Welcome to the thirty-fifth edition of Platform Engineering Monthly. As always, if you have suggestions or ideas for the next edition, please let me know!
📰 News
Max-severity GitLab bug allows remote code execution over 12 years of releases
A CVSS 10 that’s been sat in GitLab since 7.0 in 2014, unauthenticated, on self-managed CE and EE. If that’s you, this is the week’s priority: 19.5.1, 19.4.3 or 19.3.6. GitLab.com and Dedicated are already patched, so everyone else can go back to pretending this doesn’t apply to them.
PHP2Shell: AI uncovers critical RCE in PHP
RCE in PHP itself, not the usual CMS plugin, and it works against the latest WordPress, Drupal and Joomla containers. Wiz found it with AI fuzzing, the first time I’ve seen AI bug hunting land somewhere this serious. Patched PHP releases shipped on the 21st, so update your base images.
Google Cloud says a ‘power event’ caused today’s outage
A power event in one London zone took down 38 services and half of UK banking with it. Lloyds, HSBC, Royal Mail, Revolut, the lot. One zone in europe-west2-b is a single point of failure for a country’s financial plumbing, worth remembering the next time someone questions the cost of multi-region.
PHP2Shell puts dozens of UK government services out of service
32 UK government services went dark, mostly precautionary take-downs while patches went in rather than confirmed compromises. The NCSC sent 50,000 warnings, which is a lot of patching advice for one country to receive in a day.
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
The exploit was being attempted four days before the patch shipped, while the bug was still under embargo, and Cloudflare has blocked millions of attempts since disclosure. Also, the PHP Foundation accused Chainguard of shipping patched builds before the agreed deadline, a spicy sub-plot if you follow disclosure politics.
GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
A ‘Security Audit’ GitHub workflow pushed from two compromised maintainer accounts harvested secrets and full git history from 300+ repos in minutes, and 378 repos still had it live on their default branch the next day. If your CI credentials have been sat in a repo since 2019, assume they’re in there. Rotate them.
GitLab joins rush to slow AI coders with rate limits
GitLab is rate-limiting free-tier API, web and Git traffic to slow AI crawlers and agents, following Anthropic and GitHub down the same path. Enterprise users are unaffected until January, so this is mostly a ‘watch the vendors figure out agent traffic’ story for now.
📚 Learning
How Airbnb replays real database workloads to catch MySQL performance regressions
Airbnb replays real database traffic instead of running synthetic benchmarks, and it caught a query pattern going from 0.03s to 2.6s during the MySQL 8.0 upgrade. Synthetic tests never find that. If you’ve got a big database migration coming, this is how to de-risk it.
Datadog finds 3,500+ dangerous Kubernetes RBAC bindings to built-in principals
Datadog found 3,500+ dangerous RBAC bindings to built-in principals like system:anonymous across real clusters. If you’ve never audited your bindings to system:* service accounts, this’ll give you the queries to do it.
Debug why a 300-second Kubernetes grace period becomes a 10-second shutdown
A tidy debugging story: a 300 second Kubernetes grace period that was actually 10, because supervisord’s stopwaitsecs default was the real limit and nobody had set it. If you run supervisord as PID 1, go check yours.
Poison a Go build cache without changing the program’s source
You can poison a Go build cache by editing its action index file, so go run prints false from unmodified source. The CI angle is the nasty one: a PR poisons a shared cache and the poisoned entry survives even after the commit is force-pushed away.
Netflix Bridges AWS IAM and Internal Identity with Workload Attestation
Netflix swaps long-lived AWS credentials for short-lived certificates issued after the workload proves what it is via STS. One IAM role per Data Project, no injected credentials. It’s the direction most of us should be heading if we’ve got anything resembling a PKI.
🧪 Interesting Projects
Fakecloud: Local AWS cloud emulator for integration tests
A local AWS emulator claiming 107 services and 7,657 operations as a 19MB binary, versus LocalStack Community’s 3 second startup and 150MB idle. AGPL though, so mind the licence if it ends up in your CI.
Floci: Locally emulating any cloud service
Another local cloud emulator, MIT this time, covering 126 AWS services plus Azure, GCP and OCI, with a claimed 24ms startup. The LocalStack-alternative space is suddenly busy (see Fakecloud above), which feels like a rising tide.
FTL: A new operating system for clouds
An operating system where each container runs its own userspace OS library, so the kernel barely does anything. v0.1.0 does async Rust and epoll. Very early and very research-y, but throwing out the shared kernel for fleet workloads is an idea worth watching.
Pele – Mermaid diagrams as themeable SVG
Mermaid rendering to SVG without Mermaid’s 23 dependencies, 230KB against 1.6MB, built by kepano for Obsidian. If your platform portal renders Mermaid diagrams, this is the sort of thing that’ll make your frontend people happy.
📅 Events
Join Platform Engineering Day at KubeCon + CloudNativeCon North America 2026
Monday, November 9, 2026, Salt Lake City (co-located with KubeCon NA)
A full day on platform engineering co-located with KubeCon NA, end-user case studies over vendor pitches. The agents as platform producers and consumers track should be interesting.
ArgoCon North America 2026: What to expect as the Argo community looks toward CD 4.0
Argo CD at scale, 60,000 applications in one setup, and the start of the 4.0 visioning process. If GitOps is your job, block out the day.
KubeCon + CloudNativeCon North America 2026: Join the cloud native community at OpenTofu Day
State of the project, an Ask the Devs panel and Terraform migration talks, and OpenTofu’s now past 10 million downloads.
KubeCon + CloudNativeCon North America 2026: Build your SRE journey
Includes a talk on a GitOps commit that cascade-deleted 39 production clusters and another on an 8-minute clock skew locking a cluster for a day. Nothing teaches like other people’s incidents.
Security Slam 2026 – Fall edition
Virtual, runs October 5 – November 6, 2026
A 30-day challenge to improve your project’s security posture, open to any open source project this time, with a metric aimed at the EU Cyber Resilience Act.
Have platform engineering tips to share? Reply to this email or connect with me on LinkedIn. Thanks for reading! Subscribe for free to receive new posts.