InfoQ - DevOps - News

CNCF and Kusari Partner to Strengthen Software Supply Chain Security Across Cloud-Native Projects

Craig Risi — Fri, 10 Apr 2026 12:00:00 GMT

The Cloud Native Computing Foundation (CNCF) and Kusari have announced a new collaboration aimed at strengthening software supply chain security across cloud-native projects, providing free access to Kusari's AI-powered security tooling for CNCF-hosted projects.

By Craig Risi

GitHub Actions Custom Runner Images Reach General Availability

Claudio Masolo — Wed, 08 Apr 2026 14:00:00 GMT

GitHub has just announced the availability of custom images for its hosted runners. They've finally left the public preview phase that started back in October behind them. This feature will enable teams to use a GitHub-approved base image and then construct a virtual machine image that really meets their workflow requirements.

By Claudio Masolo

Istio Evolves for the AI Era with Multicluster, Ambient Mode, and Inference Capabilities

Craig Risi — Tue, 07 Apr 2026 12:00:00 GMT

The Cloud Native Computing Foundation (CNCF) has announced a major evolution of Istio, introducing new capabilities aimed at making service meshes “future-ready” for AI-driven workloads.

By Craig Risi

Open Source Security Tool Trivy Hit by Supply Chain Attack, Prompting Urgent Industry Response

Craig Risi — Fri, 03 Apr 2026 12:00:00 GMT

A major security incident affecting the widely used open source vulnerability scanner Trivy has exposed critical weaknesses in software supply chain security, after maintainers confirmed that a malicious release was briefly distributed to users.

By Craig Risi

Cloudflare Launches Dynamic Workers Open Beta: Isolate-Based Sandboxing for AI Agent Code Execution

Steef-Jan Wiggers — Wed, 01 Apr 2026 10:11:00 GMT

Cloudflare has released Dynamic Worker Loader into open beta, offering V8 isolate-based sandboxing for AI-generated code execution. The company claims isolates start in milliseconds, using megabytes of memory, making them roughly 100x faster and up to 100x more memory-efficient than containers. The feature builds on Cloudflare's Code Mode approach.

By Steef-Jan Wiggers

PyPI Supply Chain Attack Compromises LiteLLM, Enabling the Exfiltration of Sensitive Information

Sergio De Simone — Tue, 31 Mar 2026 21:00:00 GMT

Discovered by FutureSearch researcher Callum McMahon, a supply chain attack against LiteLLM on PyPI resulted in over 40 thousand downloads of a compromised version that installed a malicious payload capable of harvesting and exfiltrating sensitive information. LiteLLM is downloaded roughly 3 million times per day.

By Sergio De Simone

Agentic AI Patterns Reinforce Engineering Discipline

Rafiq Gemmail — Tue, 31 Mar 2026 20:30:00 GMT

Paul Duvall recently discussed his library of engineering patterns for AI assisted development and practices that ground high quality delivery. Related discussions from Paul Stack and Gergely Orosz highlight a shift toward remixing and specification driven development.

By Rafiq Gemmail

Kubernetes Autoscaling Demands New Observability Focus beyond Vendor Tooling

Craig Risi — Tue, 31 Mar 2026 12:00:00 GMT

As adoption of Kubernetes autoscalers like Karpenter accelerates, a new set of platform-agnostic observability practices is emerging, shifting focus from traditional infrastructure metrics to deeper insights into provisioning behavior, scheduling latency, and cost efficiency.

By Craig Risi

Cloudflare Adds Active API Vulnerability Scanning to Its Edge

Claudio Masolo — Tue, 31 Mar 2026 09:00:00 GMT

Cloudflare has announced the open beta of its Web and API Vulnerability Scanner. This Dynamic Application Security Testing (DAST) tool is part of the API Shield platform.

By Claudio Masolo

QCon London 2026: Team Topologies as the ‘Infrastructure for Agency’ with AI

Mark Silvester — Tue, 31 Mar 2026 08:00:00 GMT

At QCon London 2026, Matthew Skelton argued that AI success depends on organisational maturity. He highlighted bounded agency, security, and stewardship as key to managing AI agents. By using Innovation and Practices Enabling Teams, companies can drive knowledge diffusion and optimise internal processes to see real-world returns on their AI investments.

By Mark Silvester

KubeVirt v1.8 Brings Multi-Hypervisor Support and Confidential Computing to Kubernetes

Matt Saunders — Tue, 31 Mar 2026 07:00:00 GMT

Version 1.8 of KubeVirt was announced at KubeCon + CloudNativeCon Europe 2026. The release is aligned with Kubernetes v1.35, and the most significant addition is a Hypervisor Abstraction Layer (HAL) that allows the project to use backends other than KVM. In an announcement post on the CNCF blog, the maintainers announced the new release, broken down by their SIGs.

By Matt Saunders