Sunday, 01 November 2026

DevOps & Cloud News: 01 Nov 2026

A catch-up edition for 29 Oct to 1 Nov. CISA added an unauthenticated GitLab RCE (CVE-2026-97229), a Cisco ASA/FTD DoS and a chain of three Ivanti Connect Secure flaws to KEV. AWS added post-quantum TLS for Aurora PostgreSQL, TLS 1.3 for MSK and WAF SDK auto-integration for CloudFront.

DevOps

CISA KEV

GitLab CE/EE CVE-2026-97229: unauthenticated RCE via CI/CD regex, added to KEV (due 1 Nov)

Added on 29 Oct. An integer overflow or wraparound flaw lets an unauthenticated user execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, due to insufficient regex validation. The federal due date is 1 Nov, which is today. If you run self-managed GitLab, check the installed version against the GitLab security release and patch, and review who can reach the instance from the internet.

Cybersecurity

CISA KEV

Ivanti Connect Secure: CVE-2026-118527 and CVE-2026-111357 added to KEV, chained with CVE-2026-104935

Added on 30 Oct. CVE-2026-118527 lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk, and CVE-2026-111357 is a missing authentication flaw that lets a local authenticated attacker escalate privileges. CISA says they can be chained with each other and with CVE-2026-104935. CVE-2026-111357 is due 2 Nov and CVE-2026-118527 is due 13 Nov. Check your Ivanti advisory and integrity checker if you run these VPN appliances.

CISA KEV

Cisco Secure Firewall ASA and FTD CVE-2026-76418 added to KEV (due 1 Nov)

Added on 29 Oct. An unchecked return value leading to a NULL pointer dereference lets an unauthenticated remote attacker make the device reload unexpectedly, which is a denial of service. Check the Cisco advisory for fixed releases.

AWS

AWS What's New

Amazon Aurora PostgreSQL supports post-quantum TLS key exchange

Announced 29 Oct. Aurora PostgreSQL-Compatible Edition adds post-quantum TLS (PQ-TLS) key exchange as an option for encrypting data in transit. Check the announcement for the client driver and TLS library requirements before enabling it.

AWS What's New

Amazon MSK supports TLS 1.3; CloudFront can forward viewer ISP and post-quantum TLS details

Announced 30 Oct. MSK Provisioned clusters can use TLS 1.3 for data in transit through encryption policies. CloudFront can now forward two optional headers to your origin, including CloudFront-Viewer-ISP with the viewer's ISP name (https://aws.amazon.com/about-aws/whats-new/2026/10/cloudfront-viewer-isp-post-quantum-visbility/).

AWS What's New

AWS WAF automatic SDK integration for CloudFront; SageMaker GPU partitioning

Announced 30 Oct. With the WAF option enabled, CloudFront adds the AWS WAF JavaScript SDK script tag to the HTML it serves, with no change to your application. Also, SageMaker AI real-time inference endpoints can now partition a GPU to run several models on one accelerator (https://aws.amazon.com/about-aws/whats-new/2026/10/sagemaker-gpu-partitioning/).

← All daily news