280 posts tagged with "Security"
Cybersecurity, smart contract audits, and best practices
CVE-2026-25518: The cert-manager Bug That Lets a Poisoned DNS Reply Crash Your Whole TLS Pipeline
A crafted DNS response can crash the cert-manager controller mid-renewal. Here's exactly what CVE-2026-25518 breaks, why the fix isn't just an upgrade, and the two config changes a self-hosted PaaS's TLS automation needs today.
Chainguard and Wolfi Cross 2,000 Zero-CVE Images: Should a Self-Hosted PaaS Default to Them?
Chainguard's Wolfi-based images cut CVE counts from ~280 to zero and shaved 60-80% off build time and egress in a real migration. Here's what defaulting a git-push PaaS's build output to Wolfi would actually change — and the honest build-vs-buy call against Chainguard's paid catalog.
containerd's June 2026 CRI Advisory: Three Ways to Escape a Shared Node That RuntimeClass Can't Stop
AWS's June 2026 bulletin disclosed five containerd CRI plugin CVEs, and patching the daemon — not picking gVisor or Kata for your RuntimeClass — is the only real fix. Here's what each bug requires and what a shared-node fleet needs to check this week.
Coolify Shipped an Audit Log. It Still Wouldn't Survive a SOC 2 Review.
Coolify v4.1 shipped the first structured audit log among self-hosted PaaS platforms — but it only covers API mutations. Here's the gap against a real SOC 2 review, and the checklist a compliance-ready deploy API actually needs.
The Jscrambler npm Backdoor Beat npm's 3-Day-Old Fix — What That Means for Your Build Pipeline's Secrets
A compromised Jscrambler npm release beat npm 12's new install-script defaults within three days, stealing CI credentials and AI tool configs. Here's the build-pipeline architecture — platform-enforced script policy, egress-denied sandboxes, ephemeral scoped credentials — that actually closes the gap.
Kubernetes Just Deprecated externalIPs. Here's the Exact Migration Path for Bare Metal
Kubernetes 1.36 deprecated Service externalIPs over a security hole the project never patched. Here's the exact four-stage removal timeline and the commands to migrate a bare-metal fleet to MetalLB before the default flips in 1.40.
One Binary, Six Categories: What Octelium's VPN-ZTNA-MCP-Gateway-PaaS Convergence Actually Buys and Costs
Octelium bundles a VPN, ZTNA platform, API/MCP gateway, and PaaS into one AGPL binary with per-agent identity for AI tool calls. Here's exactly what that convergence buys in security and what it costs in blast radius, licensing, and bus factor.
SOPS Ships v3.13 While CNCF Debates Whether to Keep It: What Age Encryption Still Buys a Self-Hosted Fleet
CNCF is debating whether SOPS can stay in the foundation over its MPL license, even as it ships v3.13 and crosses 22,000 GitHub stars. Here's the concrete decision rule for when file-level age encryption is enough for a self-hosted fleet's secrets, and the three thresholds that push a platform toward Vault instead.
Sidero Labs Ships CA Rotation and Cosign Verification for Talos and Omni — What's Automatic, What's Manual, and What Still Breaks
Sidero Labs' Q1 2026 Talos/Omni release adds CA rotation on cluster import and native Cosign image verification. Here's exactly what each one does, which parts are operator-triggered rather than automatic, and a real bug that shipped with the new verification gate.