Welcome to the thirty-eight edition of Platform Engineering Monthly. As always, if you have suggestions or ideas for the next edition, please let me know!
📰 News
Terabytes of credentials leaked in massive supply-chain attack
Terabytes of leaked credentials from a supply-chain attack. Another reminder to actually rotate your secrets rather than just meaning to.
AsyncAPI supply chain compromise via GitHub Actions
Wiz red team shows how a GitHub Actions flaw let attackers compromise the AsyncAPI supply chain.
AWS deprecated this EKS auth method. 81% of clusters still run it.
81% of clusters still on a deprecated EKS auth method is the kind of stat that should make every platform team check their own setup right now.
Nine PBS could lose 70 years of archives after cloud vendor goes defunct
70 years of PBS archives at risk because a cloud storage vendor went under is a proper nightmare scenario. Another reminder that “the cloud” is just someone else’s business continuity plan.
*[Discussion](https://news.ycombinator.com/item?id=49285418)*
Large-scale GitHub Actions abuse powers a distributed cPanel and WHM exploitation campaign
Attackers abuse GitHub Actions at scale to power a distributed cPanel/WHM exploitation campaign.
Kubernetes’ New Rule for AI Contributions: If You Can’t Explain It, Your PR Gets Closed
Kubernetes maintainers banned AI co-author trailers outright and put the burden on humans to personally defend every line an AI helped write.
CNCF Announces Graduation of Cloud Native Buildpacks
Dockerfile-free, auto-detecting OCI image builds just got CNCF’s top maturity stamp, cementing buildpacks as the boring, standardized alternative to hand-rolled build pipelines.
📚 Learning
How the controller-runtime Cache Actually Works, and Why Your Controller Does Not Crash the API Server
controller-runtime’s cache design explains why watch-heavy controllers don’t melt the API server.
Rebuilding Postgres for 300x faster analytics
300x is a big number to put in a headline, but the underlying query engine rewrite is genuinely interesting if you’ve ever waited on a Postgres analytics query and questioned your life choices.
How we cut Kubernetes deployment validation from 45 minutes to 2 minutes
Cutting deployment validation from 45 minutes to 2 is the kind of win that actually changes how a team works day to day, not just a vanity metric.
🧪 Interesting Projects
git-filter-repo
Still the correct answer whenever someone asks how to actually scrub history from a repo, BFG included.
tfplantui
tfplantui turns raw terraform plan output into an interactive, navigable TUI diff.
Show HN: Kedge – Full-stack cloud with forkable VM snapshots and global SQLite
Kedge bundles forkable VM snapshots with globally replicated SQLite for full-stack apps.
*[Discussion](https://news.ycombinator.com/item?id=49099434)*
📅 Events
Announcing H1 2027 KCDs
KCDs are always worth a look if there’s one near you. Good way to meet people who actually run this stuff for a living rather than just tweet about it.
KubeCon + CloudNativeCon + OpenInfra Summit + PyTorch Conference China 2026
September 7-9, 2026 — Shanghai, China
CNCF’s flagship China event covering Kubernetes, cloud native infrastructure, and AI/ML tooling for platform and infra teams across the region.
QCon Amsterdam 2026
September 22-24, 2026 — Amsterdam, Netherlands
Senior-engineer conference with tracks on software architecture, platform engineering, and distributed systems, curated by practitioners for practitioners.
Devoxx Belgium 2026
October 5-9, 2026 — Antwerp, Belgium
One of Europe’s largest developer conferences, with strong DevOps, cloud native, and platform tooling tracks alongside core Java/JVM content.
PromCon EU 2026
October 7-8, 2026 — Munich, Germany
Community conference dedicated to Prometheus and the broader cloud native observability/monitoring ecosystem, key for SRE and platform observability work.
SREcon26 Europe/Middle East/Africa
October 13-15, 2026 — Dublin, Ireland
USENIX’s regional SRE conference covering reliability engineering practice, incident response, and production systems at scale.
All Things Open 2026
October 19-20, 2026 — Raleigh, NC, USA
Large open-source conference with dedicated cloud native, DevOps, and platform engineering content alongside broader open-source tracks.
HashiConf at IBM TechXchange 2026
October 26-29, 2026 — Atlanta, GA, USA
HashiCorp’s flagship event on infrastructure automation (Terraform, Vault, Consul, Nomad), core to platform engineering toolchains.
Have platform engineering tips to share? Reply to this email or connect with me on LinkedIn. Thanks for reading! Subscribe for free to receive new posts.