GitHub Blocks pull_request_target by Default, WordPress Update Race Exploited, Polymarket Drained via Hijacked DebugBear Script & Alpine's GitLab Upgrade Missed the Fix

Released Friday, November 6th 2026 16 min

Show notes

About this episode

This week on Ship It Weekly, GitHub will block pull_request_target in public repos by default from December 2, with brownouts on Mondays, November 9 and 16, 11 AM to 1 PM ET. A WordPress core update race (CVE-2026-119977) is on CISA's exploited list: during a full-package update, a fresh installer can sit for a moment at a public URL under wp-content/upgrade. A hijacked DebugBear script drained about $2.7 million from Polymarket users after DebugBear's DNS was compromised through its registrar. And Alpine Linux explains why upgrading GitLab didn't fix CVE-2026-97229 on its own image: the fix was a patch to Ruby. The thread: what actually ran, as opposed to what you think ran. A trigger that runs a fork's code with your secrets, an update that opens its own window, a script served by whoever controls the DNS, and a version number that said "fixed". In the lightning round: OpenSSH 10.6p2 fixes a password login bypass on musl builds with PAM off, which is how Alpine builds openssh-server; Debian and Ubuntu patch an APT package swap (CVE-2026-109518); and .NET 8 and 9 reach end of support on Tuesday, November 10. The human closer comes back to Alpine's "we cannot rule it out." If an attack hit you this week, could your logs prove it didn't work? Highlights • pull_request_target: what it runs, and what to check before Monday • WordPress: when keeping current is what opens the window • DNS, HTTPS and subresource integrity for third-party scripts • Registrar lock, MFA and alerts on DNS changes • Alpine: GitLab from your own image needs a fixed Ruby too • "No evidence" is only as good as the logs you kept Links pull_request_target blocked by default (GitHub): https://tsn.io/KwebM WordPress advisory GHSA-4w3m-c66w-69mg: https://tsn.io/1HGiK WordPress upgrade-window RCE (Wordfence): https://tsn.io/Pc6X2 Polymarket postmortem: https://tsn.io/rOc2M DebugBear on the registrar DNS compromise: https://tsn.io/4BjIg Polymarket losses and refunds (Hackread): https://tsn.io/qNhoe Alpi...

More from Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News

All episodes

AWS Roles Trusting Qubole Abused to Steal Secrets, Claude Code's Don't Ask Again File Leaks Credentials, KubeCon Agent Sandboxes for Kubernetes & WorkOS Breach Traced to an AI Agent

Nov 13, 2026 15 min

This week on Ship It Weekly, an attacker used Qubole's trusted access into customer AWS accounts to read secrets and pull whole S3 buckets. Claude Code's "don't ask again" button has been saving passwords and API keys into .claude/settings.local.json, a file that keeps turning up on GitHub and Docker Hub. At KubeCon, the CNCF took in Agent Substrate and OpenShell as Sandbox projects, and AWS launched Nitro Sandboxes for EKS. And WorkOS traced a breach of an internal sales tool to a security researcher's AI agent that escaped its test environment. The thread: what can it touch? A vendor role nobody removed, an approval that saved the secret with the command, agents running unreviewed code, and an internet-facing tool with a guessable dev credential. In the lightning round: an exploited Outlook bug (CVE-2026-124194) and a 9.9 Azure DevOps Server RCE in Patch Tuesday, N-able patching the Able2Shell exploits in N-central, KubeVirt's CNCF graduation, and OpenShift 5 going GA. The human closer comes from Brent Chapman: incident resolution time isn't something you should target. Target what you can change, and track the rest. Ship It Weekly is a 2026 DevOps Dozen finalist for Best DevOps Community Program or Event, and I'm a finalist for Enterprise DevOps Champion of the Year. The public vote is open through December 31. Highlights • Why the External ID didn't stop a stolen vendor credential • Find every role that trusts an outside account, and delete the idle ones • settings.local.json: rotate, untrack, and add it to .dockerignore • Moving an agent's boundary off the shared kernel • WorkOS's own list: internet-facing API, dev credential, no rate limit • Target the steps you control, not resolution time Links Qubole cross-account access abused (Wiz) Claude Code's "don't ask again" file leaks secrets (The Hacker News) settings.local.json secrets on GitHub and Docker Hub (GitGuardian) Agent Substrate and OpenShell join the CNCF Nitro Sandboxes for Amazon EKS (AWS) WorkOS inc...

Ship It Conversations: Mallory Haigh of PlatformEngineering.org on Why Context Isn't Enough for AI Agents, Harness and Governance, Probabilistic and Hybrid Paths, Agent Identity, and Building Platform Trust Before Agents

Nov 11, 2026 39 min

This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps. In this Ship It Conversations episode, I talk with Mallory Haigh about why context alone isn't enough for AI agents, the harness and governance layers that actually run them, and why she tells some platform teams to pump the brakes before adding agents at all. Mallory is Head of Platform Education and Advocacy at PlatformEngineering.org. She teaches in Platform Engineering University and coaches platform teams through Platform Engineering Consulting, where the job gets jokingly called "platform therapist". We start with her New York City analogy. Drop someone in the middle of the city with no directions and they'll get lost, and an agents.md file on its own does the same to an agent. It also needs to know what to do, how to do it, how it'll know it's done, and what it's allowed to touch. Mallory splits that into the harness, which is how the agent does the work, and governance: who and what is allowed, what's safe, and how it's watched. Then we get into IDPs as context layers. Mallory says that's partly right, because the IDP and its golden paths are the foundation. What's missing are path specifications. Probabilistic paths are agent-driven, like a read-only PR review. Deterministic paths are your pipelines, like a CI build. Hybrid paths pair an agent with a gate: the agent opens the PR, CI validates it, the agent retries, and a human makes the final call. Cap those retries at three to five, and if an agent always does the same thing with the same outcome, ask whether it should be an agent at all. On governance, Mallory says platform engineering is a practice about building trust, and that in the last three weeks alone she's told multiple platform teams to pump the brakes on agents because they can't get human governance right yet. We cover agent identity (specialists, not generalists, built on the RBAC you already have), agents watching terabytes of logs a day for SRE tea...

Ship It Conversations: Ryan Packer of BambooHR on Why CTOs Are Coding Again, Building a Software Factory, AI Straining CI/CD, Protecting HR Data, Mid-Career and Junior Engineers, and Why Every Engineer Gets a Team of Agents

Nov 9, 2026 36 min

This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps. In this Ship It Conversations episode, I talk with Ryan Packer about why a CTO is writing code again, what happens to CI/CD when every engineer runs a fleet of agents, and who trains junior engineers when AI can fix the bugs. Ryan is the CTO at BambooHR and a former VP of Engineering at Adobe. He's watched engineering organizations change from Omniture to Adobe to BambooHR, and he says he's spent more time coding this year than in the rest of his career combined. We start with why. Ryan will never write production code for his team again, but he wants to use the same tools and learn the same techniques they're learning, and to show an idea in working code instead of a PRD or a Slack message. He's also honest about the limits: his sandbox serves maybe a hundred people, and his team's software serves millions. Then we get into the software factory. In Ryan's own version, a customer files a bug, an agent opens the PR, tests it for security and performance, scores it, and ships it if it meets the bar. At BambooHR, pull requests are up almost 80% since the start of the year, and quality has improved by the metrics they track. The part he's most excited about is more at-bats with customers: an idea to a working prototype in a day. For platform teams, Ryan says AI has been more of a challenge than a help for CI/CD. BambooHR was already releasing hundreds of times a day, but agents do their best work when they can run and test what they build. Ten, twenty or a hundred agents per engineer means environments that spin up and down fast, with real data. We also cover protecting HR and payroll data: terms with the frontier labs, data retention, and an AI council. On careers, Ryan thinks mid-career engineers face the hardest change, and that the ones who keep learning have little to worry about. On junior engineers, he doesn't claim a perfect answer. He no longer needs them to fix bugs,...

Ship It Conversations: The AI Agent That Ran Terraform Apply, With Davlet Dzhakishev of Cloudgeni on Read-Only Cloud Access, Sandboxes Beyond Docker, Agentic PR Reviews, the Real Cost of Running Agents, FinOps for AI, and Permissions Over Prompts

Nov 4, 2026 37 min

This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps. In this Ship It Conversations episode, I talk with Davlet Dzhakishev about what it takes to let AI agents work on your cloud infrastructure, why guardrails belong in the architecture and not the prompt, and what running your own agents really costs. Davlet is the CEO and co-founder of Cloudgeni, which builds AI agents for cloud infrastructure. He got into this after working through SOC 2 and ISO 27001 compliance prep mostly by hand, and asking what agents would need to fix those problems reliably without making things worse. We start with the incident that changed how Cloudgeni builds. An agent hit a snag on a simple Terraform change and decided the fix was to run apply. On staging. Resources got recreated, and Davlet calls it his wake-up call. Since then, guardrails come first: sandboxed runtimes, scoped credentials, read-only cloud access, and changes that go through Git, CI/CD and tests. At the architecture level, the agent shouldn't be able to do what you don't want it to do. Then we get into agentic PR reviews, which check human and agent work the same way, and why a good reviewer catches more than the obvious errors. Davlet's example is a private network around a key vault: great for security, until your own apps lose access. We also cover drift, and why you need to reconcile it before you can trust agent PRs. On cost, Davlet's view is that AI subscriptions are heavily subsidized, and running your own agents on API tokens can cost ten to twenty times more. Most agent usage also has no audit trail, so a stuck loop can poll a dead API server every day and no one will know. He thinks FinOps for AI is going to be big, orphaned agents and all. That need for audits is part of why Cloudgeni open-sourced its foundation as OpenGeni. We finish with what he still wouldn't hand to an agent, and where a platform team should start without building a monster: PR reviews first, then...

Ship It Conversations: The AI Hallucination That Looks Right, With Devansh of Irys on Legal AI, Three-Tier Error Isolation, Models That Change Under You, Overhyped Reinforcement Learning, and Optimizing for Maintenance Over Generation

Nov 2, 2026 33 min

This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps. In this Ship It Conversations episode, I talk with Devansh about why the trickiest legal AI hallucination is a real case used the wrong way, how his team splits their system into three tiers to find failures fast, and why he'd rather optimize for maintenance than for generation. Devansh is the Founder and Head of AI at Irys. He builds reasoning and verification systems for legal AI, a tough place for hallucinations and confident wrong answers. He also publishes open source AI research on Substack. We start with why AI for professionals breaks down. Devansh thinks models are getting good at doing a lot of things somewhat well, but they fall short on the last mile to reliable. So his team engineers structure back in instead of hoping a better model fixes it. In legal, fake citations are the failure everyone has heard about. The more interesting one is a real case that doesn't apply. So much of law is interpretation, and a model built to predict the most probable token pulls toward the average. Then he walks through the three tiers behind Irys One. Ingestion maps messy input, like PDFs with handwritten notes and email chains that refer to them, into a knowledge graph so the AI knows where to look. Reasoning navigates that graph. Delivery applies how a firm or a lawyer likes to work. The payoff is error isolation: if a lawyer says something is missing, two or three targeted queries tell them whether it was ingestion or reasoning. We also get into why chunk-based retrieval misses connections, why going from 10 docs to 10 gigabytes is mostly about finding the few documents that matter, and how "answer contracts" handle "it depends." Then I take a DevOps angle. Devansh says the hardest part of running AI in production is tracking everything. A fully agentic system might perform 20% better, but you never know how it breaks until it breaks. The first thing his team tracks is whether...

From the podcast

Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News Teller's Tech - DevOps, SRE and Cloud Podcast

Ship It Weekly is a short, practical recap of what actually matters in DevOps, SRE, cloud infrastructure, and platform engineering. Each episode, your host Brian Teller walks through the latest outages, releases, tools, and incident writeups, then translates them into “here’s what this means for your systems” instead of just reading headlines. Expect a couple of main stories with context, a quick hit of tools or releases worth bookmarking, and the occasional segment on on-call, burnout, or team culture. This isn’t a certification prep show or a lab walkthrough. It’s aimed at people who are already working in the space and want to stay sharp without scrolling status pages, cloud updates, and blogs all week. You’ll hear about things like cloud provider incidents, Kubernetes and platform trends, Terraform and infrastructure changes, and real postmortems that are actually worth your time. Most episodes are 15–30 minutes, so you can catch up on the way to work or between meetings. Every now and then there will be a “special” focused on a big outage or a specific theme, but the default format is simple: what happened, why it matters, and what you might want to do about it in your own environment. If you’re the person people DM when something is broken in prod, or you’re building the cloud and platform everyone else ships on top of, Ship It Weekly is meant to be in your rotation.

Share this episode

Episode details

Length: 16 min
Released: Nov 6, 2026
Explicit: No
Type: Audio

Download audio

This podcast, its content and its artwork are not owned by, affiliated with, or endorsed by Castquire.