ACM ACME Over AWS PrivateLink: Issue Public TLS Certificates From a VPC With No Internet Access On October 6, 2026, AWS Certificate Manager added AWS PrivateLink support for ACME issuance. A server in a subnet with no internet gateway and no NAT gateway can now request and renew a publicly trusted TLS certificate with …

Fix CVE-2026-83497: OpenSearch SQL Plugin Deserialization RCE via Cursor Pagination If you run OpenSearch — self-managed or Amazon OpenSearch Service — and have the SQL plugin enabled, a user with nothing more than basic read/search rights can get arbitrary code execution on your cluster right now. CVE-2026-83497, …

GitHub Disabled SHA-1 in HTTPS: Fixing Git Clone/Push SSL Errors After Sept 15, 2026 On September 15, 2026, GitHub completely disabled SHA-1 in HTTPS/TLS connections to github.com, GitHub Enterprise Cloud, and its partner CDNs. If a git clone, git push, or a script calling the GitHub API over HTTPS suddenly started …

Copy an EBS Volume to Another AWS Account: Cross-Account Volume Clones Setup Guide Refreshing a dev or test account with real production data has always meant snapshot the volume, copy the snapshot cross-account, share it, wait, then restore a new volume from it — four separate operations before anyone can attach a …

Block GitHub Pull Requests With Exposed Secrets: New Ruleset Rule Setup Guide Push protection catches a lot of leaked secrets, but it has always had a gap: it only inspects the commits in a single git push. A secret that slipped in through a squash-merged branch, a force-push that bypassed protection, a fork PR from a …

Azure User-Bound Delegation SAS Is GA: Lock Storage Tokens to a Single Entra Identity Every SAS token you've ever generated for Azure Storage has the same underlying weakness: it's a bearer credential. Whoever holds the URL — the person you sent it to, whoever they forwarded it to, whoever it leaked to in a log line or …

Docker Engine 29.8.0: --umask Flag, Custom AppArmor Profiles, and CloudWatch Entity Logging Docker Engine 29.8.0 shipped on September 3, 2026, and it's a release worth actually reading the changelog for instead of skimming past. It doesn't add a headline feature — it closes four small, specific gaps that practitioners …

Docker CopyEscape (CVE-2026-17106): Fix the docker cp Host File Overwrite Vulnerability If you or your CI pipeline ever run docker cp against a container you didn't fully trust — a scanning sidecar, a customer-submitted build, an AI-agent sandbox — you need to check your Docker version right now. CVE-2026-17106, …

Find Source IP Addresses Connecting to AWS Transfer Family SFTP with CloudWatch Logs Insights If your AWS Transfer Family SFTP server has CloudWatch logging turned on, every connection, login attempt, and file operation is already sitting in a log group — you just need the right query to pull the source IPs out of it. …

GitHub Actions' New vulnerability-alerts Permission: Read Dependabot Alerts Without a PAT If you've ever tried to have a GitHub Actions workflow check for open Dependabot alerts — to block a release, gate a merge, or post a Slack summary — you've probably hit a wall: the default GITHUB_TOKEN can't read them. The …