GitHub's New Runner Deprecation API: Automate Your Self-Hosted Fleet Audit If you manage self-hosted GitHub Actions runners, you've probably already been checking versions by hand — SSH into a box, run ./run.sh --version, repeat for every machine. On September 3, 2026, GitHub shipped a REST API that makes that manual …

Fix CVE-2026-83497: OpenSearch SQL Plugin Deserialization RCE via Cursor Pagination If you run OpenSearch — self-managed or Amazon OpenSearch Service — and have the SQL plugin enabled, a user with nothing more than basic read/search rights can get arbitrary code execution on your cluster right now. CVE-2026-83497, …

GitHub Disabled SHA-1 in HTTPS: Fixing Git Clone/Push SSL Errors After Sept 15, 2026 On September 15, 2026, GitHub completely disabled SHA-1 in HTTPS/TLS connections to github.com, GitHub Enterprise Cloud, and its partner CDNs. If a git clone, git push, or a script calling the GitHub API over HTTPS suddenly started …

GitHub Actions Ubuntu 26.04 Migration: What Breaks When ubuntu-latest Moves On September 17, 2026, GitHub announced that the ubuntu-latest runner label is moving from Ubuntu 24.04 to Ubuntu 26.04, rolling out gradually between October 19 and November 19, 2026. If your workflows just say runs-on: ubuntu-latest and …

Copy an EBS Volume to Another AWS Account: Cross-Account Volume Clones Setup Guide Refreshing a dev or test account with real production data has always meant snapshot the volume, copy the snapshot cross-account, share it, wait, then restore a new volume from it — four separate operations before anyone can attach a …

Block GitHub Pull Requests With Exposed Secrets: New Ruleset Rule Setup Guide Push protection catches a lot of leaked secrets, but it has always had a gap: it only inspects the commits in a single git push. A secret that slipped in through a squash-merged branch, a force-push that bypassed protection, a fork PR from a …

Azure User-Bound Delegation SAS Is GA: Lock Storage Tokens to a Single Entra Identity Every SAS token you've ever generated for Azure Storage has the same underlying weakness: it's a bearer credential. Whoever holds the URL — the person you sent it to, whoever they forwarded it to, whoever it leaked to in a log line or …

Docker Engine 29.8.0: --umask Flag, Custom AppArmor Profiles, and CloudWatch Entity Logging Docker Engine 29.8.0 shipped on September 3, 2026, and it's a release worth actually reading the changelog for instead of skimming past. It doesn't add a headline feature — it closes four small, specific gaps that practitioners …

Fix GitHub CLI NO_PUBKEY / EXPKEYSIG Errors After the September 2026 Key Rotation If apt update, dnf update gh, or yum update gh suddenly started failing on a Linux box that has the GitHub CLI installed from GitHub's own package repository, you're not imagining it. The PGP key GitHub CLI used to sign its Linux packages …

AWS Lambda SnapStart for Container Images: Setup Guide and Cost Tradeoffs If you package a Lambda function as a container image and it runs Java, Python, or .NET, you have probably eaten cold starts of several seconds every time traffic scaled up. SnapStart was the fix for that on .zip functions since 2022, but until …