Tamal Saha retweeted
Talked to an older Chairman the other day, and something he talked about in building a business was the "tax" you pay before getting to break out success.
"Everything in this system will try to keep you from winning, and you have to hang in long enough to win anyway."
Tamal Saha retweeted
Kubernetes v1.37: Garhwal - kubernetes.io/blog/2026/08/2… #Kubernetes
It is my belief that many devs right now are not maximizing what they can do with automatic programming because they still look at the code. Doing it makes you the bottleneck. Your time is better invested in new ideas, QA, design, and asking yourself what is your goal.
🚨 Argo CD users have a serious problem.
- Low-privilege users could read Kubernetes resources outside their app scope
- ServerSideDiff=true made it worse
- Plaintext Secrets could be exposed with zero redaction
Affected:
- 3.2 < v3.2.11
- 3.3 < v3.3.9
Fix:
> Upgrade now
> Disable ServerSideDiff=true
> Tighten RBAC
> Rotate Secrets if enabled
This one is bad.
github.com/argoproj/argo-cd/…
Starting June 1st, GitHub Copilot will move to a usage-based billing model as GitHub Copilot supports more agentic and advanced workflows.
In early May, you'll see a preview bill experience, giving visibility into projected costs before the transition.
👉 Read more about the upcoming change: github.blog/news-insights/co…
Tamal Saha retweeted
TL;DR: pgBackRest is no longer being maintained. For details see github.com/pgbackrest/pgback…
Tamal Saha retweeted
When this news broke I really wanted to understand how the linux scheduler work. So I started to research.
What I gathered so far: (of course I might be missing something)
Unlike user code, the Linux kernel code isn’t usually preemptable. That is when a system call is executed or a page fault is triggered the kernel runs to completion hogging the cpu core it runs on.
The current Linux 7 tip experimenting a different preemption model for kernel code, so other more critical tasks can be scheduled. With this default mode, Postgres experienced 50% dropped in performance in one test suite 96 cores, with 100GB shared buffers pool.
The theory from the thread discussion is that the large buffer pool 100 GB with the default 4kb kernel vm page size, caused significant number of page faults. Page faults gets triggered to allocate physical memory on first access or on swap (I have a video detailing this).
Page fault runs kernel code to do the allocation of the physical memory and update the page table data structure for the process. If page faults are being preempted, it keeps the user process code in spin lock waiting for access.
Indeed Andreas, the postgres maintainer, was able to prove that even with stable Linux you could see the contention obtaining memory from shared buffers, its just not as obvious with 7.0 where kernel preemption is enabled
Using huge pages significantly reduces page faults, improving the performance.
My Page Faults The Backend Engineering Show
youtu.be/AsFxaZJ1M0k
Phoronix article
phoronix.com/news/Linux-7.0-…
Tamal Saha retweeted
Kubernetes v1.36: ハル (Haru) - kubernetes.io/blog/2026/04/2… #Kubernetes
Tamal Saha retweeted
🚨 Breaking: Trivy Docker images are compromised.
Tags 0.69.4, 0.69.5, and 0.69.6 contain infostealer IOCs. The latest images were pushed to Docker Hub without corresponding GitHub releases. `latest` currently points to a malicious image.
Details: socket.dev/blog/trivy-docker…
🚨 Breaking: Trivy GitHub Actions supply chain attack – 75 out of 76 version tags compromised.
If your CI/CD pipelines reference “aquasecurity/trivy-action” by version tag, you’re likely running malware right now.
At Socket, we identified that an attacker force-pushed nearly every version tag in the official aquasecurity/trivy-action repository. That’s @0.0.1 all the way through @0.34.2. Over 10,000 GitHub workflow files reference this action.
The malicious payload runs silently before the legitimate Trivy scan, so nothing looks broken. Meanwhile it’s:
- Dumping runner process memory to extract secrets
- Harvesting SSH keys
- Exfiltrating AWS, GCP, and Azure credentials
- Stealing Kubernetes service account tokens
The only unaffected tag right now appears to be @0.35.0.
Socket independently detected this at 19:15 UTC and generated 182 threat feed entries tied to this campaign – all correctly classified as Backdoor, Infostealer, or Reconnaissance malware.
This is the second Trivy compromise this month. Earlier in March, attackers injected code into the Aqua Trivy VS Code extension on OpenVSX to abuse local AI coding agents.
The compromised tags are still active. Pin to @0.35.0 or use a SHA reference until this is fully remediated.
Full write-up: socket.dev/blog/trivy-under-…
🌟 Go 1.26.1 and 1.25.8 are released!
🔐 Security: Includes security fixes for the standard library (CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142).
🗣 Announcement: groups.google.com/g/golang-a…
⬇️ Download: go.dev/dl/#go1.26.1
#golang
Tamal Saha retweeted
The reason why RAM has become four times more expensive is that a huge amount of RAM that has not yet been produced was purchased with non-existent money to be installed in GPUs that also have not yet been produced, in order to place them in data centers that have not yet been built, powered by infrastructure that may never appear, to satisfy demand that does not actually exist and to obtain profit that is mathematically impossible.
Tamal Saha retweeted
Despite what people say, the majority are not really willing to do what it takes...
That's your biggest advantage.
Tamal Saha retweeted
MongoBleed (CVE-2025-14847) is basically Heartbleed for MongoDB
- unauthenticated memory disclosure
- public POC, trivial to exploit
- leaks creds, tokens, cloud keys straight from RAM
- huge exposed surface on the internet
Good writeups and technical details here:
doublepulsar.com/merry-chris…
ox.security/blog/attackers-c…
blog.ecapuano.com/p/hunting-…
Patch fast, rotate secrets, and assume exposed instances were scanned(!)






















