Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News

Teller's Tech - DevOps, SRE and Cloud Podcast
  • 5.0 (1)
  • Tech News
  • Updated twice weekly

Ship It Weekly is a short, practical recap of what actually matters in DevOps, SRE, cloud infrastructure, and platform engineering. Each episode, your host Brian Teller walks through the latest outages, releases, tools, and incident writeups, then translates them into “here’s what this means for your systems” instead of just reading headlines. Expect a couple of main stories with context, a quick hit of tools or releases worth bookmarking, and the occasional segment on on-call, burnout, or team culture. This isn’t a certification prep show or a lab walkthrough. It’s aimed at people who are already working in the space and want to stay sharp without scrolling status pages, cloud updates, and blogs all week. You’ll hear about things like cloud provider incidents, Kubernetes and platform trends, Terraform and infrastructure changes, and real postmortems that are actually worth your time. Most episodes are 15–30 minutes, so you can catch up on the way to work or between meetings. Every now and then there will be a “special” focused on a big outage or a specific theme, but the default format is simple: what happened, why it matters, and what you might want to do about it in your own environment. If you’re the person people DM when something is broken in prod, or you’re building the cloud and platform everyone else ships on top of, Ship It Weekly is meant to be in your rotation.

  1. 2 hr ago

    Ship It Conversations: Running Retros as Tabletop RPGs, With Jinger Meilani of Mountain on Chapters and Characters, Technical Archetypes, Reading the Room, Following Through, and Why Silliness Gets You Honest Answers

    This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps. In this Ship It Conversations episode, I talk with Jinger Meilani about Tabletop Retro, her way of turning an engineering retrospective into a tabletop role-playing game, and why a little silliness gets teams to give honest answers. Jinger is a Senior Software Engineer in DevOps at Mountain. She says Tabletop Retro brings together three things she loves: world building, psychological safety on teams, and engineering enablement. We start with why she reinvented the retro at all. She was bored of them, and even the themed ones got rote. At a previous company, the team rotated who ran the retro, and her turn landed around Halloween, so she built a story around the team. She calls the result retro plus plus plus. The usual formats and outcomes are all still there, inside a story. A lot of it comes down to silliness. Jinger compares it to hiding vegetables in a fruit smoothie: it disarms people, and she gets honest answers, sometimes while everyone thinks they're talking about something else. That's also why she won't run one during a fire. People have to feel comfortable before they'll speak their truth, so the flame-breathing dragon can wait. Then we get into how one is built. A Tabletop Retro is a series of chapters, and each chapter holds part of the story and at least one activity. Players fill out character sheets, and each in-game race maps to a technical archetype, like a Goliath for a high-level systems thinker or a gnome for a tinkering automation engineer. Afterward the team talks through what those picks say about their strengths and weaknesses. She presents it like a storybook, in Lucidchart or Canva over Zoom. Characters cut both ways. For some people, an orc is permission to say what they'd never put on a retro board, because it's not really how they feel. They're just an orc. Others find role-play intimidating, so she reads the room: improv for an outgoing teammate, a line on screen for someone else, or no speaking part at all. If you want to try one, start with the questions, not the world. Where is the team unaligned? When does communication break down? Then keep the setting small. Kids trick-or-treating is plenty. The big takeaway: a Tabletop Retro is still a retro, and Jinger holds it to a higher bar. If everyone has fun and tells you something honest, and then nothing changes, it failed. Someone still has to do the work. Highlights • Why she calls it retro plus plus plus • Hiding vegetables in a fruit smoothie • Why you don't run one during a fire • Chapters, character sheets and technical archetypes • "I'm just an orc," and why role-play makes some people nervous • Reading the room: improv, on-screen lines, or no lines at all • Start with the questions, then keep the world small • Fun with no follow-through is a failed retro Links Tabletop Retro, Jinger's framework: https://tsn.io/wXdtL Jinger Meilani on LinkedIn: https://tsn.io/xn8Jr Jinger's IaCConf talk, Designing IaC Interfaces That Work for Humans, AI Agents, and Whatever Comes Next: https://tsn.io/5b4DM More episodes and show notes: https://tsn.io/NqkdP On Call Brief: https://tsn.io/Gpz2d LMGT Awards: https://tsn.io/lAERA

    Ship It Conversations: Running Retros as Tabletop RPGs, With Jinger Meilani of Mountain on Chapters and Characters, Technical Archetypes, Reading the Room, Following Through, and Why Silliness Gets You Honest Answers

  2. 2 days ago

    LiteLLM Release Pipeline Hijacked Again, GitHub Package Firewall, PHP2Shell Core RCEs & eMudhra CA Keys Compromised

    This week on Ship It Weekly, LiteLLM's release pipeline was hijacked again: stolen GitHub CLI tokens from three engineers changed the pipeline, kicked off the release and approved it, and a credential-stealing 1.107.0 went out to PyPI and Docker Hub. GitHub put a package firewall into public preview, with advisory and supply chain checks and a cooldown for new releases. PHP fixed PHP2Shell, two critical core runtime bugs (CVE-2026-109618 and CVE-2026-109619) that someone tried to exploit four days before disclosure. And eMudhra, a certificate authority in India, found out the private keys for eight intermediate certificates could be worked out from its own public certificates. The thread: most of this came through things you depend on but don't run. A library's release pipeline, the registry you pull from, the runtime under your app, and the trust store in your images. In the lightning round: another GitLab CVSS 10 (CVE-2026-110264), Google's report on the europe-west2 London outage, AWS taking its European Sovereign Cloud off the global backbone on October 24, and a GitHub audit log change that can quietly break SIEM rules. The human closer, from Brent Chapman: page on what users actually do. Your users don't care how your machines feel. They care whether they can log in. On Monday, Jinger Meilani joins me to talk about running retros like a tabletop RPG. Highlights • LiteLLM 1.107.0: two stolen identities passed a two-person approval • GitHub package firewall: advisories, attestations and a cooldown • PHP2Shell: an exploit attempt four days before disclosure • Patching PHP is easy, finding all of it is hard • eMudhra: CA private keys worked out from public certificates • Page on what users feel, not how the machine feels Links LiteLLM 1.107.0 compromise (Wiz): https://tsn.io/yQtmu GitHub package firewall in public preview: https://tsn.io/QjofJ PHP2Shell, CVE-2026-109618 and CVE-2026-109619 (Help Net Security): https://tsn.io/GUyop Eight eMudhra CA keys compromised (The Hacker News): https://tsn.io/K2jqM GitLab 19.5.1 patch release: https://tsn.io/0wsPX Google Cloud europe-west2 incident report: https://tsn.io/nVk2N AWS European Sovereign Cloud independent operation: https://tsn.io/gKnQl GitHub secret scanning updates: https://tsn.io/JDGmT Stop paging on how your machines feel (Brent Chapman): https://tsn.io/MAItM SRE Weekly #539: https://tsn.io/XAsKz This week's On Call Brief: https://tsn.io/nBAVg More episodes and show notes: https://tsn.io/NqkdP On Call Brief: https://tsn.io/Gpz2d LMGT Awards: https://tsn.io/lAERA

    LiteLLM Release Pipeline Hijacked Again, GitHub Package Firewall, PHP2Shell Core RCEs & eMudhra CA Keys Compromised

  3. 19 Oct

    Ship It Conversations: Rob Koch of Slalom on Accessible Cloud Native, Sign Language Recognition with Kubeflow, Overhyped AI, Conference Accessibility, and Why Teams Should Hire Deaf Engineers

    This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps. In this Ship It Conversations episode, I talk with Rob Koch about what accessible cloud native actually looks like, why sign language is still one of the hardest problems in AI, and why the fastest way to make your tooling accessible is to hire deaf engineers. Rob is a senior principal at Slalom, an AWS Hero, and co-chair of the CNCF Deaf and Hard of Hearing Working Group. Rob is Deaf, and his ASL interpreter, Amelia Fruehsamer, voices his answers. Special thanks to Amelia for interpreting the conversation. We start with an analogy Rob comes back to all episode: cloud native is the toolbox, and platform engineering is the workbench. Then we get into what's overhyped about AI, the guardrails it still needs, and what auditable AI observability looks like. A big part of the conversation is accessibility in practice. Rob explains how captions pushed for deaf attendees ended up helping neurodivergent folks too, and what conferences get wrong: accessibility planned at the very end instead of the start, and the real cost of interpreters versus captions. Then we get technical. Rob walks through using Kubernetes and Kubeflow to train models that recognize sign language, and why it's so hard: regional signs, lighting, skin tone and backgrounds, and a camera that can't tell which way a hand is facing. His joke: we don't have AGI until AI understands sign language. The big takeaway: start with people, not a checklist. Hire deaf and hard of hearing engineers, ask them how they want to work, and your tools get more accessible because they're in the room. Highlights • Cloud native as the toolbox, platform engineering as the workbench • What's overhyped about AI, and the guardrails it still needs • What accessible cloud native means in practice • Captions that help far more people than you planned for • What conferences get wrong about accessibility, and what it costs • Kubernetes and Kubeflow for sign language recognition • Gesture-based computing and why speech-to-text had a 30-year head start • Where to start: hire deaf engineers Links Rob Koch on LinkedIn: https://tsn.io/4qmFo Rob Koch on GitHub: https://tsn.io/Mbxrs Amelia Fruehsamer (Rob's ASL interpreter) on LinkedIn: https://tsn.io/UJB88 CNCF Deaf and Hard of Hearing Working Group: https://tsn.io/tB1lS CNCF conference accessibility best practices: https://tsn.io/BZvpv CNCF Merge Forward: https://tsn.io/QPVNQ Kubeflow: https://tsn.io/4OVKf More episodes and show notes: https://tsn.io/NqkdP On Call Brief: https://tsn.io/Gpz2d LMGT Awards: https://tsn.io/lAERA

    Ship It Conversations: Rob Koch of Slalom on Accessible Cloud Native, Sign Language Recognition with Kubeflow, Overhyped AI, Conference Accessibility, and Why Teams Should Hire Deaf Engineers

  4. 17 Oct

    GitHub Actions Lockfiles, GitLab CVSS 10 CI Flaw, Google Cloud Storage Outage & Torvalds Builds Kernel Patches With Claude Code

    This week on Ship It Weekly, GitHub Actions workflow lockfiles land in public preview, pinning actions and their dependencies to exact commits. GitLab shipped a critical patch release for CVE-2026-97229, a CVSS 10 CI/CD regex flaw that could let an unauthenticated attacker run code on the server. Google published its final report on two Cloud Storage incidents in us-central1, including a recurrence caused by an incomplete rollback. And Linus Torvalds pushed an experimental kernel branch with page-cache patches built using Claude Code, as maintainers debate dropping the mandatory AI attribution tag. The thread this week: know what you're actually running, from the commit you reviewed to the state a rollback really left behind and code someone can still explain. In the lightning round: a record Patch Tuesday with more than 1,400 CVEs and an actively exploited Windows Shell bypass, GitHub AI Scan for pull requests and agentic autofix going GA, AWS Strands Box, an open-source agent sandbox that keeps real credentials out of the agent's environment, and a Microsoft 365 outage through Global Secure Access. The human closer comes from Paul LaPosta's “Your error budgets don't know AI exists.” AI has split shipping a change from understanding it, and SLOs don't measure comprehension. Your SLO can tell you the service is up. It cannot tell you whether anyone still understands it. Programming note: Ship It Weekly turns one next month, so expect more conversations over the next couple of months, usually two a week, starting Monday with Rob Koch. Links GitHub Actions workflow lockfiles GitLab 19.4.2 / 19.3.5 / 19.2.8 patch release Google Cloud Storage incident report Linus Torvalds and Claude Code (Phoronix) Linux drops the Assisted-by requirement (Phoronix) October 2026 Patch Tuesday GitHub AI Scan for pull requests GA Agentic autofix GA AWS Strands Box Microsoft 365 Global Secure Access outage Your error budgets don't know AI exists (LeadDev) This week's On Call Brief

    GitHub Actions Lockfiles, GitLab CVSS 10 CI Flaw, Google Cloud Storage Outage & Torvalds Builds Kernel Patches With Claude Code

  5. 12 Oct

    Ship It Conversations: Erik Osterman of Cloud Posse on Terraform Modules, IaC Frameworks, Atmos, Internal Developer Platforms, AI Agents, and Why Conventions Matter More Than Ever

    This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps. In this Ship It Conversations episode, I talk with Erik Osterman of Cloud Posse about Terraform modules, infrastructure as code frameworks, internal developer platforms, and why AI makes conventions more valuable, not less. Erik is the founder and CEO of Cloud Posse, which has published more than 180 open source Terraform modules, and he hosts Cloud Posse's weekly DevOps Office Hours. We start with what AI has done to open source infrastructure projects, then get into what makes a good Terraform module: consistent naming, a consistent interface, not so small that it wraps a single resource, and not so large that it has a hundred inputs nobody can test. We also talk about CloudFormation, Pulumi, and why HCL's constraints helped build the module ecosystem. Erik explains where Crossplane fits, and why accounts, IAM, networking, DNS and certificates all come before the cluster. A big part of the conversation is frameworks. Erik argues that nobody actually runs "vanilla Terraform," because Terraform alone doesn't handle state layout, promotion, authentication, tool installation or repository structure. Every team ends up building its own framework, usually undocumented. We talk about Terragrunt, Atmos, naming conventions, brownfield adoption, and breaking a monolithic root module into services. Near the end, we get into AI and self-service. Erik's team now generates most of its infrastructure work with AI, and it works because the conventions, agent skills, MCPs and pipelines are already in place. Self-service doesn't have to mean another no-code platform. The big takeaway: AI can generate infrastructure code faster than ever, but without conventions it is generating into chaos. Highlights • What makes a good Terraform module • Root modules vs. child modules • CloudFormation, Terraform, Pulumi, and why constraints helped HCL win • Where Crossplane fits, and what has to exist before the cluster • Why internal developer platforms like Backstage come after zero-to-one • Why infrastructure as code needs frameworks, not just modules • Agent skills, MCPs, and self-service without a no-code platform Links Cloud Posse: https://cloudposse.com Atmos: https://atmos.tools Cloud Posse on GitHub: https://github.com/cloudposse DevOps Office Hours: https://tsn.io/2gq7v Erik Osterman on LinkedIn: https://www.linkedin.com/in/osterman More episodes and show notes: https://tsn.io/NqkdP On Call Brief: https://tsn.io/Gpz2d LMGT Awards: https://lmgt.org

    Ship It Conversations: Erik Osterman of Cloud Posse on Terraform Modules, IaC Frameworks, Atmos, Internal Developer Platforms, AI Agents, and Why Conventions Matter More Than Ever

  6. 10 Oct

    Critical Atlassian CVE Hits Jira, Confluence & Bitbucket, GitHub Copilot Sandboxing Goes GA, AWS Lambda SnapStart for Containers & Google Spanner Omni

    This week on Ship It Weekly: Atlassian disclosed a critical arbitrary file access vulnerability affecting eight Data Center products, including Jira, Confluence, Bitbucket, and Bamboo. GitHub Copilot local sandboxing is now generally available, giving teams enforceable controls around filesystem, network, credentials, and local tooling. AWS published a deeper look at Lambda SnapStart for container images, including the operational risks of restoring initialized state. And Google Spanner Omni is now generally available, bringing Spanner outside Google Cloud and putting more of the availability responsibility back on the customer. The bigger theme this week is control. Developer tools are production infrastructure. AI agents need real execution boundaries, not just instructions. Faster startup through snapshots means understanding exactly what state is being restored. And moving a managed database onto your own infrastructure gives you portability, but also gives you the pager. In the lightning round: Citrix has a NetScaler SAML vulnerability under active exploitation. Cloudflare is working toward becoming a publicly trusted certificate authority. And attackers are actively scanning for Rejetto HFS servers vulnerable to a flaw that can lead to account takeover and remote code execution. And the human closer comes from Lorin Hochstein and a recent Google Cloud networking incident. One part of the outage involved someone correctly following an incorrect procedure, while another involved someone incorrectly following a correct one. Training matters, but systems also need guardrails that keep normal human mistakes from turning into large outages. If your system only works when nobody makes a mistake, the system is the problem. Links Atlassian CVE-2026-21589 https://tsn.io/ZlqKv GitHub Copilot Local Sandboxing https://tsn.io/rQngM AWS Lambda SnapStart for Container Images https://tsn.io/uXqkK Google Spanner Omni GA https://tsn.io/GoZZ5 Citrix NetScaler CVE-2026-88779 https://tsn.io/yN5a9 Cloudflare Certificate Authority https://tsn.io/egMN5 Rejetto HFS CVE-2026-61500 https://tsn.io/oQrkU Google Cloud Networking Incident https://www.tellerstech.com/go/s-dc989ad2/ There Was a Light That Never Went Out https://www.tellerstech.com/go/s-cb0bc459/ This Week’s On Call Brief https://tsn.io/8yaIY Ship It Weekly https://tsn.io/NqkdP On Call Brief https://tsn.io/Gpz2d

    Critical Atlassian CVE Hits Jira, Confluence & Bitbucket, GitHub Copilot Sandboxing Goes GA, AWS Lambda SnapStart for Containers & Google Spanner Omni

  7. 1 Oct

    AWS Retires DevOps Guru: What the End of Support Means, Kubernetes Cross-Namespace CVE-2026-2270, Node.js Undici WebSocket DoS & Cloudflare’s New CLI for AI Agents

    This week on Ship It Weekly: AWS is retiring Amazon DevOps Guru and pointing customers toward CloudWatch and the newer Amazon DevOps Agent. Kubernetes disclosed a vulnerability where StatefulSet and ControllerRevision permissions can allow cross-namespace pod creation under specific conditions. A vulnerability in Undici can let a malicious WebSocket server crash a Node.js process through compressed data. And Cloudflare launched a new CLI as AI agents grow from 25 percent to 48 percent of Wrangler usage. The bigger theme this week is how the systems around our infrastructure are changing. Managed cloud services still have lifecycles that eventually become migration work. Kubernetes authorization can depend on what controllers do with the resources users are allowed to manipulate. Applications acting as clients still process untrusted data. And infrastructure tooling is starting to treat AI agents as first-class users rather than humans who happen to automate commands. In the lightning round: another Kubernetes vulnerability affecting Windows nodes can expose NetNTLMv2 credentials through NTLM coercion. GitHub now supports custom runners for Dependabot version and security updates. And external systems like a CMDB or internal developer portal can push repository properties into GitHub while remaining the source of truth. And the human closer comes from Lorin Hochstein and SRE Weekly. Some availability risks are probably never going away. Resources are finite, networks fail, security controls can affect availability, and production systems have to change. Preventing individual failures still matters, but incident response is part of reliability engineering too. Sometimes improving reliability means getting better at handling the failures you cannot eliminate. Links Amazon DevOps Guru End of Support - https://tsn.io/GQHN8 Kubernetes CVE-2026-2270: Cross-Namespace Pod Creation - https://tsn.io/BsNs8 Undici CVE-2026-85024: WebSocket Denial of Service - https://tsn.io/LncLd Cloudflare: Introducing the cf CLI - https://tsn.io/Wk3ma Cloudflare Forge - https://tsn.io/bAPJu Lightning Round Kubernetes CVE-2026-76654: Windows NTLM Coercion - https://tsn.io/36Kc3 GitHub: Custom Runners for Dependabot - https://tsn.io/tYl9K GitHub: External Custom Properties - https://www.tellerstech.com/go/s-1fd1396d/ Human Closer Omnipresent Availability Risks in Cloud Software - https://www.tellerstech.com/go/s-076db9dd/ Our Links This Week’s On Call Brief - https://tsn.io/fKB9V Ship It Weekly - https://tsn.io/NqkdP On Call Brief - https://tsn.io/Gpz2d

    AWS Retires DevOps Guru: What the End of Support Means, Kubernetes Cross-Namespace CVE-2026-2270, Node.js Undici WebSocket DoS & Cloudflare’s New CLI for AI Agents

  8. 25 Sept

    AWS Puts Elastic Beanstalk on EKS, CrowdSec Supply-Chain Breach, Critical Next.js RCE, Microsoft Disrupts EvilTokens & Why Fixing the Initial Compromise Isn’t Enough

    This week on Ship It Weekly: AWS introduced Elastic Beanstalk Cluster Mode, allowing multiple applications to run on shared EKS infrastructure while AWS handles much of the Kubernetes complexity. CrowdSec published how a software supply-chain compromise led to attackers copying roughly 170 private repositories using a stolen OAuth token. A critical Next.js vulnerability in ImageResponse can lead to remote code execution through attacker-controlled SVG data. And Microsoft disrupted EvilTokens, a cybercrime platform linked to more than 12,000 compromised inboxes across 10,000 organizations. The bigger theme this week is what happens after trust has been established. Elastic Beanstalk Cluster Mode puts more infrastructure behind a managed abstraction, but shared infrastructure still means understanding isolation and blast radius. CrowdSec shows how an initial compromise can become a credential problem long after the malicious code is gone. Next.js shows how something as ordinary as generating a social preview image can expose a server-side execution path. And EvilTokens shows how attackers can use valid access to move faster once inside an account. In the lightning round: F5 has a critical BIG-IP APM vulnerability under active exploitation. GitHub Enterprise Cloud can now export an inventory of credentials with enterprise access, including PATs, SSH keys, OAuth tokens, and GitHub App credentials. Zyxel patched a vulnerability affecting GS1900 switches. And Veeam Agent for Microsoft Windows has a privilege-escalation vulnerability that can lead to SYSTEM access. And the human closer comes back to CrowdSec. Removing the malicious package, patching the server, or reimaging the workstation does not necessarily end the incident. If an attacker already stole an OAuth token, cloud credential, SSH key, session, or registry credential, that access can survive long after the original compromise is gone. Containment means understanding not only how the attacker got in, but what they took with them Links AWS Elastic Beanstalk Cluster Mode https://tsn.io/1xaV7 CrowdSec Supply-Chain Attack Analysis https://tsn.io/7yq2f Next.js ImageResponse Security Advisory https://tsn.io/8JvHp Microsoft: Disrupting EvilTokens https://tsn.io/DtbC9 Microsoft: EvilTokens and Device-Code Phishing https://tsn.io/ZzwtD F5 BIG-IP APM CVE-2026-94127 https://tsn.io/sFuKW GitHub Enterprise Credential Inventory https://tsn.io/7bpMn Zyxel GS1900 Security Advisory https://www.tellerstech.com/go/s-b2595852/ Veeam Agent for Microsoft Windows Vulnerability https://www.tellerstech.com/go/s-166d3119/ This Week’s On Call Brief https://tsn.io/Nnd8g Ship It Weekly https://tsn.io/NqkdP On Call Brief https://tsn.io/Gpz2d

    AWS Puts Elastic Beanstalk on EKS, CrowdSec Supply-Chain Breach, Critical Next.js RCE, Microsoft Disrupts EvilTokens & Why Fixing the Initial Compromise Isn’t Enough
See All (76)

Trailer

About

Ship It Weekly is a short, practical recap of what actually matters in DevOps, SRE, cloud infrastructure, and platform engineering. Each episode, your host Brian Teller walks through the latest outages, releases, tools, and incident writeups, then translates them into “here’s what this means for your systems” instead of just reading headlines. Expect a couple of main stories with context, a quick hit of tools or releases worth bookmarking, and the occasional segment on on-call, burnout, or team culture. This isn’t a certification prep show or a lab walkthrough. It’s aimed at people who are already working in the space and want to stay sharp without scrolling status pages, cloud updates, and blogs all week. You’ll hear about things like cloud provider incidents, Kubernetes and platform trends, Terraform and infrastructure changes, and real postmortems that are actually worth your time. Most episodes are 15–30 minutes, so you can catch up on the way to work or between meetings. Every now and then there will be a “special” focused on a big outage or a specific theme, but the default format is simple: what happened, why it matters, and what you might want to do about it in your own environment. If you’re the person people DM when something is broken in prod, or you’re building the cloud and platform everyone else ships on top of, Ship It Weekly is meant to be in your rotation.

Information

You Might Also Like