Digest #235: GhostAction's 346-repo burst, Airbnb's MySQL regression, Kubernetes' 10-second shutdown and AI vulnerability triage

Also inside: Sam Newman on resilient systems, encrypting secrets with SOPS, and five GitHub security settings you can enable from your terminal.

GhostAction is still spreading: an October 8 burst injected fake security-audit workflows into 346 repositories, now hunting credentials in Git history as well as GitHub Actions secrets.
Airbnb's database replay system caught a MySQL upgrade turning a 0.03-second query into a 2.6-second query.
And if your Kubernetes workers have 300 seconds to shut down, a supervisor with a 10-second timeout can make that setting meaningless.

If you’re interested in sponsoring this newsletter, reach out via LinkedIn or reply to this email.

My take: rotating CI secrets is only half the cleanup

Newsworthy stories

• How Airbnb replays real database workloads to catch MySQL performance regressions

• Datadog finds 3,500+ dangerous Kubernetes RBAC bindings to built-in principals

• Can Claude fix itself? Three production incidents from Anthropic’s on-call team

• Testing Jev against Claude and traditional record linkage for identity resolution

Tutorials of the week

• Connect AWS DevOps Agent to OpenSearch logs and traces through MCP

• Build an AI vulnerability harness with evidence-based exploitability checks

• Debug why a 300-second Kubernetes grace period becomes a 10-second shutdown

• Encrypt secrets in Git, CI/CD and Kubernetes with SOPS

• Why multi-tenant best practices can send background work to the wrong tenant

• Make Terraform easier for AI agents by simplifying your infrastructure

• Poison a Go build cache without changing the program’s source

• Explore how PostgreSQL rewrites query plans

• Cut incident detection from 40 seconds to under 10 with OpenTelemetry, Kafka and Flink

• Structure Terraform modules with consistent files, generated docs and pre-commit checks

Podcasts of the week

Building resilient systems with Sam Newman

Projects of the week

Meme of the week

Want to sponsor the newsletter? Book a slot - Q4 dates are open.