Cloudflare is launching early access to a service called Vulnerability Discovery and Remediation, which scans customer codebases for security flaws and proposes patches and firewall rules to fix them. The service uses OpenAI's GPT-5.6 Cyber model for reconnaissance, hunting, and validation, with model prompts routed through Cloudflare AI Gateway to OpenAI's servers. Cloudflare combines those findings with production traffic data and Web Application Firewall activity to help teams prioritize which vulnerabilities are actually exposed and under active attack. Access is invitation-only through Cloudflare's Managed Defense team, and customers must approve any proposed changes before they are deployed.
ClickHouse 26.8 adds pipelined SQL with a new |> operator that lets queries be written as an explicit sequence of transformations instead of relying on nested subqueries or CTEs. Each stage passes its result to the next, making multi-step filtering, aggregation, sorting, and limiting easier to read and compose.
Centralized identity gateways solve the limitations of SSO in federated AI and data platforms by making one service responsible for session creation, validation, refresh, and logout while regional gateways enforce local access policies. The pattern reduces duplicated authentication flows and upstream IdP load while enabling consistent identity propagation and delegated user authorization across Kubernetes clusters, data tools, and AI assistants.
ZGateway is a proxy tier that sits between clients and ZippyDB, Meta's most widely used key-value store. The system handles more than 1 billion operations per second and carries about 40% of ZippyDB traffic, adding roughly 6% computational overhead. The core problem it solves is connection sprawl: under direct access, a million-plus client hosts each maintained tens of thousands of TLS connections to database hosts, creating a many-to-many mesh that caused file-descriptor exhaustion and reboot loops during reconnection storms. By routing all traffic through a controlled proxy fleet, Meta reduced total persistent connections by roughly 19x and made fan-in independent of client population size.
Dropbox treats compute, storage, networking, power, cooling, rack density, and capacity planning as one interconnected optimization problem rather than independent infrastructure layers. The approach focuses on extracting more usable capacity from existing data centers through workload placement, fleet optimization, denser hardware, and lifecycle planning before expanding the physical footprint.
Diagram Design is a Claude Code skill that generates editorial-quality diagrams as self-contained HTML and SVG files. The skill works with Claude Code, Codex, Factory Droid, Pi, and Agent Skills-compatible hosts, and can also redraw existing draw.io or Mermaid diagrams in the same design system. Each diagram ships in three static variants (minimal light, minimal dark, and full-editorial) with no build step, no JavaScript dependencies, and no external images.
Alien is an open-source platform for deploying and operating software inside customer-owned AWS, GCP, and Azure environments while retaining centralized control over releases, monitoring, and lifecycle management. It supports push- and pull-based deployment models, automatic updates and rollbacks, remote commands without inbound networking, cross-cloud resource abstractions, and least-privilege IAM derived from an application's declared infrastructure.
AWS DevOps Agent, Kiro CLI, and LaunchDarkly form an autonomous experimentation loop that turns business goals into feature-flagged code changes, measured A/B tests, guarded rollouts, and iterative improvements. The system reduces planning and measurement overhead while using automated release reviews, runtime rollback, and recorded outcomes to safely optimize toward defined metrics.
YugabyteDB Resource Governance adds CPU controls for multi-tenant database clusters so a runaway query or traffic spike in one database does not starve other workloads sharing the same infrastructure. The system combines per-database CPU limits with fair sharing of unused capacity, allowing denser consolidation while maintaining workload isolation and predictable performance.
YOLO mode lets AI coding agents execute actions without approval prompts, improving productivity but increasing security risks when agents run directly on a host with access to files, credentials, and networks.
Anthropic's Model Hardware Standard (MHS) extends MCP-style agent interoperability from software into physical devices, creating new safety challenges where unreliable or repeated commands can cause real-world damage.
Sponsored
Buildkite, the pro-tool that hands you building blocks for CI orchestration and then gets out of the way.
Enough with constant downtime. No more band-aids or burden.
We provide programmable primitives you co-ordinate, running only what changes, across any cloud, any chip, your secrets, your infra.
Control without compromise. Build faster, more securely, more reliably, with the CI engineered for frontier scale, used by the teams setting the pace.
Kubernetes v1.37 makes horizontal pod autoscaling to zero replicas a Beta feature, enabled by default. A HorizontalPodAutoscaler can now scale a workload all the way down to zero pods and bring it back up based on object or external metrics, without requiring an add-on or Alpha feature gate as previous versions did. The feature works for queue consumers and batch processors but requires at least one object or external metric, since CPU and memory metrics disappear once no pods are running. The first Alpha version shipped in Kubernetes v1.16, and SIG Autoscaling plans to collect operational feedback before considering a GA graduation.
An unauthorized BGP announcement diverted traffic for a Softaculous-owned /24 for roughly 33 hours, allowing the attacker to intercept requests and obtain valid Let's Encrypt certificates because ACME validation traffic was hijacked too. A small number of Virtualizor systems later downloaded a malicious update package, showing how routing attacks can cascade into software supply-chain compromise.
Managed PostgreSQL services reduce the operational tax of self-hosting by transferring infrastructure, patching, backups, high availability, and platform security responsibilities to the provider. Self-managed PostgreSQL remains preferable when organizations need deep control, specialized configurations, unsupported extensions, or have mature platform engineering and operational capabilities.
KubeVirtBMC can be paired with Metal3, a CNCF incubating project, to provision KubeVirt virtual machines as if they were physical bare-metal servers. Metal3 uses OpenStack Ironic under the hood to handle hardware inspection, boot device control, and OS image writing via standard IPMI or Redfish interfaces. KubeVirtBMC creates virtual BMC endpoints for KubeVirt VMs, so Metal3 has no way to distinguish them from real hardware. This post walks through a full end-to-end setup that configures Redfish virtual media boot without PXE or DHCP and provisions a VM with a live ISO image.
A Kubernetes engineer describes how to move a service out of the default namespace without downtime, using an ExternalName service as a DNS-level forwarding address. The approach lets dozens of dependent services keep calling the old cluster-internal DNS name while traffic silently routes to the new deployment, with no code changes required from other teams. A temporary policy exception handled the ingress side, allowing both the old and new ingress rules to coexist briefly while traffic was confirmed on the new deployment before the old one was removed.
Magnitude is an open source inference server that runs AI models locally on your own hardware, with no internet connection required after setup. It profiles your machine, recommends models that fit your available memory, then downloads and runs them. The tool works with Pi, OpenCode, Hermes, OpenClaw, Codex, Claude Code, Oh My Pi, and Cline, and also supports custom GGUF models from Hugging Face.
Semantica is an open-source context and knowledge-graph layer for AI systems that turns enterprise data, agent decisions, and provenance into a structured, queryable graph. It supports deterministic reasoning with Datalog, SPARQL, Rete, and forward chaining, plus W3C PROV-O audit trails, SHACL/OWL ontology governance, conflict detection, and integrations with graph stores, vector databases, Databricks, Snowflake, LangChain, CrewAI, MCP, and other agent frameworks.
Agent optimization reduces AI costs by optimizing model selection, deployment, caching, prompts, agent configurations, and observability at runtime. Microsoft Foundry combines these capabilities into a continuous optimization loop that measures cost per successful outcome while maintaining quality, latency, and reliability.
Cloudflare has prototyped a system called Cache Transcoding that compresses eligible cached assets using the Zstandard algorithm before writing them to disk, shrinking those assets to roughly one-third of their original size on average. The system targets compressible text content like HTML, JSON, CSS, and JavaScript, which made up 67.3% of requests in Cloudflare's traffic sample but arrived uncompressed about 71% of the time. Encoding happens once when an asset enters the cache, while the CPU cost of decoding is paid on every serve at approximately 1.56 nanoseconds per byte. In testing across 10 cache servers with more than a million requests, the architecture stayed within its CPU budget at zstd level 3 with a 4 kibibyte minimum object size.
Go's newer map implementation uses a Swiss Table design that groups entries in small blocks with compact control bytes, allowing many candidate slots to be checked before doing full key comparisons. SIMD can compare multiple control bytes at once on supported CPUs, while the layout and growth strategy improve cache locality and lookup performance.
Cloud-native environments make periodic GRC checks obsolete because infrastructure and configurations change continuously.
HCP Vault Dedicated audit logs can reach Microsoft Sentinel through a Terraform-provisioned Azure pipeline using a generic HTTP sink, Azure Functions or Logic Apps, and Azure Monitor Logs Ingestion.
Sponsored
Technical leaders from Intel, IBM, Uber and more will gather in San Jose this September to talk search, observability, and AI workloads, and to connect with peers solving the same problems.
Get your ticket [4] for keynotes, hands-on sessions, and more:
* Leave with real production patterns for your team, not just slides * Build a full OpenTelemetry observability stack or an agentic AI search app in two hands-on Developer Workshops * Network with peers tackling the same search and observability challenges
2026.09.02·events.linuxfoundation.org·Sponsor·TLDR DevOps Storage version migration (SVM) is now generally available in Kubernetes v1.37, stable and enabled by default across all clusters running that version. The feature lets cluster administrators migrate stored API resources to a current storage version by creating a declarative StorageVersionMigration object, which the built-in control plane controller then handles automatically. Previously, admins had to rely on manual kubectl scripts or a separate out-of-tree component called kube-storage-version-migrator.
Wasmi 2.0 is roughly 2.2× faster than Wasmi 1.0 across its benchmark suite, largely through a redesigned interpreter that adds threaded-code dispatch, accumulator registers, and lower-overhead instruction handling. The release also preserves fast startup, adds options to reduce binary size, and includes stable fuel metering, deterministic WebAssembly support, and an improved CLI.
2026.09.02·wasmi-labs.github.io·23 min read·TLDR DevOps AI-driven development accelerates technical debt, making continuous modernization essential in legacy environments. A DIY approach using AWS Transform custom and GitHub Actions automates dependency remediation, documentation, repository-wide transformations, and continual learning, enabling ongoing modernization through CI/CD.
AWS has published a guide for building an automated incident response pipeline on Amazon EKS using a new open source tool called the DevOps Agent Operator. The Operator watches for pod failures like OOMKilled or IP exhaustion, immediately collects pod logs, node-level data, and Kubernetes events, then sends that data to AWS DevOps Agent via a webhook before evidence disappears.
Sponsored
Agents now write 76% of Laurel's PRs. Each one is verified pre-merge in a production-like environment on their own cluster. Only the changed services spin up. Nothing else is duplicated. With Signadot [12] and coding agents, their team of ~60 engineers ships 2,300+
OpenClaude is an open-source command-line coding agent that works with multiple AI backends, including OpenAI-compatible APIs, Gemini, GitHub Models, Codex, and Ollama.
ECC is an open-source engineering harness for coding agents that adds a reusable workflow around planning, testing, implementation, review, verification, memory, and continuous improvement. It ships with specialized agents, skills, hooks, rules, persistent memory, and security scanning, with strongest support for Claude Code plus integration paths for Codex and other agent environments.
Grafana 13.2 expands shared saved queries with search, RBAC, command palette access, and Terraform provisioning, while the new View panel sidebar improves exploration without edit permissions. Additional updates include Git Sync enhancements, a refreshed homepage, secure cloud data source authentication, improved variable editing, and dashboard organization.
Datadog monitored its own AI agents to uncover security lessons, starting with building an inventory of agent components. The effort also traced sensitive data flows and tool calls to identify risks across the agent stack.
OpenTelemetry achieved graduated status within the Cloud Native Computing Foundation in May, making it one of the few projects to reach that tier alongside Kubernetes and Prometheus. Graduated status means the project's contributor health, security standards, governance processes, and adoption have been evaluated at a level suitable for enterprise use at any scale.
Sponsored
Microsoft Azure autoscales when traffic spikes—adjusting capacity automatically so you can skip the scramble. With more global regions than any other cloud provider, you've always got room to grow. Scale
2026.09.02·links.tldrnewsletter.com·Sponsor·TLDR DevOps GCP cost optimization becomes difficult when billing data is disconnected from operational telemetry, making cost anomalies harder to attribute and resolve.
Datadog Serverless Monitoring now traces requests, reports enhanced CPU metrics, and profiles code across all Azure Functions hosting plans.
Amazon EC2 R9g and R9gd instances are now generally available, powered by AWS Graviton5 processors.
Sponsored
Buildkite is built differently: refined primitives orchestrated with a control plane that provides control with zero compromise.
OpenAI, Anthropic, Cursor, Meta, Uber, Shopify, Airbnb, Bazel, Backstage, vLLM and Reddit all standardized CI on Buildkite.
Hosted runners or your own infra; any cloud, any OS, any chip; MCP, models and pipeline triggers for agentic development; your secrets and source code never leaving your hands.
Kubernetes 1.37 brings Pod Certificates and Cluster Trust Bundles to general availability, adding X.509 certificate issuance for TLS and mTLS directly into core Kubernetes. The feature is designed as an alternative to service account JWTs, which are bearer tokens, meaning anyone who receives a copy of the token can use it to impersonate the workload. Pod Certificates use proof-of-possession credentials, so a workload proves it holds a private key without ever sending that key to a peer. The Kubernetes project has also released Tinycert, a third-party signer for experimenting with Pod Certificates, since no built-in signers ship with core Kubernetes yet.
ReactOS 0.4.16 adds a graphical installer, a combined live/install image, improved video, audio, networking, and storage support, and a new Server Core installation mode. The release also fixes a long-standing Nvidia slowdown caused by exhausted system page-table entries, introduces a new ATA driver for broader boot compatibility, adds asynchronous networking, and brings its Wine fork substantially closer to Wine 10.0.
Datadog saves more than $1 million monthly on AI usage through agent evaluations, spending guardrails, and context optimization. These measures let the company balance cost against performance without sacrificing either.
Taste develops through practicing a craft directly—trying, failing, making unexpected discoveries, and gradually forming a distinctive style—rather than simply judging outputs produced by others. Heavy use of generative AI can undermine that process by replacing practice with statistically average output and even acclimating users to AI-generated patterns, potentially weakening the judgment they hoped would differentiate them in the first place.
Developers can become “blind” to bugs and poor UX by unconsciously learning workarounds, causing teams to perceive severely flawed software as high quality even when normal users struggle with it. Dogfooding helps only if engineers actively notice these adaptations. Deliberately pointing out hidden friction can train teams to recognize quality problems before they become normalized.