Hey {{first name | there}}. This week, security patches are landing across critical infrastructure, while AI continues to reshape how software gets built and run. There’s plenty to catch up on.
Here’s what’s happening 👇
In today’s roundup:
Critical PHP flaws put unpatched websites at risk
GitLab patches a code execution flaw affecting releases dating back to 2014
Cilium 1.20 expands Kubernetes networking and Gateway API support
AI speeds up coding but leaves open source maintainers with more junk to review
Google brings its AI agent infrastructure to the cloud
💡TOGETHER WITH EVERYTHINGDEVOPS
Free KodeKloud Pro Annual Subscription
I'm giving away a KodeKloud Pro annual subscription, and because you're already subscribed, you're holding the one thing you need to win it, which is your personal referral link.
The mechanics are simple enough: the first person to refer 15 engineers to join the Newsletter gets the full annual subscription.
And anyone who reaches 3 referrals unlocks a 30-minute 1-on-1 with me, wherever they finish on the leaderboard.
Your link: {{ rp_refer_url }}
Copy and share this ☝🏾 link with others.
Your referrals so far: {{ rp_num_referrals }}
LATEST DEVELOPMENT
Image source: PM IMAGES
The Rollout: The NSA is urging websites to patch two critical PHP vulnerabilities immediately, warning that unpatched servers may need to be taken offline. AI researchers discovered the flaws, but AI could also make them easier for attackers to exploit.
The details:
The vulnerabilities affect PHP versions dating back to 2004 and could let attackers access server files or databases.
OpenAI and Wiz researchers used AI tools to identify flaws and worked with the PHP Foundation and other organizations to develop and test patches.
PHP users should update to a supported version. WordPress sites are also affected at the server level, so site owners should coordinate with their hosting providers.
Why this matters: AI is changing both sides of cybersecurity. It helped researchers uncover vulnerabilities that had gone undetected for years, but it could also help attackers exploit them. With the flaws now public,
Image source: TheHacker News
The Rollout: GitLab has released emergency fixes for a critical vulnerability that could let unauthenticated attackers execute code on self-managed servers. The flaw affects every release since 2014, and administrators who patched earlier this month may need to update again.
The details:
The vulnerability, CVE-2026-110264, carries the maximum CVSS score of 10.0 and stems from an integer overflow in the Ruby regular-expression engine.
GitLab fixed the flaw across seven release branches, including older versions outside its usual support window. GitLab.com already has the fix.
Administrators can use two new detection rules to look for exploitation attempts, but GitLab says updating is the only certain protection. No interim workaround is available.
Why this matters: Self-managed GitLab administrators should check their versions and apply the relevant fix promptly, even if they updated on October 12. The flaw spans more than a decade of releases, and some fixed versions require database changes that can cause downtime on single-node installations.
Image source: CNCF
The Rollout: Cilium 1.20 expands Kubernetes traffic management, lets third parties extend its eBPF networking system, and adds automatic selection of faster networking options across mixed Linux environments.
The details:
Gateway API 1.6 adds external authentication and support for TCP and UDP traffic, giving teams more control over how services are exposed.
Beta datapath plugins let cloud providers add custom networking features without maintaining a separate Cilium fork.
Automatic datapath selection lets Cilium use netkit on supported Linux kernels and fall back to veth on older ones.
Why this matters: The release gives platform teams more flexibility to manage traffic, extend networking, and run clusters across different Linux kernel versions. However, datapath plugins and sidecarless mutual TLS remain beta, so teams should review the upgrade notes before adopting them.
🧠PRESENTED BY EVERYTHINGDEVOPS
A lot of DevOps roadmaps still have you learning tools one by one, ticking boxes, and hoping you’ll be job ready when you reach the end. But knowing the tools doesn’t mean you know how to use them together.
This video breaks down what has changed, five mistakes that waste time, and how to build a learning path around real projects instead of endless tutorials. It also covers which skills to focus on and how to show employers what you can actually do.
Subscribe: @EverythingDevOpsHQ for deeper dives on agents, Kubernetes, MLOps, and AI infrastructure.
Image source: TheRegister
The Rollout: A Linux Foundation survey found that AI cuts open source coding time by 52% on average, but maintainers estimate that a quarter of incoming pull requests are low-quality AI-generated submissions.
The details:
71% of maintainers say AI has made contributing to open source easier, but 53% disagree that it has improved community trust.
Among large projects, maintainers estimate that 31% of incoming pull requests are AI slop.
Only 35% of surveyed projects have formal policies allowing AI use, leaving many contributors without clear guidelines.
Why this matters: AI makes writing code faster, but reviewing poor submissions takes maintainers' time away from useful work. Open source projects need clear contribution policies and better review tools to benefit from AI without overwhelming the people who keep projects running.
Image source: TheNewStack
The Rollout: Google is bringing the infrastructure behind its Gemini agents to Google Cloud with Agent Compute Engine, a managed service that gives each agent an isolated virtual machine designed to start, pause, and resume quickly.
The details:
Agent Compute Engine uses hardware-isolated microVMs, encrypted storage, and traffic proxies to isolate agents and keep credentials outside their environments.
Agents can run shell scripts, browse the web, and write code with root access inside their own sandboxes, while idle machines can be paused to save resources.
Google also offers Agent Substrate, an open-source runtime for Kubernetes that snapshots idle agents and can support other agent frameworks.
Why this matters: As AI agents take on longer and more complex tasks, teams need infrastructure that can isolate their activity without wasting compute resources. Google is offering a managed option through Cloud and a Kubernetes-based alternative for teams that want to run agent workloads in their own environments.
QUICK LINKS
📅EVENTS
🇪🇺 🇬🇧Europe
Title | Date | Location |
October 20–23 | Palacio de Congresos, Valencia, Spain | |
October 23 & 26 | London |
🇺🇸🇨🇦North America
Title | Date | Location |
October 28–29 | San Francisco, CA (USA) |
🇳🇬Africa
Title | Date | Location |
October 23–24 | Ho, Volta Region, Ghana | |
October 24 | Lagos, Nigeria | |
October 28 - 29 | Uganda |
🌎Asia
Title | Date | Location |
October 24 | Istanbul | |
Octobr 29–31 | Goa, India | |
October 31 | Atrium, Jakarta Barat |