A short alert between digests: Traffic Server’s Tuesday release fixes fifteen flaws and two of them hand out the wrong client certificate identity; Traefik patched a second connection-identity bug in the same month on related plumbing; and Red Hat is pulling two roots out of its system CA bundle over the eMudhra key leak. mTLS origins, meet your change window.
Not the Monday digest: PHP shipped an emergency release this morning for two leaked-then-patched core RCEs, eight eMudhra intermediate CA keys are compromised, and Cisco and Oracle both emptied their patch trucks.
The appliance beat returned to the top this week: a mail gateway and a VPN, both rooted through unauthenticated bugs that were in use before they had fixes. Below them sits the more interesting story: an initial access broker ran a campaign on Claude Code, a cluster of 51 specialized agents, and an open-source pentest framework, then leaked its own working directory, so the intruder’s playbook is readable in its own session logs. Appliances first, Meta’s GitHub and the agent stories after, cloud and model news closer to the end.
Security owned the week again, and not subtly. An npm release shipped with a dead-man’s switch wired to a stolen credential. Registries for Ghana, Sierra Leone, and American Samoa got bent into a certificate-forgery kit for Google domains. The Wikimedia Foundation published its own account of “rogue” OpenAI agents touching its platforms. Against that, the constructive item of the week: AWS shipped Strands Box, an agent sandbox built on the idea that someone outside the agent’s process should judge what it did, not just what it asks for. Security first, then that, then the rest of the week.
Most weeks the hardest call is which lane leads. Not this one: the perimeter devices went first, then the AI agent stack, and both stories are still getting worse. Cloud news was comparatively quiet, which somehow feels appropriate.
Welcome to a new recurring feature. Each week I’ll round up the announcements that actually mattered across AWS, Google Cloud, open source, and frontier AI – with opinions attached, because news is cheap and judgment isn’t.
It’s been a while since we’ve blown the whistle around here, and it turns out we’ve been saving up. Today we have three announcements: a fresh new StackRef logo, the open sourcing of the StackRef Hackathon Manager, and a brand-new iOS game called Pickasso that’s on its way to the App Store.
Mark your calendars, folks!
StackRef will be officially launching on Product Hunt on Wednesday, December 13, 2023!
Good news, everyone!
Previously, purchasing StackCash – credits used to schedule events – was only possible by directly contacting us, or via the Amazon Marketplace. Well, no longer! StackCash is now directly purchasable within the application, once you have your free account created and are an organization’s owner or administrator.
In the fast-paced world of business, it’s easy to think that strategy is something only top dogs should worry about. But Max McKeown’s insight reminds us that it’s a team effort, and it’s more important than ever.
