🐞Weekend Roundup: the Linux bug nobody noticed for 18 years

Hey {{first name | there}}. A use-after-free bug sat in Linux's networking code for eighteen years, until researchers used it this week to break out of a container and land as root underneath.

The unsettling part is how much of what we rely on works the same way, trusted right up until someone finally looks.

In today's roundup:

You will also find upcoming events and curated job opportunities across the ecosystem.

Let’s dive in👇🏼

AI slop pollutes the CVE pipeline with fake vulns
Someone filed dozens of AI-invented CVEs, and the system waved them through with critical severity scores, one citing SQLite code that doesn't exist, because no step anywhere required proving the bug was real.

Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
Novee found flaws in Claude Code, Gemini CLI, and Codex where an issue from an unprivileged account reached CI secrets or hijacked the next run.

Rootly Drops Small PR Rule as Agentic AI Changes Code Review Economics
After two years of atomic PRs, Rootly dropped the rule: agents ship whole features at once, so it now reviews for blast radius, not line count, gating risk at rollout behind feature flags instead of at merge.

18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
Tencent found a use-after-free in Linux's SCTP code, present since 2008, that gets root on the host and, in their testing, escaped a container six times in eight. 

PSA: Apple’s Private Relay can leak your real IP address
Researchers found three WebKit flaws that expose the real IP address of Safari users relying on Private Relay. They skipped reporting it to Apple, citing past delays, and built a site where you can test your own.

Latest GitHub outage squeezes Actions, Pages to death
Actions and Pages failed again this week, another entry in a run that logged 26 incidents in July alone. GitHub blames an AI-driven traffic surge and promised fixes, but the outages haven't let up.

npm Staged Publishing Available, Adding a Human Approval Step Before Packages Go Live
npm's staged publishing lets CI upload a version to a queue that a maintainer must approve with 2FA before anyone can install it. 

The blank-check AI coding era is dead. Here’s what comes next.
Microsoft now caps AI coding spend by division and tracks it per engineer, after finding some burn thousands a month. 

LLMs reward expertise
Everyone talks to the same models, but expertise changes what you get back. The argument, illustrated by Terence Tao steering ChatGPT through a hard proof, is that domain knowledge lets you wring far more from the same LLM. 

🧠TOGETHER WITH EVERYTHINGDEVOPS

What if the biggest mistake experienced engineers make isn't technical at all? Divine makes a compelling case.

Our YouTube channel explores platform engineering, cloud infrastructure, Kubernetes, AI, and the career lessons shaping modern engineering.

→ Subscribe: @EverythingDevOpsHQ

Mark your calendars!