Security alerts and field guides for cloud teams.
Short, dated notes on the vulnerabilities and fixes that matter to teams running AWS, Azure, Google Cloud, Kubernetes and the software on top. Written by DevopsMind engineers, with sources and a last verified date on every note.
- Read the note →
eMudhra CA compromise: update your trust stores
Keys of eight eMudhra subordinate CAs were compromised. Managed services are patched, but servers, images and CLIs with their own CA bundle are not.
- Read the note →
npm and GitHub Actions: a hardening checklist
GitHub changed npm trusted publishing after a flaw put 1,500+ packages at risk. A short checklist to harden your workflows and publish settings.
- Read the note →
Leaving Node.js 20: a migration checklist
Node.js 20 is end of life and will not get the October security fixes. A practical checklist to find, test and move your services to 22 or 24.
- Read the note →
NGINX 1.30.6 and 1.31.7: five CVEs to check
NGINX fixed five flaws in October. Whether you are affected depends on your config. How to check your servers, images and ingress controllers.
- Read the note →
Node.js October security release: 10 CVEs
Node.js 22, 24 and 26 got security fixes on 21 October, including a Brotli flaw. How to find every Node you run and what to update first.
- Read the note →
PHP2Shell: what to patch this week
Two critical PHP flaws allow remote code execution and are being exploited. Fixed versions, how to find your PHP estate and temporary hardening steps.
- Read the note →
Patching Vertex AI Workbench for CVE-2026-99999
A critical Linux kernel flaw has an upstream fix, but Workbench release notes do not list it yet. How to check your instances and patch stopped ones.