Digest #230: AWS root accounts sprayed at 150+ orgs, Shai-Hulud hunts 469 secret paths, Nvidia buys Hugging Face and Kubernetes scales to zero

Also inside: a Cilium bug made pods take 90s to start, what happened when someone broke a K8s cluster on purpose to test AI debugging agents, and how GitHub cut Copilot's bill without making it dumber

Someone spent a month knocking on the root account of more than 150 AWS organizations, and Datadog's writeup is worth reading precisely because every single attempt failed. The interesting part is that the attackers already knew the root email addresses, which makes this a failed campaign built on successful reconnaissance.
Meanwhile Shai-Hulud came back checking 469 places for credentials instead of 189, Nvidia agreed to buy Hugging Face for about $13 billion, and Kubernetes quietly shipped the thing plenty of teams have been faking with cron jobs for years.

If you’re interested in sponsoring this newsletter, feel free to reach out via LinkedIn or simply reply to this email.

One webhook platform for your agents and your customers

Most AI agents can’t receive a webhook: they run on a laptop, behind a VPN, or in a sandbox that blocks inbound traffic.

Svix Ingest takes events from Stripe, GitHub, incident.io, or anything else that sends webhooks, and your agent pulls them over an outbound HTTPS connection a few seconds later. No public URL, no tunnel, and nothing lost while it was offline.

Try Svix for free

My take: three frontier models in three days

Every big lab shipped this week. Claude Fable 5.1, Gemini 3.8 Flash, and GPT-6 Astra.

Newsworthy stories

• Password spraying hit AWS root accounts at 150+ organizations

• Shai-Hulud now scans 469 credential locations, up from 189

• Nvidia agrees to buy Hugging Face for almost $13 billion

• Kubernetes v1.37 can scale workloads to zero with the HorizontalPodAutoscaler

• MCP went stateless, so your AWS deployment can drop sticky sessions

• How GitHub cut Copilot’s inference bill without hurting task quality

• Saving petabytes of cache storage with Zstandard and Pingora

• AI scrapers are now most of kernel.org’s traffic

Tutorials of the week

• Detecting multi-stage attacks on AWS by correlating signals across services

• Terraform observability: drift detection, TF_LOG and plan metrics in practice

• How to handle errors in Go

• AWS S3 bucket security: finding the secrets that live outside Git

• Cutting EKS MTTR with the AWS DevOps Agent and a Kubernetes operator

• Can an AI agent debug Kubernetes? I broke a cluster to find out

• Why pod setup started timing out after 90 seconds

• Which tools do Claude, Codex and Cursor reach for?

• I spent a full day on a “five-minute” Docker migration

• PostgreSQL shared memory visualizer

• Build your own continuous modernization pipeline with AWS Transform custom

• Choosing GCP cost optimization tools that match your environment

Videos of the week

Projects of the week

• Warren runs coding agents as managed infrastructure with isolation, spend limits, and Git delivery instead of terminal sessions.

• Boost compresses the noisy output of the commands your coding agent runs so it keeps the errors and timings without the log spam.

• ZSvirt runs and manages KVM virtual machines from a single web console, including VMware migration.

• Rootprint searches logs and traces directly from object storage, so you can self-host log management instead of renting it.

• pgterm monitors every Postgres database you own from a single terminal dashboard and flags those that need attention.

• ku browses Kubernetes resources, follows logs, and drops you into pods from a keyboard-driven terminal UI.

• srelens combines cluster browsing, logs, exec, and port forwarding into a single local desktop workspace built for engineers and agents alike.

Meme of the week

Want to reach out to sponsor the newsletter? Book a slot - Q4 dates are open.