280 posts tagged with "Security"
Cybersecurity, smart contract audits, and best practices
Your Tenants' 'edit' Role Could Steal Another Tenant's DNS Credentials: The cert-manager Challenge Bug and the RBAC Audit to Run Today
A cert-manager bug let any tenant with Kubernetes' built-in edit or admin role steal another tenant's DNS credentials through a crafted ACME Challenge — not from a misconfiguration, but from an RBAC aggregation label almost no one audits. Here's the mechanism and a six-check audit to run against your own multi-tenant TLS setup.
Cilium's Sidecarless mTLS Kills the Service-Mesh Tax — But Not the Way You'd Assume
Real numbers on what a sidecar mesh actually costs, how Cilium's eBPF mTLS removes it, and the eventually-consistent identity cache that a documented security review found exploitable — plus what a multi-tenant self-hosted PaaS should actually run.
Cloudflare Tunnel Is Now Fully Free — What Zero-Open-Ports Ingress Means for Your Self-Hosted PaaS
Cloudflare Tunnel is now free with unmetered bandwidth and unlimited tunnels — but an October 5, 2026 API change breaks anything scripted against its old routes. Here's what it buys a self-hosted PaaS's tenants, what it costs, and the migration checklist.
CNCF Buildpacks Graduation: What Reaching the Top Maturity Tier Actually Changes
Cloud Native Buildpacks reached CNCF's Graduated maturity level on July 17, 2026. Here's what the governance milestone actually verifies, what it doesn't change technically, and why it matters for a platform team betting its build layer on the spec.
Confidential Containers Reaches CNCF Incubation: What TEE-Attested Secrets Release Actually Costs a Self-Hosted PaaS
Confidential Containers just reached CNCF incubation, promising tenant code even the platform operator can't read. Here's what the TEE hardware, the Trustee attestation service, and the per-pod overhead actually cost to run on a self-hosted Hetzner fleet.
GitHub Copilot's Coding Agent Now Runs on Self-Hosted Runners — But You Have to Turn Off Its Firewall to Get There
GitHub's coding agent can now run on your own Actions Runner Controller fleet to reach internal registries and on-prem services — but doing so requires disabling its managed firewall entirely. Here's what changes, and the three ARC misconfigurations that leave the gap unguarded.
GitHub Agent HQ Runs Claude, Codex, and Copilot on the Same Repo — Here's the Trust Boundary Your MCP Server Actually Needs
GitHub Agent HQ runs Claude, Codex, and Copilot side by side on the same repo under one identity model — here's why a deploy platform's MCP server should authenticate the calling app, not the AI vendor behind it.
kpack: The Buildpack Controller That Rebuilds When the Base Layer Patches, Not When You Push
Most git-push PaaS tools only rebuild an app image when you push code — so a CVE patched into the base image sits unused until you happen to touch your source again. kpack's Image/Builder/ClusterStack CRDs close that gap by watching the base layer itself.
Your Post-Quantum TLS Migration Isn't a Second Certificate Format — It's the Same Freshness Problem You Already Solved for 6-Day Certs
Let's Encrypt is skipping a direct ML-DSA swap for Merkle Tree Certificates because the naive post-quantum handshake blows past 14,700 bytes. Here's the actual byte math, the late-2026 staging timeline, and what a self-hosted PaaS's ACME automation needs to track before production MTCs land in 2027.