6 min read · 12 sources

If you have long-lived GitHub personal access tokens floating around your CI pipelines or developer machines, rotate them this morning. An automated campaign dubbed Gheist has been systematically walking compromised credentials across private and enterprise repositories to turn GitHub Actions into an internal data exfiltration network.

The attacker’s technique avoids external command-and-control servers entirely. By committing workflows that encode secrets to bypass native log masking and reading the raw logs back via the GitHub API, the operation runs silently within GitHub’s own infrastructure boundaries.

Meanwhile, the infrastructure underneath Git itself is undergoing the biggest architectural overhaul in its history. AI agents are pushing write volumes past the physical limits of traditional bare-metal datacenters, forcing GitHub to migrate almost every byte it hosts into public cloud storage.

Gheist slipped into 13,500 branches before GitHub’s token controls finally caught it.

Gheist weaponizes GitHub Actions through base32 log evasion

Source: wiz.io ↗

Wiz Research disclosed Gheist, an automated campaign that abuses compromised GitHub credentials to harvest repository secrets. Since mid-September, the operators have targeted over 850 accounts and generated more than 13,500 branches.

The attack mechanics are simple and effective. The automation pushes a branch named ci-sync-* containing a malicious workflow at .github/workflows/sync-check.yml. When run, the workflow dumps environment variables and repository secrets. To bypass GitHub’s default log scrubber - which redacts strings matching known secret patterns - the payload base32-encodes the dumped values before printing them to standard out.

Instead of opening an egress connection to an external server, which might trigger network alerts, the actor uses the GitHub REST API to pull the workflow execution logs directly. While GitHub added guardrails that blunted the campaign across public repositories, private and enterprise repos remain vulnerable if an identity with write access is compromised. Check your audit logs for unauthorized branch creations matching ci-sync-* immediately.

GitHub migrates 99.99999% of repositories to Azure for agent write scale

Source: github.blog ↗

Faced with physical power envelopes and supply chain bottlenecks in its own datacenters, GitHub moved a copy of 99.99999% of its Git repositories to Azure. Running in production since August 2025, the new topology splits five replicas per repository: three on bare-metal and two in Azure, with the Azure footprint already handling half of all Git traffic.

The hard engineering problem was write latency. Git typically relies on repository-wide locks during write operations. Across cross-region topologies, write serialization causes throughput to collapse under the weight of AI coding agents opening hundreds of concurrent branches and pull requests. GitHub resolved this by decoupling storage from compute and shifting to per-reference quorums. Writes to different branches or tags no longer contend for the same repository-level lock, reducing latency to 25ms and delivering 3x to 4x higher write throughput.

Cloudflare's Q3 outage data reveals physical and political fragility

Source: blog.cloudflare.com ↗

The Cloudflare Radar Q3 2026 Internet disruption report logged 49 major global network outages. While SREs spend immense time engineering against software regressions, physical and geopolitical failure domains dominated the quarter.

Government-directed shutdowns accounted for 19 incidents, including 18 coordinated blackouts in Iraq to prevent cheating during national academic exams. Power grid failures triggered 14 major disruptions, hitting nationwide infrastructure across Cuba and Ukraine, while natural disasters accounted for five. For teams building multi-region architectures, these reports remain a reminder that BGP routes and redundant transit providers cannot route around a dead electrical grid or state-enforced fiber cuts.

Stop letting Kubernetes autoscalers fight for the same fields

Source: thenewstack.io ↗

Kubernetes scaling controllers operate under decoupled, asynchronous reconciliation loops. When you combine the Horizontal Pod Autoscaler (HPA), Vertical Pod Autoscaler (VPA), KEDA, and Karpenter on the same cluster, those loops quickly trigger resource thrashing, as detailed by The New Stack’s analysis on autoscaler contention.

The issue stems from controllers mutating the same API fields without shared context. VPA changes CPU and memory requests to right-size pods, which alters the utilization percentages HPA relies on to calculate target replica counts. Simultaneously, KEDA scales replicas based on external message queues, and Karpenter provisions or consolidates underlying EC2 nodes based on pending pod specs.

The resulting race conditions cause GitOps drift, eviction loops, and resource ping-pong. Kurup argues that treating scaling as independent Unix-style pipes is broken; platform teams require autonomous, predictive scaling engines that calculate replica counts, pod dimensions, and node capacity inside a single decision loop.

Golden paths require strict boundaries for AI agents

Source: spacelift.io ↗

Platform teams rolling out internal developer portals are shifting architectures to accommodate non-human contributors. A guide from Spacelift on building Golden Paths outlines how self-service infrastructure blueprints must evolve when both developers and autonomous coding agents call them.

A functional golden path requires five building blocks: standardized Infrastructure as Code (IaC) modules, CI/CD pipeline definitions, policy-as-code guardrails, documentation, and a developer portal entry. When exposing paths to AI agents via APIs or Model Context Protocol (MCP) servers, loosely defined free-text interfaces lead to misconfigured cloud primitives. Platforms must enforce typed inputs, deterministic schemas, and least-privilege service identities so agents can provision resources like Multi-AZ databases without bypassing compliance guardrails.

Scrape walls and manage persistent AI teammates from the CLI

Source: github.com ↗

Two new open-source projects aim to reduce friction for local and autonomous agent operations:

• Agent-Reach provides agents with a unified CLI to fetch content from behind authentication walls and complex web properties. It uses a local headless browser to extract clean data from YouTube transcripts, GitHub, Bilibili, and Xiaohongshu without dedicated API fees or custom scraper maintenance.
• OpenBot provides a local-first desktop workspace for orchestrating persistent AI teammates across multiple LLM backends (Codex, Claude Code, Gemini, Grok). It includes embedded browsing, agent-to-agent messaging, and an optional OS automation driver. Operators should note that the current preview ships configured with danger-full-access and approvalPolicy: never, meaning it executes local system commands without human confirmation.

Fix vLLM tool-calling bugs and optimize GPU spend

Source: ubicloud.com ↗

Open-weight models frequently produce malformed JSON when handling nested function calls, corrupting agent execution loops. In a benchmark published by Ubicloud on vLLM tool-call accuracy, vLLM 0.28 serving Kimi K2.6 failed 8% of its structured tool invocations. The newly released vLLM 0.31 resolves this by introducing a server-side constrained decoding flag, forcing 100% schema compliance at the token generation layer for Kimi and DeepSeek architectures.

Before throwing more expensive silicon at AI workloads, platform teams should also audit job economics. An operational guide on optimizing Kubernetes GPU pools recommends establishing strict latency, deadline, and interruption-tolerance budgets before expanding node groups. Implementing staggered scheduling windows for batch inference flattens peak utilization spikes, allowing existing clusters to absorb higher volumes without purchasing additional GPU capacity.

Google and Meta open-source TorchTPU; AWS details agent telemetry

Source: infoq.com ↗

Closing out the tooling updates for platform and SRE teams:

• TorchTPU launch: At the PyTorch Conference, Google and Meta open-sourced TorchTPU, a native backend that replaces PyTorch/XLA. It allows engineers to swap hardware targets with model.to("tpu") and brings out-of-the-box support for vLLM, SGLang, and TorchTitan, demonstrating linear scaling across 8,192 TPU v7x chips.
• Agent observability on EKS: AWS published a deep dive on observability patterns for AI agents on Amazon EKS. Standard HTTP health checks fail to catch agent-specific outages like circular tool calls, reasoning drift, and context window exhaustion. SREs must instrument traces that capture per-request token usage, tool spans, and cost attribution metrics directly.
• Supabase scoped access tokens: Supabase announced scoped Personal Access Tokens, replacing account-wide credentials. Admins can now restrict token permissions to specific projects, set strict expiration windows up to one year, and scope access specifically for CI/CD runs and MCP tools.