TLDR DevOps 2026-10-26

Security approval is the top blocker to shipping AI agents, cited by 42% of teams in Nylas's State of Agentic AI: H2 2026 survey. Nylas IAM makes the reviewer's question easy to answer. Each service and agent gets its own API key, limited by permission and by boundary, from one mailbox up to a whole organization. Nylas checks every request before it reaches the provider and logs every call, including the ones it refuses. A read-only agent can draft a reply but can't send it. IAM is included on every plan.

See how Nylas IAM works

Google Cloud now offers an Anthropic-managed deployment option for Claude models alongside its Google-managed one. Both provide the same models on day zero at the same pricing. The Anthropic-managed option adds immediate access to Claude Platform features such as Managed Agents.

AWS has made Continuum for code vulnerabilities generally available. It builds a context graph of an AWS environment, tests findings for exploitability in a sandbox, and opens pull requests with patches. Teams start in Learn mode and can move to Enforce mode.

CVE-2026-111497, also known as Broccoli2Shell, is a critical vulnerability in the Brotli decompression library that allows remote code execution. The flaw affects Node.js, Bun, and Envoy Proxy. Wiz data shows 91% of cloud environments have vulnerable resources. Organizations should apply security updates and rebuild affected workloads.

A working root exploit for Linux kernel bug ZDI-CAN-33367 is public before a CVE or fix is available. TuxCare reproduced the proof of concept for local privilege escalation on Ubuntu, Debian, and AlmaLinux. A separate patch for the flaw is reviewed but not merged, and none of the six disclosed bugs has a CVE ID yet.

Neki "shard groups" let users co-locate related tables like customers and orders on the same physical cluster to keep joins and transactions local. Reference tables replicate lookup data to every shard, while global secondary indexes support queries that lack the shard key.

Cloudflare rebuilt range-request caching in Pingora to coordinate partial downloads across cached data and in-flight origin fetches. The redesign roughly halved R2's p99 time to first byte and eliminated customer-managed range sizes, while a follow-up improvement reduced tiered-cache traffic for R2 and similar workloads by about 6%.

Protecting workloads from cloud operator access shouldn't require work on your part. The AWS Nitro System provides strong isolation — monitoring, protecting, and verifying instance hardware and firmware. There is no mechanism for any person, including AWS's most privileged admins, to access instance memory. Learn more.

Coolify is an open-source, self-hostable PaaS alternative to Vercel, Heroku, and Netlify. It allows users to deploy static sites, databases, and full-stack applications on their own servers. The tool offers more than 360 one-click services and automatic HTTPS certificates.

QuestDB 10.1 adds optional merge-append partitions that reduce rewriting when late data arrives, with background compaction reclaiming obsolete rows. On QuestDB's public demo, enabling the feature reduced rows written per ingested row from about 440 to 8. The release also adds exact percentiles and SQL subsampling.

Kubernetes control planes run out of room in three independent ways: node count, object churn, and resident state. Joe Betz of Google describes four seams, including storage routing and cache residency, and a recipe ladder built from stock upstream components. Some seams still have upstream gaps.

Railway disclosed a security incident where an attacker accessed internal systems from October 20 to 22 to target AI provider API keys. Environment variables for approximately 100,000 workspaces, or 1.85% of the total, were potentially compromised. Railway revoked credentials with partner vendors and accelerated a rollout of single-tenant builder infrastructure.

Ads get ignored on social media but not in TLDR! Reach DevOps and platform engineers where they actually pay attention. Learn more about sponsorship opportunities.

Grafana Labs proposes applying SLOs and error budgets to AI agent behavior, such as a 95% target for fulfilled conversations over 30 days.

Prompt caching is now generally available on DigitalOcean Serverless Inference.