Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News

Teller's Tech - DevOps, SRE and Cloud Podcast

Ship It Weekly is a short, practical recap of what actually matters in DevOps, SRE, cloud infrastructure, and platform engineering. Each episode, your host Brian Teller walks through the latest outages, releases, tools, and incident writeups, then translates them into “here’s what this means for your systems” instead of just reading headlines. Expect a couple of main stories with context, a quick hit of tools or releases worth bookmarking, and the occasional segment on on-call, burnout, or team culture. This isn’t a certification prep show or a lab walkthrough. It’s aimed at people who are already working in the space and want to stay sharp without scrolling status pages, cloud updates, and blogs all week. You’ll hear about things like cloud provider incidents, Kubernetes and platform trends, Terraform and infrastructure changes, and real postmortems that are actually worth your time. Most episodes are 10–25 minutes, so you can catch up on the way to work or between meetings. Every now and then there will be a “special” focused on a big outage or a specific theme, but the default format is simple: what happened, why it matters, and what you might want to do about it in your own environment. If you’re the person people DM when something is broken in prod, or you’re building the cloud and platform everyone else ships on top of, Ship It Weekly is meant to be in your rotation.

  1. Special: Claude Mythos Preview and Project Glasswing: AI Exploit Discovery, Zero-Day Risk, Business Fallout, and What It Means for DevOps, Cloud, and Platform Security

    1 GIỜ TRƯỚC

    Special: Claude Mythos Preview and Project Glasswing: AI Exploit Discovery, Zero-Day Risk, Business Fallout, and What It Means for DevOps, Cloud, and Platform Security

    In this Ship It Weekly special, Brian breaks down Claude Mythos Preview and Project Glasswing, and why this story matters beyond normal AI launch hype. Anthropic is treating Mythos like a real security inflection point, not just a better coding model. Project Glasswing is their coordinated effort to get early access into the hands of defenders, critical software maintainers, and major infrastructure organizations before similar capability becomes more broadly available. If OpenClaw was about agents becoming a new control plane, this episode is about what happens when finding ways into messy environments and control planes starts getting faster too. We walk through the practical angle for DevOps, cloud, platform, and infra teams: exploit timelines may be compressing, platform debt becomes attacker leverage, and the boring work most orgs treat like cleanup suddenly looks a lot more like frontline security work. We also zoom out to the business side, including why banks, regulators, and government officials are already paying attention. Chapters Why This Episode ExistsOpenClaw CallbackWhat Actually HappenedDon’t Get Gullible, Don’t Get LazyWhat Changes If This Is Even Half TrueWhy Business People Should CareWhat This Means for DevOps, Cloud, and PlatformBoring Work Just Got PromotedThe Uncomfortable TakeawayWhat I’d Do Right NowLinks from this episode Claude Mythos Preview https://red.anthropic.com/2026/mythos-preview/ Project Glasswing https://www.anthropic.com/project/glasswing AI cyber threats: open letter to business leaders https://www.gov.uk/government/publications/ai-cyber-threats-open-letter-to-business-leaders/ai-cyber-threats-open-letter-to-business-leaders-html AI-boosted hacks with Anthropic’s Mythos could have dire consequences for banks https://www.reuters.com/legal/litigation/ai-boosted-hacks-with-anthropics-mythos-could-have-dire-consequences-banks-2026-04-13/ ECB to quiz bankers about risks of Anthropic's new AI model, source says https://www.reuters.com/world/ecb-warn-bankers-about-new-anthropic-model-risks-source-says-2026-04-15/ Related episode: OpenClaw special https://www.tellerstech.com/ship-it-weekly/special-openclaw-security-timeline-and-fallout-cve-2026-25253-one-click-token-leak-malicious-clawhub-skills-exposed-agent-control-panels-and-why-local-ai-agents-are-a-new-devops-sre-control-plane/

    16 phút
  2. Amazon S3 Files, Malicious npm Plugins, Trivy Fallout, and Kubernetes’ Gateway Shift

    5 NGÀY TRƯỚC

    Amazon S3 Files, Malicious npm Plugins, Trivy Fallout, and Kubernetes’ Gateway Shift

    This episode of Ship It Weekly is about the interface layer becoming the story. Brian covers Amazon S3 Files and why it feels more like a managed filesystem layer in front of S3 than “S3 is EFS now,” including how it relates to the old s3fs and FUSE-style approach. He also digs into 36 malicious npm packages posing as Strapi plugins, the uglier follow-on to the Trivy incident he discussed previously, Kubernetes Ingress2Gateway 1.0 and the push toward Gateway API, and Kubernetes Agent Sandbox as a sign that newer AI-style workloads are starting to reshape the platform itself. Links Amazon S3 Files https://aws.amazon.com/blogs/aws/launching-s3-files-making-s3-buckets-accessible-as-file-systems/ Malicious npm packages posing as Strapi plugins https://thehackernews.com/2026/04/36-malicious-npm-packages-exploited.html Trivy follow-on incident discussion https://github.com/aquasecurity/trivy/discussions/10425 RoseSecurity on Trivy / typosquatting angle https://rosesecurity.dev/2026/03/20/typosquatting-trivy.html Earlier episode covering the first Trivy incident https://www.tellerstech.com/ship-it-weekly/aws-bahrain-uae-data-center-issues-amid-iran-strikes-argocd-vs-flux-gitops-failures-github-actions-hackerbot-claw-attacks-trivy-roguepilot-codespaces-prompt-injection-block-ai-remake/ Kubernetes Ingress2Gateway 1.0 https://kubernetes.io/blog/2026/03/20/ingress2gateway-1-0-release/ Kubernetes Agent Sandbox https://kubernetes.io/blog/2026/03/20/running-agents-on-kubernetes-with-agent-sandbox/ Fortinet FortiClient EMS emergency patch https://www.fortiguard.com/psirt/FG-IR-26-099 Karpathy post https://x.com/karpathy/status/2036487306585268612 ProofShot https://github.com/AmElmo/proofshot More episodes and show notes https://shipitweekly.fm On Call Briefs https://oncallbrief.com

    15 phút
  3. Ship It Conversations: David Tuite on Backstage, Internal Developer Portals, and the Shift to AI Agents

    6 THG 4

    Ship It Conversations: David Tuite on Backstage, Internal Developer Portals, and the Shift to AI Agents

    This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps. In this Ship It: Conversations episode, I talk with David Chute, founder and CEO of Roadie, about internal developer portals, Backstage, automation, and how IDPs may evolve as AI agents become more common in engineering workflows. We talk about the difference between a platform and a portal, the three common problems IDPs usually try to solve, why discoverability tends to be the first pain teams feel, and why a lot of orgs should start with automation before trying to perfect a service catalog. We also get into self-hosted Backstage vs managed options, and how teams should think about adoption, data models, and time to value. The bigger theme is the one I found most interesting: IDPs may be shifting away from dashboard-heavy “single pane of glass” thinking and toward becoming context layers for workflows, terminals, and eventually agents. Highlights • The difference between an internal developer platform and an internal developer portal • The three common IDP problem areas: discoverability, automation, and guardrails • Why discoverability is usually the first pain teams feel • Why adoption is often more of a human problem than a technical one • Catalog completeness vs team ownership • Why a lot of teams should start with automation first • Self-hosted Backstage vs SaaS tradeoffs: extensibility, control, lock-in, and time to value • Why IDPs may move from dashboards to context delivery for humans and agents • Why AI helps teams build faster, but does not solve the problem of building the right thing • David’s advice for platform and DevEx teams: talk to your internal users first David’s links • LinkedIn: https://www.linkedin.com/in/davidtuite/ Roadie / Backstage • Roadie: https://roadie.io/ • Backstage: https://backstage.io/ Stuff mentioned • Workday • Backstage • GitHub • GitLab • Bitbucket • Azure DevOps • Argo CD • LaunchDarkly • CircleCI • DORA metrics • MCP-style context for agents Our links More episodes + show notes + links: https://shipitweekly.fm On Call Brief: https://oncallbrief.com

    34 phút
  4. GitHub Actions Hardening, Airbnb Config Rollouts, Cloudflare Rust Restarts, ECS Managed Daemons, and Terraform Access Controls

    3 THG 4

    GitHub Actions Hardening, Airbnb Config Rollouts, Cloudflare Rust Restarts, ECS Managed Daemons, and Terraform Access Controls

    This episode of Ship It Weekly is about the quiet platform work that keeps things safe before they break. Brian covers GitHub Actions hardening in Kubernetes-related repos, Airbnb’s safer config rollouts, Cloudflare’s zero-downtime Rust restarts, Amazon ECS Managed Daemons, and HCP Terraform access controls with IP allow lists and temporary AWS permission delegation. Links GitHub Actions security roadmap https://github.blog/news-insights/product-news/whats-coming-to-our-github-actions-2026-security-roadmap/ Airbnb config rollouts https://medium.com/airbnb-engineering/safeguarding-dynamic-configuration-changes-at-scale-5aca5222ed68 Cloudflare graceful restarts for Rust https://blog.cloudflare.com/ecdysis-rust-graceful-restarts/ Amazon ECS Managed Daemons https://aws.amazon.com/about-aws/whats-new/2026/04/amazon-ecs-managed-daemons/ HCP Terraform IP allow lists https://www.hashicorp.com/blog/hcp-terraform-adds-ip-allow-list-for-terraform-resources HCP Terraform AWS permission delegation https://www.hashicorp.com/blog/aws-permission-delegation-now-generally-available-in-hcp-terraform GitHub secret scanning updates https://github.blog/changelog/2026-03-10-secret-scanning-pattern-updates-march-2026/ GitHub secret scanning for AI coding agents https://github.blog/changelog/2026-03-31-secret-scanning-extends-to-ai-coding-agents-via-the-github-mcp-server/ Codespaces GA with data residency https://github.blog/changelog/2026-04-01-codespaces-is-now-generally-available-for-github-enterprise-with-data-residency Kubernetes v1.36 sneak peek https://kubernetes.io/blog/2026/03/30/kubernetes-v1-36-sneak-peek/ GKE Inference Gateway https://cloud.google.com/kubernetes-engine/docs/concepts/about-gke-inference-gateway More episodes and show notes https://shipitweekly.fm On Call Briefs https://oncallbrief.com

    14 phút
  5. Hackerbot-Claw Grows, Xygeni Tag Poisoning, GitHub Search HA, Windows SID Failures, and AI Skills Supply Chain

    27 THG 3

    Hackerbot-Claw Grows, Xygeni Tag Poisoning, GitHub Search HA, Windows SID Failures, and AI Skills Supply Chain

    This episode of Ship It Weekly is about the places where convenience quietly turns into trust. Brian revisits the Trivy story by zooming out to the bigger hackerbot-claw GitHub Actions campaign, then gets into the Xygeni tag-poisoning compromise, GitHub’s search high availability rebuild for GitHub Enterprise Server, Windows Server 2025 surfacing duplicate SID problems in cloned images, and the agent-skills ecosystem replaying package supply chain history. Plus: a quick lightning round on GitHub pausing self-hosted runner minimum-version enforcement and March secret scanning updates. Links OpenSSF advisory on active GitHub Actions exploitation https://seclists.org/oss-sec/2026/q1/246 Xygeni action compromise via tag poisoning https://www.stepsecurity.io/blog/xygeni-action-compromised-c2-reverse-shell-backdoor-injected-via-tag-poisoning GitHub Enterprise Server search high availability rebuild https://github.blog/engineering/architecture-optimization/how-we-rebuilt-the-search-architecture-for-high-availability-in-github-enterprise-server/ Microsoft on duplicate SIDs and nongeneralized Windows Server 2025 images https://learn.microsoft.com/en-us/troubleshoot/exchange/administration/exchange-server-issues-on-incorrect-windows-server-image Socket on supply chain security for skills.sh https://socket.dev/blog/socket-brings-supply-chain-security-to-skills Snyk ToxicSkills research https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/ GitHub self-hosted runner minimum version enforcement paused https://github.blog/changelog/2026-03-13-self-hosted-runner-minimum-version-enforcement-paused/ GitHub secret scanning pattern updates, March 2026 https://github.blog/changelog/2026-03-10-secret-scanning-pattern-updates-march-2026/ More episodes and show notes at https://shipitweekly.fm On Call Briefs at https://oncallbrief.com

    15 phút
  6. Ship It Conversations: Ang Chen on Project Vera, AI Cloud Emulation, and Safer Infrastructure Testing

    23 THG 3

    Ship It Conversations: Ang Chen on Project Vera, AI Cloud Emulation, and Safer Infrastructure Testing

    This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps. In this Ship It: Conversations episode, I talk with Ang Chen from the University of Michigan about Project Vera, a cloud emulator built to help teams test infrastructure changes more safely before they touch real cloud. We talk about why testing against real cloud APIs is slow, expensive, and risky, how Vera works under tools like Terraform and CloudFormation, what “high fidelity” actually means, and where a tool like this could fit in local dev and CI/CD. The bigger theme is one I think matters a lot: if AI is going to play a real role in cloud operations, it probably needs a sandbox first, not direct access to production. Note This interview was recorded on February 13, 2026. Since then, Vera’s public project materials have expanded the framing a bit further around multi-cloud support and safe environments for agent learning, so keep that in mind while listening. Highlights • Why real cloud testing still creates cost, delay, and risk • How Vera emulates cloud behavior at the API layer • Where this could help with Terraform, CloudFormation, and CI/CD workflows • Why “useful enough to catch real mistakes” may matter more than perfect emulation • The limits, tradeoffs, and fidelity questions that still need to be solved • Why safe training grounds may matter before AI agents touch real infrastructure Ang’s links • LinkedIn: https://www.linkedin.com/in/ang-chen-8b877a17/ • University of Michigan profile: https://eecs.engin.umich.edu/people/chen-ang/ • Publications: https://web.eecs.umich.edu/~chenang/pubs.html Project Vera • Project site: https://project-vera.github.io/ • GitHub: https://github.com/project-vera/vera • The quest for AI Agents as DevOps: https://project-vera.github.io/blogs/cloudagent/cloudagent/ • No More Manual Mocks: https://project-vera.github.io/blogs/cloudemu/cloudemu/ Stuff mentioned • A Case for Learned Cloud Emulators: https://dl.acm.org/doi/10.1145/3718958.3754799 • Cloud Infrastructure Management in the Age of AI Agents: https://dl.acm.org/doi/abs/10.1145/3759441.3759443 • LocalStack: https://www.localstack.cloud/ Our links More episodes + show notes + links: https://shipitweekly.fm On Call Brief: https://oncallbrief.com

    24 phút
  7. McKinsey AI Flaw, Kafka Goes Diskless, Google Buys Wiz, AWS Copilot Ends, and AI Gateway on Kubernetes

    20 THG 3

    McKinsey AI Flaw, Kafka Goes Diskless, Google Buys Wiz, AWS Copilot Ends, and AI Gateway on Kubernetes

    This week on Ship It Weekly, Brian looks at what happens when new interfaces create old responsibilities. McKinsey patched a vulnerability in its internal AI tool Lilli, Kafka contributors are pushing a diskless-topics model that rethinks durability and replication in cloud environments, and Google officially closed Wiz acquisition in one of the biggest cloud-security moves. Plus: AWS is sunsetting Copilot CLI, Kubernetes launches an AI Gateway Working Group. Links McKinsey statement on Lilli https://www.mckinsey.com/about-us/media/statement-on-strengthening-safeguards-within-the-lilli-tool Kafka diskless topics proposal https://cwiki.apache.org/confluence/display/KAFKA/The%2BPath%2BForward%2Bfor%2BSaving%2BCross-AZ%2BReplication%2BCosts%2BKIPs Google completes acquisition of Wiz https://blog.google/innovation-and-ai/infrastructure-and-cloud/google-cloud/wiz-acquisition/ AWS Copilot CLI end-of-support https://aws.amazon.com/blogs/containers/announcing-the-end-of-support-for-the-aws-copilot-cli/ Kubernetes AI Gateway Working Group https://kubernetes.io/blog/2026/03/09/announcing-ai-gateway-wg/ Amazon Bedrock observability for first-token latency and quota consumption https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-bedrock-observability-ttft-quota/ Cloudflare JSON responses and RFC 9457 support for 1xxx errors https://developers.cloudflare.com/changelog/post/2026-03-11-json-rfc9457-responses-for-1xxx-errors/ Amazon S3 source-region information in server access logs https://aws.amazon.com/about-aws/whats-new/2026/02/amazon-s3-source-region-information/ AWS Config adds 30 new resource types https://aws.amazon.com/about-aws/whats-new/2026/03/aws-config-new-resource-types/ Amazon Bedrock AgentCore Runtime stateful MCP server features https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-bedrock-agentcore-runtime-stateful-mcp/ More episodes and show notes at https://shipitweekly.fm On Call Briefs at https://oncallbrief.com

    15 phút
  8. Meta Buys Moltbook, Block AI Layoffs Get Messier, Atlassian Cuts Jobs, and GitHub Explains the Outages

    13 THG 3

    Meta Buys Moltbook, Block AI Layoffs Get Messier, Atlassian Cuts Jobs, and GitHub Explains the Outages

    This week on Ship It Weekly, Brian covers five “AI meets reality” stories that every DevOps, SRE, security, and platform team can learn from. Block’s AI layoff story is getting messier as follow-up reporting pushes back on the original framing, Meta bought Moltbook and brought more attention to the trust and security problems already showing up around AI-agent platforms, and Atlassian cut about 10% of its workforce while saying AI is changing the skills and roles it needs. Plus: GitHub gives one of the more honest outage breakdowns we’ve seen lately, Anthropic and Mozilla show a more grounded AI use case with Claude finding real Firefox bugs, and there’s a quick lightning round on Bedrock AgentCore policy, Dependabot for pre-commit hooks, and Cloudflare’s latest threat report. Links Block layoffs follow-up https://www.theguardian.com/technology/2026/mar/08/block-ai-layoffs-jack-dorsey Meta acquires Moltbook https://www.theguardian.com/technology/2026/mar/10/meta-acquires-moltbook-ai-agent-social-network Wiz on Moltbook exposure https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys Atlassian team update https://www.atlassian.com/blog/announcements/atlassian-team-update-march-2026 GitHub availability issues write-up https://github.blog/news-insights/company-news/addressing-githubs-recent-availability-issues-2/ Anthropic + Mozilla Firefox security https://www.anthropic.com/news/mozilla-firefox-security Anthropic labor market report https://www.anthropic.com/research/labor-market-impacts AWS Bedrock AgentCore Policy GA https://aws.amazon.com/about-aws/whats-new/2026/03/policy-amazon-bedrock-agentcore-generally-available/ GitHub Dependabot support for pre-commit hooks https://github.blog/changelog/2026-03-10-dependabot-now-supports-pre-commit-hooks/ Cloudflare 2026 Threat Report https://blog.cloudflare.com/2026-threat-report/ More episodes and show notes at https://shipitweekly.fm On Call Briefs at: https://oncallbrief.com

    17 phút

Xếp Hạng & Nhận Xét

5
/5
9 Xếp hạng

Giới Thiệu

Ship It Weekly is a short, practical recap of what actually matters in DevOps, SRE, cloud infrastructure, and platform engineering. Each episode, your host Brian Teller walks through the latest outages, releases, tools, and incident writeups, then translates them into “here’s what this means for your systems” instead of just reading headlines. Expect a couple of main stories with context, a quick hit of tools or releases worth bookmarking, and the occasional segment on on-call, burnout, or team culture. This isn’t a certification prep show or a lab walkthrough. It’s aimed at people who are already working in the space and want to stay sharp without scrolling status pages, cloud updates, and blogs all week. You’ll hear about things like cloud provider incidents, Kubernetes and platform trends, Terraform and infrastructure changes, and real postmortems that are actually worth your time. Most episodes are 10–25 minutes, so you can catch up on the way to work or between meetings. Every now and then there will be a “special” focused on a big outage or a specific theme, but the default format is simple: what happened, why it matters, and what you might want to do about it in your own environment. If you’re the person people DM when something is broken in prod, or you’re building the cloud and platform everyone else ships on top of, Ship It Weekly is meant to be in your rotation.

Có Thể Bạn Cũng Thích