$ tail -f topics/infra.log
Daily updates from the platform-engineering layer - Kubernetes, Terraform, Linux, Arch, and the tools that run production.
42 updates across 6 projects this week.
One calm review of what shipped across Infrastructure - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top Infrastructure projects - refine anytime. · Read a sample issue →
Linux
Linus pulled a critical io_uring thread pool fix that closes a use-after-free vulnerability in the io-wq hashing layer, while Herbert Xu's crypto stack tackles a rhashtable deadlock that could freeze systems under memory pressure.
read --wire →
Arch Linux
NetworkManager and its 32-bit dependencies graduate from testing to stable repos [ref:3][ref:4][ref:5], while the installer gains logfile preview and wider translation support.
read --wire →
HashiCorp
Nomad Autoscaler shipped security fixes for 14 vulnerabilities across Go toolchain and dependencies overnight, while Azure provider teams finalize deprecated property cleanup ahead of major version release.
read --wire →
Kubernetes
kOps is gutting years of cloud configuration cruft, moving Azure cloud-config from per-node files to a cluster-managed Secret while deprecating the unused in-tree cloud provider flag that's been dead code since Kubernetes 1.31.
read --wire →
Go
An attacker can inject arbitrary content into errors returned by net/textproto when external input reaches the package unescaped, potentially exploiting HTTP clients that parse untrusted server headers.
read --wire →
Linux
The kernel shipped critical fixes for ptrace memory access logic and SMC-D network protocol flaws that could allow malicious peers to trigger DoS conditions.
read --wire →
Arch Linux
Arch Linux kernel v7.0.7-arch2 is live with unprivileged namespace restrictions, io_uring memory fixes, and critical SMC-D socket vulnerabilities patched.
read --wire →
HashiCorp
Both consul-k8s and consul-dataplane shipped go-discover updates that fix two container CVEs, and you need them before your next production deploy.
read --wire →
Kubernetes
Kubernetes patched a critical managedFields bug that was stripping data on conversion webhook failures, while test infrastructure begins a major migration to standardize Windows Azure testing across CAPZ.
read --wire →
Go
Image decoders can allocate memory proportional to untrusted headers before validating pixel data, a security footgun that just got official guidance.
read --wire →
Linux
Virtualized Control Enforcement Technology is hanging production hosts, and the kernel just gave you an off switch.
read --wire →
Arch Linux
Arch's build system just got smarter—the new list-builds API merges after weeks of refinement, bringing pagination controls and richer build metadata to the pipeline.
read --wire →
HashiCorp
Consul-K8s shipped a critical security fix for CVE GO-2026-4918 overnight while simultaneously restoring unit tests that had vanished from the main branch.
read --wire →
Kubernetes
Kubernetes apiserver just cut redundant object conversions in CEL evaluation, while kops shipped critical fixes for eBPF networking and cloud provider integrations.
read --wire →
Go
Go is standardizing its PowerPC implementation across endianness while Windows developers gain syscall access to extended file attributes.
read --wire →
Linux
The kernel's trace subsystem just killed a footgun where ftrace NOPs were corrupting kprobe blacklists during module loads, while the desktop team fixed a stuck-key bug that's been eating deployments.
read --wire →
Arch Linux
Element.io shipped stable after testing [ref:4], while the signing infrastructure gains critical backup and inspection capabilities [ref:15].
read --wire →
HashiCorp
Consul upgraded Go 1.26.3 to close eight chained CVEs in the standard library overnight, while consul-k8s 1.8.x stops firing misleading FIPS compliance warnings on every pod startup.
read --wire →
Kubernetes
etcd-manager jumped to v3.0.20260512 in kops while a coordinated kube-openapi revert rippled across four core repos to fix an API definition issue.
read --wire →
Go
Go's allocator just got leaner, dropping specialized memory classes above 128 bytes to cut icache misses and improve performance across the board.
read --wire →
