When guardrails break prod: GitHub “Too Many Requests” from legacy defenses, Kubernetes nodes/proxy GET RCE, HCP Vault resilience in an AWS regional outage, and PCI DSS scope creep

When guardrails break prod: GitHub “Too Many Requests” from legacy defenses, Kubernetes nodes/proxy GET RCE, HCP Vault resilience in an AWS regional outage, and PCI DSS scope creep

Author: Teller's Tech - DevOps, SRE and Cloud Podcast February 13, 2026 Duration: 15:49

This week on Ship It Weekly, Brian hits four stories where the guardrails become the incident.

GitHub had “Too Many Requests” caused by legacy abuse protections that outlived their moment. Takeaway: controls need owners, visibility, and a retirement plan.

Kubernetes has a nasty edge case where nodes/proxy GET can turn into command execution via WebSocket behavior. If you’ve ever handed out “telemetry” RBAC broadly, go audit it.

HashiCorp shared how HCP Vault handled a real AWS regional disruption: control plane wobbled, Dedicated data planes kept serving. Control plane vs data plane separation paying off.

AWS expanded its PCI DSS compliance package with more services and the Asia Pacific (Taipei) region. Scope changes don’t break prod today, but they turn into evidence churn later if you don’t standardize proof.

Human story: “reasonable assurance” turning into busywork.

Links

GitHub: When protections outlive their purpose (legacy defenses + lifecycle)

https://github.blog/engineering/infrastructure/when-protections-outlive-their-purpose-a-lesson-on-managing-defense-systems-at-scale/

Kubernetes nodes/proxy GET → RCE (analysis)

https://grahamhelton.com/blog/nodes-proxy-rce

OpenFaaS guidance / mitigation notes

https://www.openfaas.com/blog/kubernetes-node-proxy-rce/

HCP Vault resilience during real AWS regional outages

https://www.hashicorp.com/blog/how-resilient-is-hcp-vault-during-real-aws-regional-outages

AWS: Fall 2025 PCI DSS compliance package update

https://aws.amazon.com/blogs/security/fall-2025-pci-dss-compliance-package-available-now/

GitHub Actions: self-hosted runner minimum version enforcement extended

https://github.blog/changelog/2026-02-05-github-actions-self-hosted-runner-minimum-version-enforcement-extended/

Headlamp in 2025: Project Highlights (SIG UI)

https://kubernetes.io/blog/2026/01/22/headlamp-in-2025-project-highlights/

AWS Network Firewall Active Threat Defense (MadPot)

https://aws.amazon.com/blogs/security/real-time-malware-defense-leveraging-aws-network-firewall-active-threat-defense/

Reasonable assurance turning into busywork (r/sre)

https://www.reddit.com/r/sre/comments/1qvwbgf/at_what_point_does_reasonable_assurance_turn_into/

More episodes + details: https://shipitweekly.fm


For anyone building or running modern systems, the sheer volume of news, tools, and incident reports can be overwhelming. Ship It Weekly cuts through that noise. This isn't a surface-level scan of headlines. Host Brian Teller digs into the latest significant outages, major software releases, and insightful post-mortems, focusing squarely on the practical implications for DevOps, SRE, and platform engineering work. Each episode of the podcast breaks down a couple of key stories, providing the crucial context often missing from tech news. You'll hear analysis that translates events into actionable insights, answering the "so what?" for your own infrastructure and processes. The show also includes a quick rundown of tools or updates actually worth your attention, saving you hours of browsing. The tone is direct and informed, favoring depth over breadth. It’s designed for engineers and technical leaders who need a concise, reliable filter for the week's most relevant developments. Listen to this podcast for a focused recap that prioritizes what actually matters, delivered without fluff. You get the news, plus the necessary interpretation to understand how it might affect your systems, your team, and your on-call rotation. It's a weekly briefing that respects your time while aiming to make you more effective.
Author: Language: English Episodes: 37

Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News
Podcast Episodes