Block GitHub Pull Requests With Exposed Secrets: New Ruleset Rule Setup Guide Push protection catches a lot of leaked secrets, but it has always had a gap: it only inspects the commits in a single git push. A secret that slipped in through a squash-merged branch, a force-push that bypassed protection, a fork PR from a …

Azure User-Bound Delegation SAS Is GA: Lock Storage Tokens to a Single Entra Identity Every SAS token you've ever generated for Azure Storage has the same underlying weakness: it's a bearer credential. Whoever holds the URL — the person you sent it to, whoever they forwarded it to, whoever it leaked to in a log line or …

Docker Engine 29.8.0: --umask Flag, Custom AppArmor Profiles, and CloudWatch Entity Logging Docker Engine 29.8.0 shipped on September 3, 2026, and it's a release worth actually reading the changelog for instead of skimming past. It doesn't add a headline feature — it closes four small, specific gaps that practitioners …

Fix GitHub CLI NO_PUBKEY / EXPKEYSIG Errors After the September 2026 Key Rotation If apt update, dnf update gh, or yum update gh suddenly started failing on a Linux box that has the GitHub CLI installed from GitHub's own package repository, you're not imagining it. The PGP key GitHub CLI used to sign its Linux packages …

AWS Lambda SnapStart for Container Images: Setup Guide and Cost Tradeoffs If you package a Lambda function as a container image and it runs Java, Python, or .NET, you have probably eaten cold starts of several seconds every time traffic scaled up. SnapStart was the fix for that on .zip functions since 2022, but until …

Docker CopyEscape (CVE-2026-17106): Fix the docker cp Host File Overwrite Vulnerability If you or your CI pipeline ever run docker cp against a container you didn't fully trust — a scanning sidecar, a customer-submitted build, an AI-agent sandbox — you need to check your Docker version right now. CVE-2026-17106, …

Managed Instance on Azure App Service Is GA: Migrate Legacy .NET Framework Apps Without Rewriting Them If you've ever tried to move a 15-year-old ASP.NET app to Azure App Service and hit a wall — a COM component that needs registering, an MSI installer the app depends on, hardcoded C:\ paths, or a registry key some …

Find Source IP Addresses Connecting to AWS Transfer Family SFTP with CloudWatch Logs Insights If your AWS Transfer Family SFTP server has CloudWatch logging turned on, every connection, login attempt, and file operation is already sitting in a log group — you just need the right query to pull the source IPs out of it. …

GitHub Actions' New vulnerability-alerts Permission: Read Dependabot Alerts Without a PAT If you've ever tried to have a GitHub Actions workflow check for open Dependabot alerts — to block a release, gate a merge, or post a Slack summary — you've probably hit a wall: the default GITHUB_TOKEN can't read them. The …

AKS Hyperscale Control Plane (Preview): Setup Guide and When You Actually Need It If you've ever run a large AKS cluster and watched kubectl requests start queuing during a traffic spike, or seen pods sit Pending while the scheduler falls behind, the cause is usually invisible: the managed control plane itself, not …