Company & Industry Updates
Announcements, technology updates, and industry news from Private DevOps LTD.
Showing 1-20 of 20 news items
Page 1 of 1
TeamPCP Breaches GitHub via Poisoned Nx Console Extension
TeamPCP exfiltrated about 3,800 GitHub-internal repositories after a poisoned Nx Console VS Code extension reached a GitHub employee. The full supply-chain chain, and what to do.
Read more about TeamPCP Breaches GitHub via Poisoned Nx Console ExtensionRailway 8-Hour Outage: GCP Auto-Suspended Their Account
Google Cloud auto-suspended Railway's production account on May 19, 2026, taking the platform offline for 8 hours. The cross-cloud dependency lesson, in detail.
Read more about Railway 8-Hour Outage: GCP Auto-Suspended Their AccountMini Shai-Hulud Worm Hits Microsoft's durabletask PyPI
TeamPCP's Mini Shai-Hulud worm backdoored durabletask v1.4.1-1.4.3 on PyPI, stealing AWS, GitHub and Vault secrets and spreading via SSM and kubectl exec.
Read more about Mini Shai-Hulud Worm Hits Microsoft's durabletask PyPIssh-keysign-pwn (CVE-2026-46333): Kernel Secret Leak
CVE-2026-46333 (ssh-keysign-pwn) lets any local Linux user read SSH host keys and /etc/shadow via a kernel ptrace exit race. Who is exposed and how to fix it.
Read more about ssh-keysign-pwn (CVE-2026-46333): Kernel Secret LeakApple's M5 Memory Integrity Enforcement Bypassed in Five Days with AI Help
Researchers built the first public macOS kernel exploit on Apple M5 silicon, defeating Memory Integrity Enforcement in five days with Claude Mythos. The real story is the velocity.
Read more about Apple's M5 Memory Integrity Enforcement Bypassed in Five Days with AI HelpGoogle GTIG Confirms the First AI-Developed Zero-Day Used in the Wild
On May 11, 2026, Google's Threat Intelligence Group published the first confirmed evidence of a criminal group using AI to build a working zero-day. Here is what it means for your threat model.
Read more about Google GTIG Confirms the First AI-Developed Zero-Day Used in the WildNGINX Rift (CVE-2026-42945) - An 18-Year-Old RCE in the World's Most Deployed Web Server
NGINX Rift (CVE-2026-42945) is a CVSS 9.2 heap overflow in the nginx rewrite module. A single unauthenticated request can reach RCE. PoC is public. Here is who is exposed and how to patch.
Read more about NGINX Rift (CVE-2026-42945) - An 18-Year-Old RCE in the World's Most Deployed Web ServerFragnesia (CVE-2026-46300) - The Linux Kernel LPE That the Dirty Frag Patch Created
Fragnesia is a new Linux kernel local privilege escalation introduced by the Dirty Frag patch itself. Public PoC is out. Ubuntu still unpatched. Here is the mitigation playbook.
Read more about Fragnesia (CVE-2026-46300) - The Linux Kernel LPE That the Dirty Frag Patch CreatedMay 2026 Linux and cPanel CVE Storm: What to Patch Now
Three high-severity Linux kernel CVEs and a critical cPanel authentication bypass are being actively exploited in May 2026. Here is what to patch and how.
Read more about May 2026 Linux and cPanel CVE Storm: What to Patch NowDirty Frag (CVE-2026-43500) - Linux Kernel RxRPC Root Escalation, Public Exploit Out
Dirty Frag (CVE-2026-43500) is a high-severity Linux kernel local privilege escalation in the RxRPC subsystem. Public exploit is already out - the disclosure embargo broke. Patch and mitigation playbook below.
Read more about Dirty Frag (CVE-2026-43500) - Linux Kernel RxRPC Root Escalation, Public Exploit OutCopy Fail (CVE-2026-31431) - Patch Every Linux Server You Run
Copy Fail (CVE-2026-31431) is a Linux kernel local privilege escalation that turns any local account into root in seconds. Every major distribution is affected. This is the patch and mitigation playbook.
Read more about Copy Fail (CVE-2026-31431) - Patch Every Linux Server You RunMajor Vercel Breach Disclosed - Rotate Every Token Now
A high-impact supply chain breach hit Vercel customers in April 2026. Plaintext environment variables - API keys, database credentials, signing keys - were exposed. This is the rotation playbook.
Read more about Major Vercel Breach Disclosed - Rotate Every Token NowWordPress 6.9.2 Security Release Is Now Available
WordPress 6.9.2 shipped as a March 2026 security release, making it the safer reference point than older 6.8-focused update coverage.
Read more about WordPress 6.9.2 Security Release Is Now AvailableKubernetes 1.35.2 Becomes the Latest Supported Patch
Kubernetes 1.35 remained in active support as 1.35.2 shipped in late February 2026, giving platform teams a clearer current upgrade target.
Read more about Kubernetes 1.35.2 Becomes the Latest Supported PatchDocker Desktop 4.36 Introduces Resource Saver Mode
Docker Desktop 4.36 adds resource saver mode that reduces CPU and memory usage by up to 80% when containers are idle. Key update for developers.
Read more about Docker Desktop 4.36 Introduces Resource Saver ModeAmazon OpenSearch Service Expands Graviton4 Support
AWS expanded Amazon OpenSearch Service support for Graviton4-based c8g, m8g, r8g, and r8gd instances in more regions during February 2026.
Read more about Amazon OpenSearch Service Expands Graviton4 SupportTerraform 1.8 Released with Provider Functions
HashiCorp releases Terraform 1.8 with provider-defined functions, improved refactoring support, and better state management capabilities.
Read more about Terraform 1.8 Released with Provider FunctionsInside Turbopack: Next.js Doubles Down on Faster Dev Loops
The January 2026 Next.js engineering update focused on how Turbopack reduces work during development, making it a better current reference than older 15.1 launch posts.
Read more about Inside Turbopack: Next.js Doubles Down on Faster Dev LoopsPHP 8.4 Release: What It Means for Developers
PHP 8.4 brings property hooks, asymmetric visibility, and HTML5 DOM support. Here is how these changes affect Laravel and Magento projects.
Read more about PHP 8.4 Release: What It Means for DevelopersOpenSSL CVE-2024-12797 - Raw Public Key TLS Authentication Bypass Patched
OpenSSL has patched CVE-2024-12797, a high-severity TLS authentication flaw that lets a server bypass Raw Public Key verification without aborting the handshake. Affects OpenSSL 3.2, 3.3, and 3.4. Update immediately.
Read more about OpenSSL CVE-2024-12797 - Raw Public Key TLS Authentication Bypass Patched