GitHub disables pull_request_target for public repos on 2 November
Execution protections reach general availability, and with them a default rule that blocks the one trigger that runs fork code against your secrets.
Defaults nobody re-derived
A surprising share of the stories we cover are not about a bug at all. They are about a value that was chosen once, for a smaller system, and then inherited by everything built on top of it: a list written for five verbs, a mount option nobody could set, a trigger that was on because it had always been on, a constant multiplied into something enormous. The fix is usually trivial once somebody asks what the setting is buying. Nobody asks, because the setting is not in anyone's way.
Kubernetes 1.37 adds noexec mount options for volumes
Every writable volume in a pod has been executable by default. Two alpha gates in v1.37 let you say noexec, nosuid, nodev, and set a permission mode on emptyDir.
Cloudflare cuts 100TB of RAM from its load balancers
A load balancer was holding 100,000 hash points per server. The maths said the last 90,000 bought a 0.7% accuracy gain, and 32-bit hashes made them worse than useless.
Allowlists enforce the day they were written
The list does not get wrong loudly. It gets wrong quietly, and keeps returning the same answer with the same confidence.
RFC 10008 defines QUERY, a sixth HTTP method
RFC 10008 defines QUERY - a GET with a body, safe, idempotent and cacheable. Handling in the wild already disagrees: nginx and Django reject it, Caddy, Traefik and FastAPI pass it through.