Consul Binding Rules Outlive the Patch
An upgrade to consul-k8s 1.8.18 or 2.1.0 does not rewrite binding rules for components disabled beforehand. A version inventory won’t show that. The rules on the Consul server will.
-
-
Surviving Zone Capacity Is the Failover Test Most Teams Never Run
Google’s europe-west2 report describes a zone loss and then a second failure: surviving zones that could not absorb the displaced load. A zone-loss capacity test makes that second failure measurable.
-
The Backup Application Identity Was the Attack Path. The Vendor’s Containment Suspended the Backup.
Backup application identity: the vendor’s containment suspended the service that ran on it. What the vendor controls, what a tenant administrator controls, and the restore-path check to record before the next incident.
-
A Paused Rollout Is a Queue. Azure’s Gateway Incident Was the Expiry.
Azure’s post incident review for 7Q30-010 traces a gateway outage to a paused rollout that resumed all at once. Here is what it establishes, and two tests for your own holds and restarts.
CMS Category: Cloud Strategy (cloud-strategy). Prior Field Notes also carry field-notes, so please confirm at staging. -
The Endpoint Mapper Limit Changed Under Windows Server. Four October Update Notes Don’t List It.
The Endpoint Mapper limit that Microsoft’s October 2026 Windows Server updates introduced is described in two Microsoft pages, and neither is the update notes that shipped with it. The October 13 cumulative updates for Windows Server 2025, 2022, 2019 and 2016 are documented in four notes. I read the improvement and summary sections of all…
-
SageMaker Credential Exposure: A Failed Git Clone Can Put Credentials in Exception Text
AWS bulletin 2026-134-AWS says a failed Git clone in the SageMaker Python SDK can write repository credentials to CloudWatch Logs. This note separates what AWS states from what the code shows, and derives rotation scope from where the output went.
-
Google’s Run-As Service Account Check Can Fail Without an Execution Log
Google’s GCP-2026-068 bulletin adds a run-as service account permission check to Application Integration. The bulletin, the guide and the troubleshooting page describe different parts of it, and a denial does not show up in the same place twice.
-
A ccTLD Hijack Turns Authoritative DNS Into Certificate Evidence
Google’s post on the .gh, .sl and .as hijacks documents certificates issued on attacker-influenced DNS, and a defensive step for after DNS is restored. This note separates what Google states from what it does not.
-
DKM ACL Hardening Is Scheduled. The Evidence It Worked Is Not.
Microsoft’s AD FS DKM ACL hardening moves to enforcement with the October 2026 update. The schedule is documented. The evidence that the ACL reached the expected state is not durable by default.
-
The Vendor Retention Window Wasn’t a Recovery Control
A vendor retention window describes what the custodian intends to do. It does not establish that you hold a copy the custodian cannot touch.
