A team pointed hundreds of Codex and DeepSeek agents at two PaperCut CVEs and compromised 440+ servers at 395 organizations in 48 countries, going from vulnerability research to the first real victim in under four hours.
The same week, Wiz scanned 3,074 internet-facing LiteLLM gateways and found 294 of them still accepting sk-1234, the master key from the docs, with a path from there to the cloud account's IAM credentials.
Add a .git config that makes Claude Code, Codex and Cursor run attacker code on clone, and this is the week the agents started attacking each other's infrastructure.

Faster GitHub Actions, one line to migrate

Avrea is CI infrastructure for GitHub Actions: you keep your workflows and swap runs-on for one of their labels, and jobs run on high clock-speed CPUs with a colocated cache for dependencies, Docker layers, and build artifacts, plus live observability with SSH into the runner when something is flaky.

I tested Komiser’s workflows on their runners, and the cold run went from 5min to 3min, with the Go test suite at 2min instead of 4min.
Free tier is 3,000 build minutes a month, on Linux, macOS and Windows - Try Avrea for free

My take: what Spotify did to cut Claude Code tokens by 90%, and what you can copy

Newsworthy stories

• PaperCut attacker uses hundreds of AI agents to compromise 440+ instances

• Nearly 1 in 10 exposed LiteLLM gateways accepted the example sk-1234 admin key

• Malicious .git configs can make Claude, Codex, Cursor and other AI agents run attacker code

• Portal by Spotify cut my Claude Code token usage by 90%

• 20x the CI traffic without getting slower: how Datadog rebuilt Git serving

• RTK reports token savings, but our cost benchmarks disagree

• I’ve operated petabyte-scale ClickHouse clusters for 5 years

Tutorials of the week

• Implementing chaos engineering in financial payment systems on ECS

• Investigate DMS migration issues with AWS DevOps Agent

• Kubernetes disaster recovery: guidance from three reproducible failure scenarios

• Distributed tracing for CI pipelines without touching a single workflow file

• The Karpenter change that quietly turned on cross-AZ traffic charges

• Breaking Claude Code Opus 5 auto mode: RCE from a website summary

• What SREs should automate, and never automate, with AI

• Automate IAM Identity Center governance with continuous discovery and reporting

• How to handle Terraform CI/CD for multiple environments

Videos of the week

Projects of the week

• walgit hosts git repositories from a single binary in front of an S3 or GCS bucket, with no database, no leader, and no local state that matters.

• Mantis gives coding agents security review skills to find, reproduce, and patch vulnerabilities on their own.

• Cloud in a Bottle deploys and shares web apps on a server you control, with rootless hardened containers and one login for all of them.

• llmfit tells you which open-weight models your CPU, RAM, and GPU can comfortably run, and at what quantization.

• argo9s monitors Argo CD applications in real time from a K9s-style terminal UI.

• dbmask finds the sensitive columns in a SQL database, masks them with deterministic fakes, and verifies the masking actually happened.

• Nightshift wakes your coding agent at night, hands it one small job at a time, and leaves pull requests for the morning.

Meme of the week

Someone spent a month knocking on the root account of more than 150 AWS organizations, and Datadog's writeup is worth reading precisely because every single attempt failed. The interesting part is that the attackers already knew the root email addresses, which makes this a failed campaign built on successful reconnaissance.
Meanwhile Shai-Hulud came back checking 469 places for credentials instead of 189, Nvidia agreed to buy Hugging Face for about $13 billion, and Kubernetes quietly shipped the thing plenty of teams have been faking with cron jobs for years.

One webhook platform for your agents and your customers

Most AI agents can’t receive a webhook: they run on a laptop, behind a VPN, or in a sandbox that blocks inbound traffic.

Svix Ingest takes events from Stripe, GitHub, incident.io, or anything else that sends webhooks, and your agent pulls them over an outbound HTTPS connection a few seconds later. No public URL, no tunnel, and nothing lost while it was offline.

Try Svix for free

My take: three frontier models in three days

Every big lab shipped this week. Claude Fable 5.1, Gemini 3.8 Flash, and GPT-6 Astra.

Newsworthy stories

• Password spraying hit AWS root accounts at 150+ organizations

• Shai-Hulud now scans 469 credential locations, up from 189

• Nvidia agrees to buy Hugging Face for almost $13 billion

• Kubernetes v1.37 can scale workloads to zero with the HorizontalPodAutoscaler

• MCP went stateless, so your AWS deployment can drop sticky sessions

• How GitHub cut Copilot’s inference bill without hurting task quality

• Saving petabytes of cache storage with Zstandard and Pingora

• AI scrapers are now most of kernel.org’s traffic

Tutorials of the week

• Detecting multi-stage attacks on AWS by correlating signals across services

• Terraform observability: drift detection, TF_LOG and plan metrics in practice

• How to handle errors in Go

• AWS S3 bucket security: finding the secrets that live outside Git

• Cutting EKS MTTR with the AWS DevOps Agent and a Kubernetes operator

• Can an AI agent debug Kubernetes? I broke a cluster to find out

• Why pod setup started timing out after 90 seconds

• Which tools do Claude, Codex and Cursor reach for?

• I spent a full day on a “five-minute” Docker migration

• PostgreSQL shared memory visualizer

• Build your own continuous modernization pipeline with AWS Transform custom

• Choosing GCP cost optimization tools that match your environment

Videos of the week

Projects of the week

• Warren runs coding agents as managed infrastructure with isolation, spend limits, and Git delivery instead of terminal sessions.

• Boost compresses the noisy output of the commands your coding agent runs so it keeps the errors and timings without the log spam.

• ZSvirt runs and manages KVM virtual machines from a single web console, including VMware migration.

• Rootprint searches logs and traces directly from object storage, so you can self-host log management instead of renting it.

• pgterm monitors every Postgres database you own from a single terminal dashboard and flags those that need attention.

• ku browses Kubernetes resources, follows logs, and drops you into pods from a keyboard-driven terminal UI.

• srelens combines cluster browsing, logs, exec, and port forwarding into a single local desktop workspace built for engineers and agents alike.

Meme of the week

AWS signed a deal this week to acquire DuckLabs, the ~30-person Amsterdam team behind DuckDB, and the timing is the part worth staring at: it landed nine days after DuckDB previewed v2.0 with a client/server protocol.
Also, Cloudflare shaved 533 bytes off every DNS cache entry and got 100 terabytes of RAM back across its fleet, and I shared a good case for shipping your executables as SQLite databases.

My take: what AWS actually bought when it bought DuckDB

If you haven’t used it, DuckDB is SQLite for analytics. pip install duckdb, point it at a Parquet file in S3, run SQL. No cluster, no Spark job, no ticket to the data platform team. It won because most data is small. AWS’s own post says DuckDB covers the “90%+ of data queries in the world today” that run on data smaller than 1 terabyte.

Four things I’d take from it:

• This is an S3 play, not a Redshift one. The announcement was signed by Andy Warfield, who runs S3.

• The deal landed nine days after DuckDB previewed v2.0 with the Quack protocol, which allows any DuckDB process to serve its databases over the network. Embedded DuckDB is a developer tool. DuckDB that speaks a wire protocol is a query engine you can rent by the second.

• The product writes itself. Quack on top of S3 Tables and Iceberg gives you serverless SQL straight against object storage, no warehouse in the middle. That’s aimed at Databricks and Snowflake, not Redshift.

• AWS didn’t buy the project; it hired everyone who commits to it. No license fight, no fork, no OpenSearch-style backlash. The Foundation keeps the IP, AWS keeps the roadmap.

Newsworthy stories

• How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache

• On-call is now theatre

• Your executable is a SQLite database

• How Databricks uses AI to accelerate incident investigation

• Stop trying to learn all of Kubernetes at once

Tutorials of the week

• From clickops to governed IaC: CloudFormation drift detection in practice

• Optimizing Kubernetes pod deployments for reliability with topology spread constraints

• How to evaluate LLMs before production

• How we built an AI security analyst on AWS for under $500/month

• Putting models to the secure coding test: plan vs default mode

• Federating clusters for zero-downtime Kubernetes

• How to achieve resource-level isolation in Kubernetes using a multi-environment node pool strategy

• HashiCorp’s tfpolicy made module source a policy decision

• Building safe MCP servers for your PostgreSQL database

• Automating filtered cost and usage report exports with AWS Data Exports

Videos of the week

Projects of the week

• Khaos injects the Kafka failures you normally wait for into a cluster on demand, from consumer lag and hot partitions to rebalances and broker outages.

• Proval reviews your pull requests with an LLM that runs entirely inside your own network, on GitLab, Forgejo, and GitHub alike.

• restoredrill restores your latest Postgres backup into a throwaway container, runs your validation checks against it, and writes the JSON report an auditor actually asks for.

• AWSHound turns your AWS IAM data into a BloodHound graph, so the privilege escalation paths in your account become something you can see.

• cloudflare-github-actions-runner runs your GitHub Actions jobs on ephemeral Cloudflare Containers you size yourself, instead of on GitHub’s runners.

Meme of the week

Cloudflare published the actual economics of AI code review this week: 131,000 reviews a month, $0.98 each, and an 85.7% cache hit rate. Swizec’s counterpoint landed the same week, arguing that most of what those reviewers catch is a deterministic linter rule you could run in seconds for nothing. Meanwhile Cursor rebuilt Git storage on write-ahead logs in S3 to get past the limits consensus-based Spokes ran into, and pgrust rewrote the Postgres query engine with batching, operator fusion and SIMD to make analytics 300x faster.

Newsworthy stories

• Orchestrating AI code review at scale

• Stop burning tokens on code review

• Git at any scale

• Rebuilding Postgres for 300x faster analytics

• On building scalable control planes

• Linux 7.2 brings cache-aware scheduling, faster ext4 and Btrfs

Tutorials of the week

• Massively parallel Postgres backups

• Automating Terraform testing

• Managed AWS dashboards for instant cloud financial visibility

• Building an advanced agentic harness

• PostgreSQL for everything

• How Kubernetes probes work

• A security field guide to AI tooling visibility

• Streamline your GitHub journey with AWS DevOps Agent

Videos of the week

Projects of the week

• Bruno replaces Postman with an offline API client that saves every request as a plain-text file, so collections branch and are reviewed in Git like the rest of your code.

• Munder Difflin runs your terminal coding CLIs as a self-coordinating team of agents on the subscriptions you already pay for.

• secfiles collects wordlists and payload files for penetration testing and bug bounty work.

• OpenViking is a self-evolving context database that unifies agent memory, RAG knowledge, and skills.

• triagebot-action puts every new GitHub issue through reproduce, diagnose, and fix, then ships a preview release and waits for the reporter to confirm before opening the PR.

• Agent Safehouse sandboxes coding agents on macOS so they only reach the files and integrations they actually need.

Meme of the week

Cloudflare pays $0.98 per review for AI to catch things a linter would catch for free. Which one is actually running in your pipeline today, and would you drop the other?

This week’s supply chain attack didn’t drain one company’s secrets, it dumped terabytes of credentials scraped from thousands of repositories into the open. Figma’s answer to that class of noise is a fleet of agents that triage alerts, query security data and write the fix, which cut their resolution time by 71%. One SRE team applied the same instinct to Kubernetes and pulled release validation from 45 minutes down to 2, and if you want a reminder that owning the tech is not the same as winning, the Docker video below is the best bedtime story of the year.

See how PayFit promotes infra and app releases through one pipeline

Join us on September 2 (Wed) to learn how PayFit’s platform team promotes every release the same way, Kubernetes services and Lambda functions alike. One path for app and infrastructure changes, so a release candidate proves itself before the next environment. It’s how PayFit ships payroll for 22,000+ businesses - Save your seat

Newsworthy stories

• Terabytes of credentials leaked in massive supply-chain attack

• How we secure Figma’s internal systems with agents

• How we cut Kubernetes deployment validation from 45 minutes to 2 minutes

• Investigating persistence mechanisms in AWS

• The hidden cost of homegrown IaC

Tutorials of the week

• Track generative AI costs with Amazon Bedrock inference profiles

• The infrastructure testing pyramid

• Pulling multi-gigabyte container images in seconds on Amazon EKS

• A 1,200% AWS cost spike: AI monitoring vs CloudWatch

• Before the first prompt: code execution paths in trusted coding-agent projects

• How to build your infrastructure monitoring in 2026

Videos of the week

Projects of the week

• OpenCodeReview reviews pull requests from the command line and leaves line-level comments.

• sqlfmt formats PostgreSQL queries the way gofmt formats code, aligning clause keywords on a single column.

• GoAccess analyzes web server logs in real time from your terminal or the browser.

• git-knife edits every commit’s message, author, and dates in a table you can click through.

• bsdkrun boots BSD guests, Linux OCI images, and unikernels as microVMs on macOS and Linux, with no daemon running underneath.

• Cloudflare Computer provides agents with a virtual filesystem and swappable execution backends within a Durable Object.

Meme of the week

Terabytes of credentials are now public, so I am curious where you actually stand: do you rotate CI tokens every deploy, every quarter, or only after an incident?

Permiso’s teardown of the OpenClaw ecosystem is the one to read first: agents installing skills from an unvetted marketplace while holding live credentials to email, Slack and everything else they touch. Cloudflare shipped its own answer to that problem this week with Cloudflare OS, an open platform that puts guardrails around what an agent can actually reach. And if you want proof that we are all still improvising, someone wired Claude up as a Postgres query engine and it returned real rows.

Newsworthy stories

• Inside the OpenClaw ecosystem: what happens when AI agents get credentials to everything

• Cloudflare OS: an open platform for agents, apps, and work

• How Figma stays ahead of vulnerabilities with agents

• Turning Claude into Postgres so I can raise a Series A

• Automating multi-cloud cost management at scale

Tutorials of the week

• Accelerate CloudFormation development with the IaC MCP Server

• Everyone records the MySQL audit log. Nobody reads it

• Improve your monthly cloud variance analysis with a weekly FinOps checkpoint

• The multi-account Terraform setup nobody talks about

• The DISTINCT in your COUNT

• Centralize cross-account Amazon ECS telemetry with an ADOT gateway

• What it actually takes to run parallel AI agents

• A security analysis of Amazon S3 Vectors and its use in LLM retrieval pipelines

Videos of the week

Projects of the week

• pgGraph runs graph traversals and shortest-path queries directly on your existing Postgres tables.

• nono sandboxes any AI agent behind least-privilege isolation with no setup.

• glab-tui browses GitLab and GitHub issues, merge requests, pipelines, and runners without leaving your terminal.

• Suzaku hunts threats in AWS CloudTrail logs by applying Sigma detection rules to your API call history.

• Svix handles webhook delivery, retries, and signing so you never have to build that layer yourself.

• Starboard keeps a terminal permanently docked beside the macOS Dock instead of hidden behind a hotkey.

Meme of the week

Attackers turned compromised PHP repositories into a botnet this week, using GitHub Actions runners to scan and exploit cPanel and WHM servers at scale.
It is the clearest sign yet that your CI minutes are somebody else's free infrastructure.
Elsewhere, PlanetScale explains how 768 database servers manage to look like one, and AWS shipped a control plane that finally gives platform teams a policy and cost story for Claude Code.

Learn Rogo’s IaC approach

How do platform engineers keep pace with a growing development team at a $2B AI company? On August 11, Lawrence Aiello, Platform Engineering Lead at Rogo, shares how. He’ll cover the modern IaC platforms Rogo weighed, the criteria that mattered, and how infrastructure that runs without attention frees his team to focus on enabling developers. Take Rogo’s criteria into your own platform decision - Register Now

Newsworthy stories

• Large-scale GitHub Actions abuse powers a distributed cPanel and WHM exploitation campaign

• Making 768 servers look like 1

• Introducing Claude apps gateway for AWS

• Merge conflicts are a process problem, not a Git problem

• Why do Kubernetes experts choose managed Kubernetes-as-a-service?

Tutorials of the week

• Automate CI/CD troubleshooting with AWS DevOps Agent and GitHub

• Safe Terraform auto-apply with conftest

• A green Kubernetes deployment does not mean a healthy application

• I built an AI SRE agent that diagnoses incidents before I open my laptop

• Your pod died of “out of ephemeral storage” but the disk is half empty

• Delightful integration tests in Rust

• A CISO’s guide to agentic AI

Videos of the week

Projects of the week

• tfplantui turns a Terraform plan into a navigable dependency graph in your terminal.

• Widen is a native Postgres GUI for macOS that answers questions in plain English and shows you the SQL before it runs.

• tuicr reviews code in a vim-keybound TUI and exports the result straight to GitHub or GitLab.

• zeedumper dumps the flagz, statusz and configz pages from Kubernetes components through the API server proxy.

• iron-proxy blocks all egress from untrusted workloads by default and swaps sandbox tokens for real credentials at the boundary.

Meme of the week

An attacker opened 37 pull requests against AsyncAPI last week, and eight minutes after the malicious one landed, the CI secrets were gone and four npm packages with 3 million weekly downloads were shipping a three-stage payload. The same week, Socket mapped a network of 222 fake GitHub repos pushing a Go module that was really a Windows malware loader, and Sysdig walked through an Azure tenant that fell in about an hour because permissions live across five systems that don’t talk to each other. The most interesting read, though, might be Rootly explaining why they killed their two-year-old small-PR rule now that 80% of their PRs are written by agents.

Newsworthy stories

• AsyncAPI supply chain compromise via GitHub Actions

• Malicious Go module exposes GitHub malware lure network spanning 222 repositories

• Anatomy of an Azure permission takeover

• Introducing a policy workflow built for Terraform

• Why we got rid of our small-PR rule

• How I migrated my website to Cloudflare and saved $228

• The first year managing an SRE team

Tutorials of the week

• The startup’s Postgres survival guide

• Hunting malware and malicious MCPs in memory on Kubernetes

• How I built my own home-lab: a single-node Kubernetes platform

• Authenticate legitimate AI agent traffic with AWS WAF Bot Control

• FinOps guardrails at provisioning time

• 6 security settings every GitHub maintainer should enable this week

• Multi-cluster databases on Kubernetes: architecture and deployment

• How to back up PostgreSQL in Docker

• From Terraform spaghetti to a production-grade GitOps platform

• To every agent its own database

Videos of the week

Projects of the week

• Cleat gives AI coding agents a per-project Docker sandbox so they can run fully autonomously without touching your host.

• Rusternetes is a ground-up reimplementation of Kubernetes in Rust that already passes 94% of the official conformance suite.

• Destructive Command Guard intercepts destructive shell commands before an AI agent gets to run them.

• OpenGeni is a self-hostable agent runtime with durable sessions, human approvals, and governed credentials.

• frp exposes a local server sitting behind NAT or a firewall to the internet.

• Plannotator is a local browser UI for marking up an agent’s plans and diffs, then sending the feedback straight back to it.

• git-filter-repo rewrites Git history to extract subdirectories, rename paths, or strip secrets.

Meme of the week

Someone opened their AWS console this week to a billing alert projecting $140 billion for the month, on an account that normally spends $2-3 on S3. Underneath the meme-worthy screenshot, the real theme was infrastructure hitting its limits: a kubelet memory leak in Kubernetes 1.36, four recurring failure patterns behind thousands of Postgres outages, and Slack rebuilding its entire EC2 fleet management from scratch. And with half this week’s tutorials about giving AI agents identity, memory, and APIs, the CNCF is already asking whether a pod is even the right place to run one.

AI is hitting your infra faster than you can govern it

AI is reshaping infrastructure, but the teams winning aren't adopting fastest, they're governing best. Spacelift surveyed 406 infrastructure and platform engineering leaders and found 93% have already had an AI-caused incident, while only 30% have a formal AI policy. The report reveals what separates the Pioneers, from platform engineering to the AI-specific signals most teams still aren't tracking.

Download the report to see what the most advanced teams do differently.

Newsworthy stories

• Just got an AWS billing alert projecting my monthly cost at $140B

• Fixing a kubelet memory leak in Kubernetes 1.36

• Inside the unpatched Argo CD RCE that leads to K8s cluster takeover

• Is a pod the right deployment unit for an AI agent?

• How we built Slack’s next-generation EC2 platform

• The four horsemen behind thousands of Postgres outages

• The database is not the data model

Tutorials of the week

• Just use Postgres for job queues

• Cloudflare as a data platform?

• How to encrypt Terraform state files

• Implement a unified memory from scratch via knowledge graphs

• Using Go for mobile apps

• Automating cross-repo documentation with GitHub Agentic Workflows

• Automated incident remediation with AWS DevOps Agent and Kiro CLI

• Detecting full table scans with SQLite

• Solving the identity crisis for AI agents

• Designing APIs for agents

Videos of the week

Projects of the week

• Portero shows every listening port on your machine, which process owns it, and lets you kill it or block the port from a built-in firewall.

• Greysight is an open-source dashboard for Snowflake cost observability that automatically suspends idle warehouses.

• Goshot generates polished code and terminal screenshots with syntax highlighting and automatic secret redaction.

• deja-vu is a memory index for coding agents that searches past session logs so they can recall previous solutions.

• pgsavvy is a terminal UI for PostgreSQL that works like “the lazygit for Postgres.”

• Khoj is a self-hostable AI second brain for semantic search and chat over your own documents.

• LobeHub is a platform for managing a team of AI agents as coordinated, schedulable units of work.

Meme of the week

A single attacker chained together application services, CI/CD pipelines, and secrets stores to compromise an entire AWS environment in 72 hours, and the responders tracking it say human-in-the-loop SIEM triage can’t keep pace with an AI moving that fast. The same week, GitHub’s AI agent was caught handing private repos to anyone who posted a nicely worded issue in a public repo, while an unpatched Argo CD flaw gave attackers full control of Kubernetes clusters. If you were counting on “Trusted Publishing” to keep your supply chain clean, one writeup this week argues that’s the wrong thing to trust.

Platform engineering on autopilot

Mendral is an autonomous AI DevOps engineer that handles the work your engineers shouldn’t be doing manually anymore: supply chain security, flaky CI, slow builds, and anything else specific to your stack - Try it out!

Newsworthy stories

• Lone attacker uses AI to breach AWS cloud environment in 72 hours

• Security flaw in Argo CD can let attackers take over Kubernetes clusters

• I replaced my GitHub runners with Lambda MicroVMs, and maybe you should too

• Why sandboxing your agent is not enough

• You shouldn’t trust Trusted Publishing

• Why AI has made security hard

Tutorials of the week

• Build your own vulnerability harness

• How we tricked GitHub’s AI agent into leaking private repos

• Turn your Amazon CloudWatch alarms into actionable signals

• PostgreSQL as a temporal database

• I built PR preview environments with AWS Lambda MicroVMs and cut staging costs by 78%

• Setting up continuous Terraform drift monitoring

• Experiences with local models for coding

• Three ways to give an AI agent an identity

• Multi-account AWS is about ownership, not accounts

Videos of the week

Projects of the week

• kpt is a package-centric toolchain that treats Kubernetes configuration as data, allowing you to edit and deliver manifests using reusable transformation functions rather than templating.

• Nox is a modular Go framework for attack surface management that bundles 300 built-in modules across 24 phases, taking you from passive OSINT to active vulnerability scanning.

• dotenvx is a secure env manager from the creator of dotenv, encrypting .env files with public-key cryptography.

• AnduinOS 2 is an Ubuntu-based Linux distribution designed to give newcomers a familiar, low-friction path to Linux, packaged almost entirely as shell scripts.

• GeoSQL is a Python skill that turns Claude, Codex, and Copilot into geospatial analytics agents across PostGIS, BigQuery, and Snowflake.

Meme of the week

This week, someone makes the case for keeping your databases off Kubernetes, AWS shares what breaks when you scale to 1 million Lambda functions, and LLMjacking takes an ugly turn: attackers are wiring stolen AI compute into autonomous pentesting agents. Also inside: a production migration off Ingress NGINX, pgvector running at scale on Aurora, and a field guide to corrupting SQLite on purpose.

Newsworthy stories

• Why I haven’t run my databases on Kubernetes

• Lessons learned from scaling to 1 million Lambda functions

• CloudTrail in CloudWatch isn’t very good

• Too many Postgres tables are bad

• How we migrated a production cluster from Ingress NGINX to Gateway API

• Attackers are using stolen AI compute to build offensive agentic tools

Tutorials of the week

• Claude Code for infrastructure as code

• Optimize LLM costs on Amazon Bedrock

• Multi-cluster Kubernetes explained

• Run any Dockerfile on Vercel

• AWS Amplify + Lambda MicroVMs

• Running pgvector in production on Amazon Aurora PostgreSQL

• Kubernetes on a fleet of AWS Lambda MicroVMs

• Blue/green deployments on Kubernetes with Argo Rollouts

• Getting started with Claude loops

• How to corrupt an SQLite database file

Videos of the week

Projects of the week

• terraform-review-agent reviews Terraform PRs with parallel security, cost, and style agents and posts one severity-ranked comment.

• datadog-saist is an AI-native SAST tool in Go that uses LLMs to catch vulnerabilities in Java, Python, and Go.

• ZeroFS serves S3 buckets as POSIX filesystems over NFS, 9P, and NBD, with built-in compression and encryption.

• pgsync syncs Postgres, MySQL, or MariaDB to Elasticsearch or OpenSearch in real time from a JSON document schema.

• ballast is a Kubernetes operator that right-sizes pod CPU and memory requests from real usage with in-place resize.

• tidb is a distributed, MySQL-compatible SQL database with HTAP and native vector search.

• herdr is a Rust terminal multiplexer for running multiple coding agents in parallel workspaces.

Meme of the week

This week’s supply chain news is rough: 32 malicious @redhat-cloud-services npm packages stealing credentials via a preinstall hook, and Mitiga finding spyware and 1,230+ leaked API keys hidden inside AI agent instruction files. On the building side, AWS shipped Lambda MicroVMs for running untrusted and AI-generated code in isolation, Postgres 19 hit beta, and one engineer doubled their test suite by dropping per-test SQL migrations.

Feature deployed. Did it actually work?

A change can pass CI and review and still break checkout the moment it deploys. Cleric follows every agent-written change into production, checks that it did what you meant, and gives you a verdict: it worked, fix this, or roll back - See it work on a real change.

Newsworthy stories

• How to become ridiculously good at Kubernetes

• Malware in AI instruction files, plus 1,230+ leaking API keys

• How to render giant code diffs in the browser

• What’s coming in the Postgres 19 beta

• Cutting SQL migrations from tests doubled the suite speed

• Lambda MicroVMs: what you need to know

• Inside the Red Hat npm “Miasma” credential-stealing campaign

Tutorials of the week

• Running isolated sandboxes with Lambda MicroVMs

• Running AI agents safely inside Kubernetes

• Automating PostgreSQL backups to S3 with Airflow

• Building an incident management workflow

• PostgreSQL 18 performance wins on Aurora and RDS

• The feedback loops behind Kubernetes

• Cloning an ECS environment without rewriting Terraform

• Governing AI assets at scale with MCP Gateway and Registry

Videos of the week

Projects of the week

• no-mistakes is a Go local Git proxy that runs an AI review, test, and lint pipeline in an isolated worktree before pushing, then opens a clean PR.

• Hunk is a terminal diff viewer built for reviewing agent-authored changesets, with inline AI annotations.

• BoxBox is a self-hosted file manager for homelabs that supports chunked and resumable uploads.

  

• dbtrail is a point-in-time recovery tool for MySQL that runs time-travel queries and can undo cascade deletes without locks or restores.

• oh-my-reddit is a terminal Reddit client on Bubble Tea, with live-streaming comments and automatic browser session reuse.

• Orca is an agent orchestrator that runs Claude Code, Codex, and 40+ other CLI agents in parallel within git worktrees from a single desktop app.

Meme of the week

Fable 5 opened a 1,810-line pull request on Tabularis this week. Thirty-seven new tests, all passing, in about half an hour. The line count isn’t the interesting part. It’s that it didn’t just build the feature it was asked for. It refactored the shared connection logic first, as the maintainers said they would have done themselves.

A few days later, Cloudflare pointed a different kind of agent at its own code. A harness that hunts for vulnerabilities, then hands every finding to a second, different model to argue it down. It surfaced 13,841 real bugs across 145 repositories. One model finds, another model doubts, and only what survives reaches a human.

While two teams were teaching AI to build and audit code, someone else was teaching it to sell malware. A Rust clipboard hijacker shipped with roughly 15,500 wallet addresses baked in, fronted by AI-generated YouTube narrators reading polished tutorials to an audience of coordinated fake comments.

Notice the pattern. The same kind of autonomous agent is now writing production code, auditing it, and, in the wrong hands, packaging the attack. The more capable they get, the more of the unglamorous work they can actually own. That’s the bet behind Mendral: an autonomous AI DevOps engineer that takes the jobs your team shouldn’t be doing by hand, like supply chain security, and just handles them.

In the tutorials: how a single prompt injection turned Claude Code’s own GitHub Action into a way to read your API keys, the gameday that proved Datadog’s Postgres failover wasn’t actually safe, and why one NULL can make a NOT IN query quietly return nothing at all.

On video: Postgres branching that clones a database in under a second and scales to zero, plus why slow learning still wins in the AI era.

Then six devtools worth a look, including a Kubernetes desktop client that installs nothing in your cluster, a bastion that fronts SSH, Postgres, and Kubernetes with no client software, and an MCP server that indexes the entire Linux kernel in three minutes.

Platform engineering on autopilot

Mendral is an autonomous AI DevOps engineer that handles the work your engineers shouldn’t be doing manually anymore: supply chain security, flaky CI, slow builds, and anything else specific to your stack - Try it out!

Newsworthy stories

• Why is DuckDB fast?

• Hackers use AI-generated YouTube narrators to promote Crypto malware

• What job interviews taught me about Kubernetes

• Fable 5 opened a 1,810-line, 37-test PR on Tabularis in 30 minutes

• Running local models is good now

• Infrastructure as Code needs software engineering, not more config tooling

• Cursor, GitLab, and Zed agree GitHub is breaking

• The only scalable delete in Postgres is DROP TABLE

• How Cloudflare’s multi-agent harness found 13,841 bugs across 145 repos

Tutorials of the week

• Building high-availability PostgreSQL on Kubernetes

• GitHub Actions security checklist for supply chain attacks

• Cut your AWS Fargate bill by 40%

• Getting started with AKS using Pulumi and C#

• Building a RAG-powered SRE knowledge base with Amazon Bedrock

• Securing CI/CD in an agentic world: Claude Code GitHub action case

• Run your email agent on serverless

• A goroutine leak profile in the Go standard library

• Abusing AI features in SQL Server 2025

• The NULL in your NOT IN

• Operationalizing AWS security: a maturity roadmap

Videos of the week

Projects of the week

• Klustr is a native Go/React Kubernetes desktop client that drives Helm, Argo CD, Flux, and cert-manager from your kubeconfig with no in-cluster components.

• Local Cloud Browser is a native macOS GUI for 28 AWS-compatible services, using Keychain credentials and read-only by default.

• WinPodX runs Windows apps as native Linux windows via FreeRDP RemoteApp, built in Python and Qt6.

• Zvec is Alibaba’s in-process C++ vector database that searches billions of vectors in milliseconds with hybrid retrieval.

• codebase-memory-mcp is an MCP server that builds code knowledge graphs, enabling AI agents to skip re-reading files and index the 28M-line Linux kernel in 3 minutes.

• Warpgate is a transparent Rust bastion and PAM for SSH, HTTPS, Kubernetes, MySQL, and Postgres with no client-side software.

Meme of the week

Someone collected 3,600 Google API keys, pointed an AI at them, and Google paid out $500,000. The payout isn’t the interesting part. It’s how many of those keys should never have worked at all.

A separate group gained access to high-profile Instagram accounts this week without writing a single exploit. They just asked Meta AI for access. It said yes.

And while two companies were learning what their AI would hand to a stranger, AWS shipped one agent that reads your bill and another that diagnoses your EKS nodes before you’ve finished reading the alert.

Notice the pattern. The more we wire agents into internal tools, the more of them reach for things nobody actually gave them permission to touch, and most of those connections have no auth and no record of who asked. That’s the gap Zuplo’s MCP Gateway closes.

In the tutorials: why a plain web page can turn ChatGPT’s own output into a phishing link, how to let Terraform auto-apply without losing sleep, and the reason your Claude Code security review keeps missing the bug in the same session you wrote it.

On video: Anthropic spent a year warning everyone about AI, then shipped Fable 5. Plus real lessons from engineering teams shipping on Claude.

Then seven devtools worth a look, including a server monitor, a self-hosted Postgres with instant branching, and an AI agent that runs entirely off a USB stick.

Your MCP servers have no security. Fix that

AI agents are connecting to your internal tools, and most MCP servers ship with no auth and no audit trail. Zuplo's MCP Gateway puts OAuth, structured audit logs, and centralized access control in front of them - Lock it down.

Newsworthy stories

• Hacking Google with AI for $500,000

• AWS fired the one employee who gave a damn

• Announcing the public preview of AWS FinOps Agent

• Hackers simply asked Meta AI for access to high-profile Instagram accounts

• Scaling Zero Copy from 1 trillion to 120 trillion rows with file federation

• How CockroachDB built vector indexing at scale

Tutorials of the week

• The architecture of a file tree that never freezes

• Safe Terraform auto-apply with conftest

• Your infrastructure repo is a mess (here’s how to fix it)

• Diagnose EKS Node issues faster with AWS DevOps Agent

• Lessons from building Claude Code: how we use skills

• ChatGPT markdown rendering vulnerability

• Hosting coding agents on Amazon Bedrock AgentCore

• EXPLAIN prettier, or post-processing query plans in Postgres

• Hidden gaps in Claude Code security reviews

• How to avoid rebuilding infrastructure for every new project

Videos of the week

Projects of the week

• Tabularis runs SQL notebooks, visual EXPLAIN plans, and an MCP server against Postgres, MySQL, and SQLite.

• Beszel monitors CPU, memory, disk, network, GPU, and Docker stats with alerts and history.

• doco-cd auto-deploys your Docker Compose projects and Swarm stacks straight from Git via webhooks.

• NeonD gives self-hosted Postgres instant branching, S3 durability, and point-in-time recovery.

• HelixDB stores both graph and vector data in a single OLTP engine for AI apps.

• Hermes-USB-Portable runs a self-contained AI agent off a USB drive with zero host dependencies.

Meme of the week

Three things happened this week that should bother you more than they probably do.

You can delete a Google API key and it keeps authenticating. You can have your GitHub token stolen in a single click without installing anything shady. And the Kubernetes Dashboard you’ve leaned on for years is being shown the door, with a replacement most people haven’t tried yet.

None of these are edge cases. They’re the kind of quiet shifts that don’t make the front page until they’ve already cost someone a weekend. Below: what’s actually going on with each, the supply chain secrets sitting on your dev laptop right now, why your AI-written incident reviews keep getting the root cause wrong, and 8 tools worth a look before Friday.

Speaking of catching things early: this week’s sponsor, Mendral, flagged a supply chain attack two weeks before it went public. It’s built by Docker and Dagger veterans and already chews through 1.18B log lines a week at PostHog.

Platform engineering on autopilot

Mendral is an autonomous AI DevOps engineer that handles the work your engineers shouldn’t be doing manually anymore: supply chain security, flaky CI, slow builds, and anything else specific to your stack - Try it out!

Newsworthy stories

• From Kubernetes Dashboard to Headlamp

• Google API keys keep working after you delete them

• I read the viral “Leaving AWS” post twice. Most of it is a skill issue

• The problem with AI-generated post-incident reviews

• You shipped it fast. But did you ship it right?

• AI through IaC, not instead of it

Tutorials of the week

• 1-click GitHub token stealing via a VSCode bug

• From Jira to PR: how we built agent-driven pipelines for design system changes

• Build an EKS environment factory with Pulumi and vCluster

• Well-architected best practices for software supply chain security

• Migrating from Go to Rust

• Detecting and removing dangerous secrets on dev workstations before Shai-Hulud does

• Securing your Gemini and Google API keys

• Handling graphs with SQL/PGQ in PostgreSQL

Videos of the week

Projects of the week

• Git Concepts Simulator is a browser game that teaches Git by letting you run commands and watch files move between the working directory, staging area, and remotes.

• Bumblebee is a Go read-only scanner from Perplexity that inventories packages and extensions across 9+ ecosystems to flag known-compromised software.

• GitHub Desktop Plus is a community fork of GitHub Desktop, adding multi-account support, Git worktrees, and commit search.

• Sandboxes is a Go engine for self-hosted cloud dev environments with built-in AI agents and live preview URLs, running on Docker with no Kubernetes.

• Mercek is a local-first desktop IDE for Amazon ECS with multi-account discovery, ECS Exec shell access, and Fargate right-sizing, read-only by default.

• Paseo is a control plane for running multiple AI coding agents (Claude Code, Codex, Copilot) in parallel across mobile, desktop, and CLI, fully self-hosted.

Meme of the week

On the tutorial side, a practical guide walks through Terraform state isolation using workspaces versus file layouts with S3 backends, and a case study on cutting a $140K Snowflake bill to $38K in three months using auto-suspend tuning, clustering keys, and query profile analysis. For system design, a deep dive into building S3-style object storage covers metadata/data separation, erasure coding, multipart uploads, and compaction. Plus a full K8s scheduling breakdown that traces the filter/score/bind loop with debugging playbooks for when your pod goes Pending.

For videos this week: a personal take on how AI has reshaped the day-to-day coding workflow, and a practical walkthrough of running LLMs on Kubernetes with LLMKube.

This week’s open source picks include Pullfrog, a TypeScript GitHub bot that triggers AI coding agents inside GitHub Actions via PR comment mentions; pgGraph, a Rust PostgreSQL extension that adds graph traversal to relational tables without a separate graph database; and Pathfinding Cloud Labs, a catalog of 100+ hands-on AWS IAM privilege escalation scenarios with a plabs CLI. Also worth checking: KeyLedger for unified AI API key management with health scoring, Murr for zero-copy ML inference caching on RocksDB, and ktx, a TypeScript/Python MCP context layer that helps AI agents query Snowflake and BigQuery accurately.

Newsworthy stories

• AWS restored my account: the human who made the difference

• GitHub Actions outage told devs “your account is suspended”

• How an attacker used LLMs to move from a CVE to an internal database in 4 pivots

• Rising AI spend turns FinOps into a boardroom strategist

• Gemini 3.5 deleted 28,745 lines, broke production, then fabricated the post-mortem

• Postgres is all you need for durable workflows

• How AWS DevOps agent uses multi-agent reasoning to find root causes

Tutorials of the week

• Terraform state isolation: how I kept dev, staging, and production from destroying each other

• ISO 27001 on AWS: building compliance into the architecture

• I inherited a $140K Snowflake bill. 3 months later, it was $38K. Here’s everything I learned

• Design S3 object storage like a senior engineer

• AI-powered event-driven Amazon EKS AMI updates with GitOps

• Automating security operations with AI: triaging Renovate PRs

• Where did my pod go? A deep dive into K8s scheduling

• Governing infrastructure as code using pattern-based policy as code

Videos of the week

Projects of the week

• Pullfrog is a model-agnostic GitHub bot that triggers AI coding agents inside GitHub Actions via PR/issue comment mentions, no separate infrastructure needed.

• KeyLedger is a TUI dashboard for managing AI provider API keys across OpenAI, Anthropic, AWS IAM, Google Cloud, and Mistral.

• pgGraph is a Rust PostgreSQL extension that adds graph traversal and shortest-path queries directly to relational tables via SQL.

• Pathfinding Cloud Labs is a catalog of 100+ hands-on AWS IAM privilege escalation labs across EC2, Lambda, ECS, SageMaker, and cross-account scenarios.

• Murr is a Rust RocksDB-backed caching layer for ML inference that manages tiered storage across RAM, NVMe, and S3 with zero-copy conversion.

• HeidiSQL is a GUI database client that supports MariaDB, MySQL, PostgreSQL, SQL Server, SQLite, Interbase, and Firebird.

• ktx is an MCP context layer that helps AI agents query data warehouses accurately by ingesting metric definitions and schema metadata from dbt, LookML, Looker, Metabase, and Notion.

Meme of the week

The team behind Docker and Dagger built Mendral, an autonomous AI DevOps engineer that investigates root causes across your repos, CI logs, Dockerfiles, and IaC, then ships fixes as reviewable PRs. Worth a look if supply chain security or slow CI is eating your engineers’ time.

A malicious VS Code extension granted attackers access to 3,800 GitHub repositories this week, raising fresh questions about extension trust in developer toolchains. Docker Sandbox’s undocumented microVM API was fully reverse-engineered and documented by the Rivet team; Terraform 1.15 landed with dynamic source references and variable deprecation; and Anthropic engineers are dropping Markdown in favor of raw HTML when building with Claude Code.

On the tutorial side: security researchers show exactly how malicious skills and agents can compromise Claude Code, Teads walks through cutting BigQuery slot usage by 90% after a production outage, there’s a deep-dive into building a distributed search engine in pure Go, and a postmortem on how unused Postgres indexes silently ate 41GB. Plus canary deployments with AWS SAM, root cause analysis with the AWS DevOps Agent, and Bedrock API key security.

For videos this week: how a single PR nearly hijacked the NPM registry, and a candid take on what moving too fast in software actually costs you.

This week’s projects include SCAM, a 1Password benchmark that tests AI agents’ security awareness in real-world workplace scenarios; pgsqlite, a Postgres wire protocol adapter for SQLite; swamp, a CLI for building reviewable AI agent workflows stored in Git; and capsule, a multi-tenancy framework for Kubernetes.

The team behind Docker and Dagger built an AI DevOps engineer

Mendral is an autonomous AI DevOps engineer that handles the work your engineers shouldn't be doing manually anymore: supply chain security, flaky CI, slow builds, and anything else specific to your stack.

It investigates root causes across your repos, CI logs, Dockerfiles, lockfiles, and IaC, then ships the fix as a reviewable PR - pinning CVEs, killing flakes, tuning cache layers, and upgrading dependencies without taking your engineers off product work - Try it out!

Newsworthy stories

• LLMs are good at SQL. We gave our terabytes of CI logs

• The request is the wrong unit of scale for LLMs on Kubernetes

• We reverse-engineered Docker Sandbox’s undocumented microVM API

• GitHub confirms breach of 3,800 repos via malicious VSCode extension

• Open in VSCode for Terraform in Azure Copilot

• How Anthropic engineers are building with Claude

Tutorials of the week

• Identifying security risks using AWS Cost and Usage Report data

• Live canary deployments with AWS SAM

• Mounting Git commits as folders with NFS

• Automate root cause analysis across Datadog and Elasticsearch with AWS DevOps Agent

• Compromising Claude Code with malicious skills and agents

  

• Building a distributed search engine in pure Go

• How we cut BigQuery slot usage by 90%

• AWS Bedrock security guide: API keys, detection, and response

• How unused indexes ate 41GB of Postgres storage

• Best practices for computer and browser use with Claude

Videos of the week

Projects of the week

• pgsqlite is a PostgreSQL protocol adapter for SQLite, allowing any PostgreSQL client to connect to and query SQLite databases over the standard wire protocol.

• SCAM is a benchmark from 1Password that tests AI agents’ security awareness through realistic, multi-turn workplace scenarios.

• snipe-it is an IT asset and license management system.

• changedetection.io is a website change-detection tool that alerts you when content, prices, or stock levels change.

• swamp is a CLI that supercharges AI agents to build reviewable, shareable operational workflows, stored as versioned YAML in a Git directory.

• capsule is a multi-tenancy and policy framework for Kubernetes that enforces namespace isolation and resource policies across tenant clusters.

• git-switch is a native Git client that runs dev servers directly from the UI.

Meme of the week

On the tutorial side: zero-downtime blue-green frontend deploys on a single EC2 instance with Docker and Nginx, a ten-control GitHub Actions security checklist for surviving supply chain attacks, a breakdown of how Docker’s ONBUILD directive becomes a hidden attack vector in base images, Anthropic’s own guide to running Claude Code in large codebases, a walkthrough of automating dev workflows with MCP, schema validation for Terraform input configs using CUE, and querying Redis with plain SQL.

For videos this week: an argument for why Jenkins is now effectively dead, and a look at the single hottest programming skill to have in 2026.

This week's open source picks include deepsec, a Vercel Labs scanner that runs coding agents across microVMs to find vulnerabilities in large repos; coroot, an eBPF observability platform with zero-instrumentation telemetry and AI root cause analysis; dockhand, a Docker management UI on a hardened Wolfi OS layer; re_gent, version control for AI coding agents that records which prompt wrote each line; petri, a drop-in PostgreSQL replacement that hands every test its own isolated database; tfrev, a Claude-powered reviewer that flags dangerous Terraform plan mismatches; and workshop, a local debugger for coding agents that streams traces and self-heals failing code.

Newsworthy stories

• Your container is not a sandbox

• AI load breaks GitHub, why not other vendors?

• What’s gone wrong at GitHub?

• Why I’m leaving GitHub for Forgejo

• AI assistants are leaking your conversations

• The (in)security landscape of AI-powered GitHub Actions

• Everything you know about scaling web apps breaks when you serve an LLM

• How we replaced Ingress-NGINX at Stack Overflow

• Top 15 CI/CD metrics

• The danger of multi-SSO AWS Cognito user pools

Tutorials of the week

• GitHub Actions security checklist for supply chain attacks

• Schema validation for Terraform input configuration

• Use Redis with SQL

• Zero downtime frontend deploys with blue-green on a single EC2

• Unmasking the Docker ONBUILD supply chain attack vector

• How Claude Code works in large codebases

• Automate your dev workflows with MCP

• Inbox and outbox patterns for reliable event processing

• My favorite Go backend architecture pattern

Videos of the week

Projects of the week

• deepsec runs coding agents across microVMs to scan large repos for vulnerabilities, resuming where it left off after interruptions.

• coroot is an eBPF-based observability platform with zero-instrumentation metrics, logs, traces, and AI-powered root cause analysis.

• dockhand is a Docker management UI for container orchestration, Compose stacks, and Git-based deployments.

  

• re_gent is version control for AI coding agents that records which prompt wrote each line, with rgt log, rgt blame, and rgt show.

• petri is a drop-in PostgreSQL replacement that gives every test its own isolated, seeded database with no cleanup or shared-state flakiness.

• tfrev uses Claude to review Terraform plans against code changes and flag intent mismatches like a tag edit triggering a full destroy and recreate.

• workshop is a local debugger for coding agents that streams traces in real time, writes evals, and self-heals failing code until assertions pass.

Meme of the week

IaCConf 2026 is this edition’s sponsor, a virtual event on May 14th that brings together platform engineering leaders to discuss what happens to your platform abstractions and metrics when AI becomes a first-class consumer of your infrastructure.

On the news side, a direct argument that Terraform is now obsolete, as LLM can translate intent into infrastructure without an intermediate DSL. One engineer left port 22 open on the internet for 54 days and documented exactly who showed up. AWS shipped S3 Files, a native NFS layer that lets Lambda, EKS, and EC2 mount S3 buckets as shared filesystems without changing application code. Researchers using AI tools found RCE vulnerabilities in PostgreSQL’s pgcrypto extension and MariaDB’s JSON validation logic that had been sitting there for over 20 years, with patches now out for both. Postman shared how they scaled security reviews across engineering without creating a bottleneck. Google published its official BigQuery threat model covering 14 attack vectors, including privilege escalation and data exfiltration.

On the tutorial side: a SQL learning game built around Squid Game’s format with 9 progressive levels, a PCI-DSS compliant GKE framework walkthrough for financial institutions, building a serverless AI agent code review system on top of AWS S3 Files and Lambda, a step-by-step guide to fixing CrashLoopBackoff in Kubernetes, Cilium’s CI/CD security lessons from running a large open source project, Slack’s migration of 700+ EMR pipeline jobs from SSH to REST with zero downtime, and a practical look at stopping Claude Code from leaking sensitive data using Cedar policy-as-code.

For videos this week: on networking concepts every DevOps engineer needs to know, and a deep dive into why the GitHub situation just got worse.

This week’s open source picks include late.sh, a Rust SSH terminal with real-time chat, lofi streaming, and games on a PostgreSQL backend; frak, a Node.js CLI that deploys files over rsync with interactive diffs and post-deploy hooks; Sn1per, an offensive security platform in Shell and Lua orchestrating 90+ tools with 600+ exploits in a single Docker workspace; GreptimeDB, a Rust observability database unifying metrics, logs, and traces as a drop-in for Prometheus, Loki, and Elasticsearch at 50x lower storage cost; waffle, a Go CLI that runs AWS Well-Architected reviews against Terraform files via Amazon Bedrock; and graphify, a Python tool that turns codebases, docs, PDFs, and videos into knowledge graphs for Claude Code, Cursor, and GitHub Copilot.

Your Platform Engineering playbook needs an AI rethink

Join the sharpest minds in platform engineering from Google, AHEAD, Mondelez, & Weave Intelligence to learn if the metrics, abstractions, and practices you’re relying on today will still hold up as AI becomes a first-class consumer of your platform.

Register Now - May 14th

Newsworthy stories

• Terraform is dead

• I left port 22 open on the internet for 54 days, here’s who showed up

• S3 is not a filesystem, but now there’s one in front of it

• AI sandboxing is having its Kubernetes moment

• How we scaled security reviews without slowing down engineering

• S3 is the perfect place to store data, until you try to search it

• BigQuery threat model report

• AI finds 20-year-old bugs in PostgreSQL and MariaDB

• Trunk-based development: your pull requests are still too big

Tutorials of the week

• SQL Squid Game

• Building a PCI-DSS compliant GKE framework for financial institutions

• Lambda just got a file system. I put AI agents on it

• Building an MCP server using PostgreSQL

• How do I fix CrashLoopBackoff in Kubernetes?

• Building secure PII encryption at scale

• Securing CI/CD for an open source project

• A security-driven modernization of Slack’s EMR data pipelines

• How to stop Claude Code from leaking sensitive data

Videos of the week

Projects of the week

• late.sh is a Rust-based terminal social platform over SSH with real-time chat, lofi streaming, and shared TUI games.

• frak is a Node.js CLI that deploys files to remote servers via rsync over SSH with interactive diffs and post-deploy hooks.

• Sn1per is a Shell/Lua offensive security platform consolidating recon, scanning, exploitation, and reporting across 90+ tools in one Docker workspace.

• GreptimeDB is a Rust observability database that unifies metrics, logs, and traces as a drop-in replacement for Prometheus, Loki, and Elasticsearch.

• waffle is a Go CLI that runs AWS Well-Architected Framework reviews against Terraform files via Amazon Bedrock.

• ai-dba-workbench is a Go/TypeScript PostgreSQL monitoring platform with AI anomaly detection and natural language cluster queries via MCP.

• git-commands-cheatsheet is a zero-dependency HTML reference covering 115 Git commands.

• graphify is a Python tool that turns codebases, docs, PDFs, and videos into queryable knowledge graphs for Claude Code, Cursor, and GitHub Copilot.

Meme of the week

TeamCity 2026.1 introduces a set of focused improvements that make your CI/CD more intuitive, intelligent, and enterprise-ready.

Werner Vogels published a detailed look at the engineering behind Lambda’s network. On the security side, GitHub Actions is identified as the weakest link in your CI/CD chain, with a thorough breakdown of how supply chain attacks can move through workflows. Cloudflare shared the internal AI engineering stack they actually run, including how they’re orchestrating AI code review at scale across their own engineering org. Halodoc documented their migration of AWS MSK from ZooKeeper to KRaft using a canary approach, and one team explains why Dockerfile practices cost you before they ever become a security problem.

On the tutorial side: a $1,432 to $233/month hosting cut by moving from DigitalOcean to Hetzner with zero downtime, Terraform module design via an AI agent skill built around design decisions first and code generation second, a detailed argument that Terragrunt’s run-all is broken beyond repair by multi-state transactions, benchmarking workflow execution scalability on Postgres, building a production MCP server in Go, auto-diagnosing Kubernetes alerts with HolmesGPT, and Cloudflare’s own AI code review pipeline in depth.

For videos this week: a practical terminal setup combining Tmux, btop, and GPU monitoring into a single system monitoring workflow, a real-world look at what a billion database rows actually looks like in production, and an investigation into why companies spend millions buying GitHub stars.

This week’s open source picks include JuiceFS, a Go-based POSIX file system that stores data in S3 and metadata in Redis or MySQL with 10x the sequential throughput of EFS; Gatus, a Go health dashboard that monitors over HTTP, TCP, DNS, gRPC, and 40+ alerting integrations; kured, the CNCF Sandbox Kubernetes daemonset that automates safe node reboots using API server locking; and RedAI, a TypeScript and Python workbench that validates AI-discovered vulnerabilities in live browser and simulator environments before generating reports.

AI, Pipelines, and Enterprise CI/CD

TeamCity 2026.1 introduces a set of focused improvements that make your CI/CD more intuitive, intelligent, and enterprise-ready. Join us on May 12th for a live walkthrough of the latest updates, including the new TeamCity CLI and MCP support!

Newsworthy stories

• The invisible engineering behind Lambda’s network

• GitHub Actions is the weakest link

• The AI engineering stack we built internally

• Dockerfile practices are a DevOps tax before they are a security concern

• Migrating AWS MSK from ZooKeeper to KRaft

Tutorials of the week

• Terraform module design is the hard part, so I built an agent skill for it

• Migrating from DigitalOcean to Hetzner: from $1,432 to $233/month with zero downtime

• Terragrunt is dead: multi-state transactions killed run-all

• Does Postgres scale?

• Orchestrating AI code review at scale

• My Claude Code setup

• AWS DevOps Agent: your AI SRE is now on call

• Auto-diagnosing Kubernetes alerts with HolmesGPT and CNCF tools

• Dockerizing a Java 26 project with Docker Init

• Building a production MCP server in Go

Videos of the week

Projects of the week

• JuiceFS is a Go-based POSIX distributed file system that stores data in S3 and metadata in Redis or MySQL, with 10x more throughput than EFS.

• Gatus is a Go health dashboard that monitors services over HTTP, TCP, DNS, gRPC, and SSH with 40+ alerting integrations.

• winpodx is a Python tool that runs Windows apps as native Linux windows using FreeRDP RemoteApp and a containerized Windows instance.

• kured is a Go Kubernetes daemonset that safely reboots nodes one at a time using API server locking. CNCF Sandbox project.

• RedAI is a TypeScript/Python workbench that uses AI agents to find and validate vulnerabilities in live browser and simulator environments.

• Rocky is a Rust control plane for data warehouse pipelines with column-level lineage, schema drift detection, and compile-time data contracts.

Meme of the week