed October 14, 2026 — migrate to a supported log-forwarding method before that date to avoid broken data ingestion.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation/EOL deadline mentioned: October 14, 2026; September 14, 2026
- Platform/SRE — Plan: SHA-1 HTTPS on GitHub is now enforced (2026-09-15); audit any infrastructure tooling—Terraform module fetches, Helm chart sources, custom operators—that connects to GitHub via HTTPS and update any clients running legacy TLS libraries before they surface connectivity failures.
- CI/CD — Act: Enforcement is live as of 2026-09-15—any runner image or build tool using an old TLS stack that negotiates SHA-1 for HTTPS connections to GitHub is already failing; audit runner images and git client versions immediately and update or replace those using legacy OpenSSL/TLS configurations.
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found)
- Platform/SRE — Act: Migrate AKS node pools off Azure Linux with OS Guard to Azure Container Linux before December 10, 2026 — after that date, creation of new nodes with that OS config will be blocked.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation/EOL deadline mentioned: December 10, 2026
- Platform/SRE — Act: The PGP signing key for GitHub CLI APT/RPM repos expires 2026-09-05; any managed Linux host that auto-installs or updates
ghvia apt/rpm will fail package-signature verification on the first release after that date. Update the trusted keyring on those hosts today. - CI/CD — Act: Pipelines that install
ghon Linux runners via apt or rpm will break signature verification starting with the first release after 2026-09-05; update the keyring import step in CI configs, runner setup scripts, or Dockerfiles immediately to add the new PGP key before pipelines go red. - Leader — Skip
- Platform/SRE — Act: The Minimus registry goes offline October 22, 2026; audit all Dockerfiles, Helm charts, and Kubernetes manifests for Minimus base image references and complete migration to Docker Hardened Images before that date to prevent broken image pulls in production.
- CI/CD — Act: Any pipeline pulling from the Minimus registry will break after October 22, 2026; inventory all build Dockerfiles and CI base-image references now and migrate to Docker Hardened Images using the provided migration path and Docker’s free migration assistance before the deadline.
- Leader — Skip
- Platform/SRE — Act: OpenTofu 1.11 hit EOL on 2026-08-19 and this is its final patch; the credential-leak via OCI HTTP redirect and the DoS via crafted remote-state URLs are both active security risks in IaC runs. Upgrade to a supported OpenTofu release series (1.12+) now that EOL has passed.
- CI/CD — Act: The credential-leak bug affects
tofu initwhen pulling modules or providers from OCI registries — a standard pipeline step — and could expose registry credentials to a redirect target. Upgrade the OpenTofu version pinned in CI pipelines from 1.11.x to a supported series immediately; 1.11 is already EOL. - Leader — Skip
- Signals: OpenTofu 1.11 is past EOL (2026-08-19, 5d ago)
- Platform/SRE — Plan: If running a self-managed GitLab instance, upgrade to the patched version in your release line; no public PoC or KEV listing is confirmed from the title alone, so this is urgent-but-scheduled rather than emergency.
- CI/CD — Act: GitLab CI users on self-managed instances should upgrade to 19.2.4, 19.1.6, 19.0.8, or 18.11.11 promptly — a critical patch to the CI/CD platform itself can directly break or compromise pipelines and should be treated as an outage-level priority.
- Leader — Skip
- Signals: major release (19.0)
- Platform/SRE — Skip
- CI/CD — Act: Published GHSA-pp25-4cg4-qcr9 details a critical server-side template injection in serena-agent ≤1.6.1 that executes arbitrary code via a malicious .serena/project.yml smuggled in any cloned repo — a direct supply-chain threat to developer and CI environments; upgrade to serena-agent 1.7.0 now.
- Leader — Plan: This is an early, documented example of a new risk class: MCP servers embedded in the SDL grant LLMs broad filesystem and shell access, making any compromise severe; evaluate whether your AI coding-agent adoption policies explicitly address this attack surface before broader org rollout.
- Platform/SRE — Act: If you run the containerized SAP data connector agent for Microsoft Sentinel, migrate to the replacement agent before September 14, 2026, when the agent will be permanently disabled and SAP log ingestion will stop.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation/EOL deadline mentioned: September 14, 2026
- Platform/SRE — Act: If you operate GitHub Enterprise Server, review the new security requirements for support bundle uploads and ensure your GHES instance is compliant before August 18, 2026, or uploads will be rejected, hampering incident troubleshooting.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Act: GCP Batch will reject jobs whose
allowedLocations[]field lists regions or zones outside the job’s own location; the deadline is July 31, 2026 for most projects (June 30, 2027 for projects that already submitted a cross-region job before that date). Audit all Batch workloads for cross-regionallowedLocations[]entries and restrict them to the job’s location before July 31, 2026. - CI/CD — Skip
- Leader — Skip
- Platform/SRE — Act: ingress-nginx reached end-of-life in March 2026 (now four months past); remaining on it means exposure to unpatched CVEs in a critical ingress path with no upstream fixes coming. Audit clusters for ingress-nginx usage and complete migration to a maintained alternative (Envoy Gateway, Ingress-NGINX from F5, Traefik) immediately.
- CI/CD — Skip
- Leader — Act: The SIG Network ingress-nginx controller is retired, making any org standardized on it subject to growing unpatched CVE exposure with no remediation path; this warrants a brief to leadership and a decision on a replacement ingress standard before the vulnerability surface widens further.
- Signals: deprecation mentioned (no explicit date found)