Saturday, July 04, 2026

Ahsan Hadi released pg-healthcheck, an open-source Go utility designed to provide immediate visibility into PostgreSQL instance health. The tool performs over 180 checks across 14 categories by querying live system catalogs, covering critical issues like bloat, WAL retention via replication slots, transaction ID wraparound, and silent backup failures. It specifically targets hard-to-detect problems such as TOAST corruption and heap-VM state mismatches that disrupt vacuum operations.

• Runs 180+ checks against live system catalogs for accurate, real-time diagnostics without estimates.
• Covers critical failure modes including WAL holdback, bloat, and silent backup cessation.
• Detects complex catalog issues like TOAST corruption and vacuum-affecting state mismatches.
• Written in Go for easy deployment as a standalone utility on any PostgreSQL instance.

Shaun Thomas highlights that while data checksums protect against silent corruption, enabling them historically required a full offline cluster rebuild, even after pg_checksums was added in version 12. With checksums finally becoming the default in version 18, the upcoming version 19 aims to eliminate the painful outage window by allowing online activation. This shift addresses the long-standing friction of adding this critical safeguard to existing deployments.

• Checksums now default to on in Postgres 18, making them the standard safety net.
• Postgres 19 is expected to support online checksum enablement, avoiding full outages.
• Previous methods like pg_checksums required bringing the cluster completely offline.
• Existing clusters can finally add corruption detection without rebuilding from scratch.

Fleet impact: For Oracle ExaCC/RAC fleets, this mirrors the value of ASM diskgroup checksums or Oracle Block Change Tracking for validation, though Exadata already provides robust hardware-level error detection. For AWS Aurora PostgreSQL/MySQL + RDS, this feature is largely abstracted away as Amazon manages underlying storage integrity; however, it reinforces the importance of verifying that your managed service provider exposes or enables equivalent low-level data integrity checks, as you likely cannot toggle them manually anyway.

Zhang Chen analyzes how PostgreSQL's architecture of storing each relation in a separate file increases the difficulty of recovering from ransomware attacks. The post highlights that catalog recovery becomes particularly painful when individual file integrity is compromised. It contrasts this exposure model with the more consolidated storage approaches found in MySQL and Oracle.

• PostgreSQL's single-file-per-relation design creates granular failure points during ransomware incidents.
• Catalog recovery is significantly harder due to the high volume of individual files involved.
• This exposure model differs notably from MySQL and Oracle's more consolidated storage strategies.
• Practitioners should review backup granularity and restoration procedures for PostgreSQL fleets.

AWS has made Anthropic's latest Claude Sonnet 5 model available, positioning it as the most capable in the Sonnet family. The model maintains the balance of cost and speed while improving performance in coding, agentic tasks, and knowledge work. It is designed to handle large codebases, manage multi-step agent workflows, and produce professional documents with fewer corrections.

• Sonnet 5 offers top-tier intelligence at standard Sonnet pricing tiers.
• Improved coding capabilities include multi-file changes and refactoring.
• Agent reliability increases through precise tool calling and error recovery.
• Available now on AWS for scalable professional and coding workloads.

OpenAI has introduced Agent RFT, a platform designed to fine-tune reasoning models by leveraging real-time tool interactions and custom reward signals. This approach addresses complex credit assignment challenges that typically occur within large context windows during reinforcement learning. The speakers highlight enterprise case studies where this method successfully eliminates long-tail token loops and achieves significant operational efficiency.

• Agent RFT fine-tunes models using real-time tool feedback rather than static datasets.
• Custom reward signals help solve credit assignment issues in large context windows.
• Enterprise deployments report elimination of inefficient long-tail token loops.
• The platform drives extreme efficiency gains for complex reasoning tasks.
• Focuses on practical RL implementation for production-grade reasoning models.

Amazon SageMaker HyperPod now tracks AMI versions across clusters to detect drift and applies security patches automatically without interrupting long-running training jobs. This update eliminates the previous manual, reactive patching process that risked altering bundled software like NVIDIA drivers or CUDA. The feature allows administrators to maintain secure, consistent infrastructure while reducing operational overhead.

• Gain visibility into AMI versions running across SageMaker HyperPod clusters to detect configuration drift.
• Automate security patching to avoid disrupting multi-day foundation model training workloads.
• Prevent accidental changes to critical bundled software such as NVIDIA drivers or CUDA during updates.
• Reduce manual operational burden by shifting from reactive to automated patch management.

Amazon SageMaker Inference now supports automatic container image caching to significantly reduce cold-start latency during scale-out events. By pre-pulling large generative AI container images (often 10 GB+) from ECR, new instances can start serving traffic immediately without waiting for full downloads. This feature specifically targets the bottleneck where every new instance previously had to pull the entire image, adding several minutes of delay.

• Scale-out latency drops by up to 50% as new instances bypass ECR pull times
• Large GenAI containers (10 GB+) are pre-cached locally before scaling occurs
• Eliminates multi-minute cold-start delays for deep learning framework images
• No code or configuration changes required to enable automatic caching

Amazon WorkSpaces for agents is now generally available, allowing AI agents to securely access and operate desktop applications within managed WorkSpaces environments. This capability enables enterprises to leverage AI on critical legacy systems like ERPs and CRMs without the need for costly modernization or custom integrations. Agents interact with these applications visually and operationally, mirroring human usage while relying on the same trusted infrastructure established over the last decade.

• AI agents can now interact with legacy desktop apps via screen and input, bypassing the need for API modernization.
• Leverages existing WorkSpaces infrastructure for secure, managed access to critical business processes.
• Reduces risk and cost by automating tasks on systems with undocumented logic or strict compliance needs.
• Enables immediate AI integration for ERP, CRM, and mainframe tools without building custom connectors.

Hugging Face and IBM Research introduce ScarfBench, a benchmark designed to evaluate AI agents specifically for migrating enterprise Java frameworks. The initiative focuses on measuring how effectively automated tools can handle the complexities of modernizing legacy Java applications. This provides a standardized way to assess agent performance in real-world migration scenarios.

• ScarfBench targets enterprise Java framework migration, not general code generation.
• It benchmarks AI agents' ability to handle complex legacy code modernization.
• Provides a standardized metric for comparing agent effectiveness in this niche.
• Collaborative effort between Hugging Face and IBM Research.
• Helps practitioners choose tools for large-scale Java migrations.

Agent Skills introduces a lightweight, open specification for adding specialized knowledge and workflows to AI agents. Each skill is defined as a folder containing a required SKILL.md file with metadata and instructions, alongside optional scripts, references, and assets. This structure allows developers to modularly extend agent functionality without modifying core code.

• Skills are folder-based packages with a mandatory SKILL.md for metadata and instructions
• Enables modular extension of AI agents with specialized workflows and knowledge
• Supports bundling scripts, references, and templates alongside core skill definitions
• Provides an open standard to avoid vendor lock-in for agent capabilities

TencentCloud released CubeSandbox, a lightweight sandbox service built on RustVMM and KVM designed for AI agents. It delivers hardware-isolated environments in under 60ms with a memory footprint of less than 5MB. The v0.4 update introduces credential vaulting to keep API keys out of the sandbox and adds operational dashboards for template health checks.

• Sub-60ms startup and <5MB overhead enable high-concurrency agent workloads.
• Credential vaulting ensures API keys never enter the isolated sandbox environment.
• Compatible with E2B SDK for easier integration with existing agent frameworks.
• Supports both single-node and multi-node cluster scaling.
• New dashboard provides visibility into template health and version matrices.

OpenAI has published an official plugin enabling Claude Code users to invoke OpenAI's Codex directly within their existing workflow. The tool supports commands for code reviews, adversarial testing, and delegating background tasks. It requires a ChatGPT subscription or OpenAI API key alongside Node.js 18.18 or later to operate.

• Enables direct Codex invocation from inside Claude Code workflows
• Supports code review, adversarial challenges, and task delegation
• Requires ChatGPT subscription or OpenAI API key for access
• Counts against Codex usage limits rather than standard API quotas
• Install via /plugin marketplace add openai/codex-plugin-cc

AWS CloudFormation now executes pre-deployment validation automatically during Create Stack and Update Stack operations, providing immediate feedback on common errors before resource provisioning begins. This eliminates the need to wait for full provision-and-rollback cycles to detect preventable failures such as property syntax issues or resource name conflicts. The feature extends previous change set validation capabilities to all stack operations, accelerating feedback loops for manual workflows, CI/CD pipelines, and AI agents.

• Validation now runs automatically on Create and Update operations, not just during change set creation.
• Catches syntax errors, name conflicts, and S3 constraints before any resources are provisioned.
• Eliminates wait times for rollback cycles when deploying preventable infrastructure errors.
• Accelerates iteration speed for CI/CD pipelines and AI-driven infrastructure agents.

AWS has introduced express mode for CloudFormation and CDK, cutting infrastructure deployment times by up to 4x based on internal benchmarks. This feature completes stack operations immediately upon resource configuration confirmation, bypassing extended stabilization checks like traffic readiness and region propagation. The change is designed to support faster iteration cycles for developers and AI agents building infrastructure incrementally.

• Deployments skip full resource stabilization checks, significantly reducing wait times.
• Enables faster iteration loops for developers and AI agents in dev environments.
• Reduces overhead for operations where full propagation is not immediately critical.
• Internal benchmarks cite up to 4x speedup in stack completion times.

GitHub Actions checkout v7 now refuses to checkout fork pull request code by default when triggered by pull_request_target or workflow_run. This change mitigates "pwn request" vulnerabilities where fork code executes with the base repository's elevated GITHUB_TOKEN and secrets. Users must explicitly opt in via the allow-unsafe-pr-checkout input if they require this behavior. The action has also migrated to ESM and updated dependencies for security fixes.

• Fork PR code is no longer executed by default in pull_request_target workflows to prevent token theft.
• Opt in to previous behavior using the new allow-unsafe-pr-checkout: true input after reviewing risks.
• Migrated to ESM to support newer @actions/* package versions and improve compatibility.
• Transitive dependencies updated with security patches for known vulnerabilities.
• No direct database migration impact; CI/CD pipeline security posture is strengthened.

Amazon SageMaker Unified Studio now accepts Terraform for domain provisioning via the terraform-aws-sagemaker-unified-studio module. This enables platform teams to integrate the service into existing infrastructure-as-code workflows. Teams can now manage SageMaker Unified Studio domains using version-controlled templates across development, staging, and production environments.

• Use the terraform-aws-sagemaker-unified-studio module to provision domains via IaC
• Integrate SageMaker Unified Studio into existing CI/CD and infrastructure pipelines
• Maintain consistency for data and AI workspaces across multiple AWS accounts
• Leverage version-controlled templates for reproducible environment setup

Kubernetes production containers are often minimal or distroless, lacking the tools needed for effective troubleshooting when issues arise. Ephemeral containers provide a solution by allowing operators to attach temporary debugging sessions to running pods without modifying the original application image. This approach maintains the immutability and security of production workloads while enabling immediate access to diagnostic utilities.

• Minimal or distroless images lack troubleshooting tools like shell or debuggers
• Ephemeral containers allow safe attachment of diagnostic sessions to running pods
• No need to rebuild or modify base images to access debugging capabilities
• Maintains production immutability while solving critical visibility gaps

Amazon RDS has extended cross-region automated backup replication to four additional AWS Regions, including Mexico Central, Taipei, New Zealand, and Thailand. This update enables point-in-time recovery capabilities across specific regional pairings, such as replicating backups from Mexico to Ireland or US West, and from Asia Pacific regions to Singapore, Sydney, Melbourne, or Jakarta. The feature ensures mission-critical databases can be restored to a specific point in time within the retention period, even if the primary region experiences an outage.

• Cross-region replication now covers Mexico Central, Taipei, New Zealand, and Thailand.
• Mexico Central can replicate to Europe (Ireland) or US West (N. California).
• Taipei backups replicate to Singapore or Tokyo for enhanced regional resilience.
• New Zealand and Thailand regions replicate to Singapore, Sydney, Melbourne, or Jakarta.
• Enables point-in-time recovery across regions for mission-critical RDS workloads.

AWS has updated ECS Express Mode to allow the use of custom task definitions, enabling teams to keep existing application configurations and advanced task-level settings. This change allows users to reuse task definitions from current CI/CD pipelines and infrastructure-as-code workflows without losing the simplified deployment experience. Express Mode continues to automate load balancing, networking, auto-scaling, and monitoring while now accommodating these specific customizations.

• Reuse existing ECS task definitions in Express Mode instead of rewriting them
• Maintain advanced task-level customizations while using simplified deployment
• Keep current CI/CD and IaC workflows intact with the new support
• Automate load balancing, networking, and scaling without manual config

Amazon EKS now allows reverting to the previous Kubernetes minor version within a seven-day window following an upgrade. This feature acts as a safety net for validating new versions in production, accessible via the console, CLI, or SDKs. Before execution, the service performs automated readiness checks covering API compatibility, version skew, add-on status, and cluster health. For EKS Auto Mode clusters, worker node rollbacks are handled automatically prior to control plane reversion.

• Rollback window is strictly limited to 7 days after the upgrade operation.
• Pre-flight checks validate API compatibility, version skew, and add-on status.
• EKS Auto Mode automatically handles worker node rollback before control plane changes.
• Initiate rollbacks via Console, AWS CLI, or SDKs with full automation support.

Amazon Time Sync Service has expanded to support microsecond-accurate time on 26 additional EC2 instance types across all commercial regions. This capability leverages the AWS Nitro System's reference clocks and Precision Time Protocol hardware clock (PHC) to enable nanosecond precision timestamps. Users can access this feature by launching instances within a new Precision Time Placement Group (PTPG).

• Enables microsecond time accuracy on 26 new EC2 instance types globally.
• Requires launching instances in a Precision Time Placement Group (PTPG).
• Leverages Nitro System reference clocks for nanosecond precision hardware timestamps.
• Supports ordering events, measuring one-way latency, and boosting distributed transaction speed.

Amazon EC2 Dedicated Hosts now support AMD Secure Encrypted Virtualization-Secure Nested Paging, allowing customers to run confidential computing workloads on physical servers dedicated to their use. This feature enables instance placement control and host affinity, ensuring instances remain on the same physical server over time. The physical host is provisioned with updated AMD security firmware during allocation to maintain a secure environment.

• Enable SEV-SNP on Dedicated Hosts to isolate confidential workloads from the hypervisor and cloud provider.
• Leverage host affinity to keep sensitive instances on the same physical server for compliance and performance.
• Control instance placement to meet regulatory requirements for data residency and hardware isolation.
• Security firmware is automatically updated during host allocation to ensure a secure baseline.

Amazon RDS for Oracle now supports the Oracle Data Masking and Subsetting Pack, enabling secure data handling for non-production environments. The blog details integration via Oracle Enterprise Manager and outlines automation strategies for managing masked subsets. This capability allows DBAs to safely replicate realistic data structures without exposing sensitive information.

• Oracle Data Masking and Subsetting Pack is now compatible with RDS for Oracle instances.
• Configuration and management are handled through Oracle Enterprise Manager (OEM).
• Automation options are available for integrating masking into deployment pipelines.
• Enables safe creation of non-prod datasets that mirror production data structures.