TLDR DevOps 2026-10-23

Every security review asks: what can the cloud provider access? The AWS Nitro System was built with no operator access, and no code changes required:

🚫 No operator access by design: No system or person can log in to Nitro hosts, read instance memory, or access customer data on encrypted EBS volumes.

📋 Authenticated, audited APIs only: Even AWS's most privileged operators are limited to authorized, audited APIs, none of which can access customer data.

⚡ Near bare-metal performance: The Nitro Hypervisor performs like bare metal for most workloads, so isolation doesn't cost throughput.

Learn how the AWS Nitro System delivers confidential computing →

Harness AI Budgets turns AI cost policies into enforced weekly spending limits scoped to a team, developer, model, or project. Access pauses at 100% until the weekly reset or an approved increase. In Harness' internal test, weekly AI spend per developer fell about 37%.

Two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21. Proof-of-concept exploit code is available, and the flaws affect every PHP version from PHP 5 onward. DigitalOcean is automatically patching WordPress instances on its Cloudways managed product, but customers running PHP on Droplets or other unmanaged services must update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 immediately. There are no patches for PHP 8.1 or earlier.

Grafana Labs announced Grafana Cloud updates covering AI operations, cost controls, and full-stack context. Assistant Watchers reached general availability, Adaptive Telemetry customers report cutting spend 30% to 50% on average, and the Grafana Marketplace launched with more than 30 plugins.

Jesse Suen of Akuity describes a fleet of over 200 clusters where every merge synced everywhere with no gate. He argues sync tools do not handle release tracking or promotion decisions and recommends staged promotion that rolls out in waves and halts on failed checks.

Large cascading deletes can turn a routine schema migration into an outage by holding locks while new queries queue behind the waiting migration. Soft deletes followed by bounded background cleanup keep transactions smaller, with additional pitfalls around unindexed foreign keys and logical replication.

Nathen Harvey of Google Cloud's DORA team presents 2025 survey findings from nearly 5,000 respondents, about 90% of whom use AI professionally. He argues AI amplifies existing organizational strengths and dysfunctions, and introduces the DORA AI Capabilities Model.

Your agent shouldn't depend on your laptop staying open. Run it on an always-on VPS with a 99.99% uptime guarantee, so it keeps working after you log offGet started

This MIT-licensed guide teaches users how to use Claude Code through 10 modules covering slash commands, hooks, skills, and MCP servers. Users can copy templates directly into projects or follow a self-assessment quiz to get a personalized roadmap. The current version, v2.1.302, is compatible with Claude Code 2.1+ and includes copy-paste templates for models including Claude Opus 5.5 and Claude Sonnet 5.5.

GitHub Actions workflow lockfiles pin actions and their transitive dependencies to reviewed commits while preserving readable tags in workflow files. The public preview includes a GitHub CLI extension to generate lockfiles, Dependabot integration to update them, and policies that require workflows to use them.

Private keys for eight widely trusted eMudhra intermediate certificates were compromised on October 19, allowing attackers to forge certificates for any domain. Cloudflare has patched its CDN, Zero Trust, and Tunnel products. Customers must update the Cloudflare One Client and 1.1.1.1 app to specific versions to remain protected.

Engineers at Radar tested whether adding context to coding agents improves Kubernetes diagnostics. When running 50 fault scenarios, agents with context reached a correct diagnosis within two minutes on 86% of faults, compared to 60% for agents using a standard shell. Accuracy improved only slightly with context, but the time savings were significant. The test used Claude Code and Microsoft's SREGym benchmark on a live Amazon EKS cluster.

GitHub released Actions Runner Controller 0.15.0, which sends smaller patch requests and moves runner status aggregation into metrics to reduce Kubernetes API updates.

Pulumi has released the NVIDIA AI Cluster Runtime (AICR) provider to help developers deploy self-hosted AI infrastructure.