Shared infrastructure keeps cracking: apt, GitHub, AWS, Cloudflare
Debian shipped an apt security update for a man-in-the-middle arbitrary code execution bug (50364814). Commenters note it sits in the HTTP handling code, and apt fetches packages over plain HTTP, so a network attacker is a plausible threat. GitHub had an incident hitting Pull Requests, Git operations and Issues (50363378). In recent history threads, AWS's billing system showed users bills in the billions (48945241), and Cloudflare's blocking of football streams in Spain broke 'docker pull' (47738883).
The through-line: your product's uptime and security sit on a small number of providers, and their failures can be mundane (a bad billing number, a court-ordered block) and still land on you.
The apt thread has a good joke about a broken tool that can only be fixed by using the same broken tool. It captures the update-bootstrapping problem.
So what?
Patch apt now, and check whether your base images and CI pull over plain HTTP. Plan for a day without GitHub, and have a mirror for critical images so a regional block or a registry hiccup does not stop your deploys.
Read these
Debian apt security update: man-in-the-middle arbitrary code execution
Incident with Pull Requests, Git Operations and Issues
AWS: Inaccurate Estimated Billing Data – $1.7 billion
Tell HN: Docker pull fails in Spain due to football Cloudflare block