TLDR DEVOPS 2026-10-26

SEE HOW NYLAS IAM WORKS

AWS CONTINUUM FOR CODE VULNERABILITIES IS NOW GENERALLY AVAILABLE

AWS has made Continuum for code vulnerabilities generally available. It builds a context graph of an AWS environment, tests findings for exploitability in a sandbox, and opens pull requests with patches. Teams start in Learn mode and can move to Enforce mode.

EXPANDING CLAUDE AVAILABILITY AND DEPLOYMENT CHOICE ON GOOGLE CLOUD

Google Cloud now offers an Anthropic-managed deployment option for Claude models alongside its Google-managed one. Both provide the same models on day zero at the same pricing. The Anthropic-managed option adds immediate access to Claude Platform features such as Managed Agents.

BROCCOLI2SHELL: EVERYTHING YOU NEED TO KNOW ABOUT THE CRITICAL BROTLI DECODER VULNERABILITY

CVE-2026-111497, also known as Broccoli2Shell, is a critical vulnerability in the Brotli decompression library that allows remote code execution. The flaw affects Node.js, Bun, and Envoy Proxy. Wiz data shows 91% of cloud environments have vulnerable resources. Organizations should apply security updates and rebuild affected workloads.

DETECTING AND MITIGATING ZDI-CAN-33367 AND FIVE OTHER LINUX FLAWS

A working root exploit for Linux kernel bug ZDI-CAN-33367 is public before a CVE or fix is available. TuxCare reproduced the proof of concept for local privilege escalation on Ubuntu, Debian, and AlmaLinux. A separate patch for the flaw is reviewed but not merged, and none of the six disclosed bugs has a CVE ID yet.

SHARD DESIGN DOESN'T START FROM YOUR TABLES

Neki "shard groups" let users co-locate related tables like customers and orders on the same physical cluster to keep joins and transactions local. Reference tables replicate lookup data to every shard, while global secondary indexes support queries that lack the shard key.

ORIGIN RANGE REQUESTS: SERVING LARGE FILES WITHOUT RANGE-REQUEST TUNING

Cloudflare rebuilt range-request caching in Pingora to coordinate partial downloads across cached data and in-flight origin fetches. The redesign roughly halved R2's p99 time to first byte and eliminated customer-managed range sizes, while a follow-up improvement reduced tiered-cache traffic for R2 and similar workloads by about 6%.

privileged admins, to access instance memory. Learn more.

COOLIFY

Coolify is an open-source, self-hostable PaaS alternative to Vercel, Heroku, and Netlify. It allows users to deploy static sites, databases, and full-stack applications on their own servers. The tool offers more than 360 one-click services and automatic HTTPS certificates.

QUESTDB 10.1: FRESHER DATA, LESS I/O, AND MORE ANALYSIS IN SQL

QuestDB 10.1 adds optional merge-append partitions that reduce rewriting when late data arrives, with background compaction reclaiming obsolete rows. On QuestDB's public demo, enabling the feature reduced rows written per ingested row from about 440 to 8. The release also adds exact percentiles and SQL subsampling.

SCALE ISN'T ONE NUMBER: THREE WAYS A KUBERNETES CONTROL PLANE RUNS OUT OF ROOM

Kubernetes control planes run out of room in three independent ways: node count, object churn, and resident state. Joe Betz of Google describes four seams, including storage routing and cache residency, and a recipe ladder built from stock upstream components. Some seams still have upstream gaps.

RAILWAY PRELIMINARY REPORT: OCT 21ST SECURITY INCIDENT

Railway disclosed a security incident where an attacker accessed internal systems from October 20 to 22 to target AI provider API keys. Environment variables for approximately 100,000 workspaces, or 1.85% of the total, were potentially compromised. Railway revoked credentials with partner vendors and accelerated a rollout of single-tenant builder infrastructure.

GRAFANA APPLIES SLOS AND ERROR BUDGETS TO AI AGENT BEHAVIOUR

Grafana Labs proposes applying SLOs and error budgets to AI agent behavior, such as a 95% target for fulfilled conversations over 30 days.

PROMPT CACHING IS GA ON DIGITALOCEAN SERVERLESS INFERENCE: UP TO 90% OFF THE CONTEXT YOUR AGENTS RESEND

Prompt caching is now generally available on DigitalOcean Serverless Inference.