Automation / DevOps / IaC

CYBERTEC has launched a new PostgreSQL operator for Kubernetes that distinguishes itself by prioritizing multi-site cluster management over single-environment deployments. The tool automates cross-site replication and failover while providing validated deployment models and architectural guidance. This release joins a crowded ecosystem of existing operators but targets organizations needing PostgreSQL to span multiple Kubernetes locations.

• Focuses on multi-site PostgreSQL clusters with automated cross-site replication and failover.
• Provides validated deployment models and operational documentation for complex architectures.
• Competes with CloudNativePG, Zalando operator, and Crunchy PGO in the K8s space.
• Aims to solve challenges when PostgreSQL extends beyond a single Kubernetes environment.

Microsoft's August Patch Tuesday release addresses 421 vulnerabilities across its software stack. Threat actors, referred to as Norks, have already begun exploiting at least one of these flaws in the wild. This rapid exploitation timeline underscores the critical nature of the update cycle for enterprise environments.

• Patch Tuesday contains 421 fixes, significantly increasing patching workload
• Active exploitation confirmed immediately post-release by threat actors
• Prioritize updates for affected services to mitigate immediate risk
• Monitor telemetry for indicators of the initial exploit attempt

AWS offers a tag-driven automation to move RDS and Aurora logs from Standard to Infrequent Access log classes, targeting the 50% cost reduction on rarely accessed database logs. This solution eliminates the need to pay full ingestion rates for data that is seldom queried. The approach allows for an automated, policy-based migration of log groups without manual intervention.

• Target rarely accessed database logs to cut ingestion costs by roughly 50%.
• Use tag-driven automation to migrate RDS and Aurora log groups automatically.
• Avoid full standard ingestion rates for logs that are infrequently queried.

Netflix has overhauled its Service Topology pipeline to handle production-scale real-time service dependency mapping. The new architecture decouples intermediary resolution from enrichment and persistence across three distinct stages. It propagates backpressure to Kafka to prevent record loss and utilizes server-sent events for high-volume internal data transfers instead of gRPC.

• Decoupling resolution from enrichment improves scalability and fault isolation.
• Kafka backpressure propagation ensures zero data loss under load.
• Server-sent events replace gRPC for more efficient high-volume transfers.
• Three-stage pipeline separates concerns for better maintainability.

Cloud Native Buildpacks have graduated within the CNCF, moving base image selection from individual Dockerfiles to a centralized platform-owned builder. This architectural shift enables fleet-wide patching and standardizes security controls. Vendors like BellSoft are now treating the builder itself as the primary security hardening point rather than per-service Dockerfiles.

• Centralize base image management in a platform-owned builder for consistent security.
• Enable fleet-wide patching by decoupling build logic from individual service Dockerfiles.
• Shift security hardening control points from per-service configs to the builder layer.
• Leverage vendor-hardened builders like BellSoft's Paketo for immediate baseline security.

The federal government has issued a warning that the Gunra ransomware-as-a-service group is actively exploiting known vulnerabilities in Fortinet appliances. Attackers are gaining initial access through internet-facing equipment and subsequently stealing and encrypting data. This campaign specifically highlights the risk of unpatched legacy flaws in critical infrastructure environments.

• Gunra is exploiting known Fortinet vulnerabilities to breach critical infrastructure.
• Initial access is achieved via internet-facing appliances with unpatched flaws.
• Attackers exfiltrate data before encrypting it, increasing double-extortion risk.
• Immediate patching of Fortinet devices is essential to block this TTP.