GitHub Actions macOS 14 Runner Retirement: Survive the October Brownouts and Migrate Before November 2 Starting October 5, 2026 at 14:00 UTC, GitHub will deliberately fail every job that asks for a macOS 14 hosted runner, for ten hours at a time, on eight separate days this month. On November 2, 2026 the image goes …

Terraform Google Provider 8.0: Breaking Changes and Upgrade Guide HashiCorp announced the Terraform provider for Google Cloud 8.0 as generally available on September 22, 2026. If you've got GCP infrastructure sitting on an unpinned >= 7.0 constraint, the next terraform init -upgrade (or even a routine CI run, if you …

GitHub's New Runner Deprecation API: Automate Your Self-Hosted Fleet Audit If you manage self-hosted GitHub Actions runners, you've probably already been checking versions by hand — SSH into a box, run ./run.sh --version, repeat for every machine. On September 3, 2026, GitHub shipped a REST API that makes that manual …

Fix CVE-2026-83497: OpenSearch SQL Plugin Deserialization RCE via Cursor Pagination If you run OpenSearch — self-managed or Amazon OpenSearch Service — and have the SQL plugin enabled, a user with nothing more than basic read/search rights can get arbitrary code execution on your cluster right now. CVE-2026-83497, …

GitHub Disabled SHA-1 in HTTPS: Fixing Git Clone/Push SSL Errors After Sept 15, 2026 On September 15, 2026, GitHub completely disabled SHA-1 in HTTPS/TLS connections to github.com, GitHub Enterprise Cloud, and its partner CDNs. If a git clone, git push, or a script calling the GitHub API over HTTPS suddenly started …

GitHub Actions Ubuntu 26.04 Migration: What Breaks When ubuntu-latest Moves On September 17, 2026, GitHub announced that the ubuntu-latest runner label is moving from Ubuntu 24.04 to Ubuntu 26.04, rolling out gradually between October 19 and November 19, 2026. If your workflows just say runs-on: ubuntu-latest and …

Copy an EBS Volume to Another AWS Account: Cross-Account Volume Clones Setup Guide Refreshing a dev or test account with real production data has always meant snapshot the volume, copy the snapshot cross-account, share it, wait, then restore a new volume from it — four separate operations before anyone can attach a …

Block GitHub Pull Requests With Exposed Secrets: New Ruleset Rule Setup Guide Push protection catches a lot of leaked secrets, but it has always had a gap: it only inspects the commits in a single git push. A secret that slipped in through a squash-merged branch, a force-push that bypassed protection, a fork PR from a …

Azure User-Bound Delegation SAS Is GA: Lock Storage Tokens to a Single Entra Identity Every SAS token you've ever generated for Azure Storage has the same underlying weakness: it's a bearer credential. Whoever holds the URL — the person you sent it to, whoever they forwarded it to, whoever it leaked to in a log line or …

Docker Engine 29.8.0: --umask Flag, Custom AppArmor Profiles, and CloudWatch Entity Logging Docker Engine 29.8.0 shipped on September 3, 2026, and it's a release worth actually reading the changelog for instead of skimming past. It doesn't add a headline feature — it closes four small, specific gaps that practitioners …