# TLS Published articles for TLS. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## JDK 27 Security Enhancements DevFeed: [JDK 27 Security Enhancements]() Original publisher: [Read original article]() Author: Sean Mullan Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Inside Java]() Topics: [JDK 27](), [Security](), [Cryptography](), [Encryption](), [TLS (Transport Layer Security)](), [Post-Quantum](), [Release notes]() Tags: [certificates](), [cryptographic](), [encryption](), [jdk-27](), [notes](), [password](), [post-quantum](), [private-key](), [release-notes](), [security](), [tls]() ### AI overview This article reviews selected security enhancements in JDK 27, released on September 15, 2026. It highlights TLS 1.3 support for post-quantum hybrid key exchange mechanisms and the third preview of the PEM API for encoding and decoding cryptographic objects. ### Source excerpt JDK 27 was released on September 15, 2026! As with my previous blogs, I have compiled a list of what I think are the most interesting and useful security enhancements in this release. I have also grouped them into appropriate categories (crypto, TLS, etc) which should make it easier to find out what has changed in each specific area. The JDK 27 release notes also contain further details on these and other enhancements. ## Java 27 Reaches GA With The G1 Garbage Collector By Default Everywhere DevFeed: [Java 27 Reaches GA With The G1 Garbage Collector By Default Everywhere]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-15T13:39:00Z Content type: news Language: en Sources: [Phoronix]() Topics: [Java](), [openjdk](), [releases](), [Concurrency](), [Post-Quantum](), [TLS (Transport Layer Security)]() Tags: [availability](), [concurrency](), [desktop-linux](), [java](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [open-source-graphics](), [openjdk](), [phoronix](), [phoronix-test-suite](), [post-quantum](), [release](), [structured-concurrency](), [tls](), [ubuntu-benchmarks](), [ubuntu-hardware]() ### AI overview OpenJDK 27 has reached general availability. Its G1 garbage collector is now enabled by default across environments, replacing Serial as the default in constrained environments after improvements in throughput, latency, and memory usage. The release also includes post-quantum hybrid key exchange for TLS 1.3, preview features for lazy constants and structured concurrency, compact object headers by default, and an incubating Vector API. ### Source excerpt Oracle christened Java 27 today with the OpenJDK 27 release reaching general availability (GA) status... ## Running a Self-Hosted Tailscale Control Server Behind a Reverse Proxy DevFeed: [Running a Self-Hosted Tailscale Control Server Behind a Reverse Proxy]() Original publisher: [Read original article]() Author: Philipp Lehmann (philipp.lehmann@gruppe.ai) Published: 2026-09-15T07:00:00Z Content type: tutorial Language: en Sources: [Philipp Lehmann]() Topics: [tailscale](), [proxy](), [traefik](), [TLS (Transport Layer Security)](), [TLS handshake](), [Self-hosted](), [Homelab]() Tags: [dns](), [docker](), [h2](), [homelab](), [networking](), [proxy](), [reverse-proxy](), [security](), [self-hosted](), [tailscale](), [tls](), [tls-handshake](), [traefik]() ### AI overview This tutorial explains how to run a self-hosted Tailscale control server, Headscale, behind Traefik. It finds that the reverse proxy must use TLS with HTTP/1.1 only because Tailscale's noise handshake expects a full-duplex byte stream and can fail when ALPN negotiates HTTP/2. ### Source excerpt Headscale behind Traefik: tls.options=no-h2@file with alpnProtocols http/1.1, because the Tailscale noise handshake breaks when ALPN negotiates h2. ## Rustls 0.23.45 Released To Fix Two Year Old Security Issue DevFeed: [Rustls 0.23.45 Released To Fix Two Year Old Security Issue]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-14T15:35:11Z Content type: news Language: en Sources: [Phoronix]() Topics: [TLS (Transport Layer Security)](), [Security](), [vulnerability](), [Rust](), [Memory Safety](), [Go Language]() Tags: [bugs](), [desktop-linux](), [go](), [library](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [open-source-graphics](), [phoronix](), [phoronix-test-suite](), [rust](), [rustls](), [security](), [tls](), [ubuntu-benchmarks](), [ubuntu-hardware](), [vulnerability]() ### AI overview Rustls 0.23.45 fixes a vulnerability in which TLS 1.3 handshake messages sent at the wrong encryption level could be accepted as plaintext after a key-changing message. The issue was present since Rustls 0.23.13 and could allow an on-path attacker to inject plaintext messages, although the authenticated handshake transcript prevented altering or completing the handshake. ### Source excerpt While the Rustls modern TLS library is written in the Rust programming language with a focus on memory safety, as we've seen out of other Rust project re-implementations in the past, the new implementations can lead to other security bugs of their own. Out today is Rustls 0.23.45 to fix a security issue introduced back in 2024 with Rustls while the likes of OpenSSL, BoringSSL, and others are unaffected... ## One Decade of Rustls: Evolution, Benchmarks, and Future Roadmap DevFeed: [One Decade of Rustls: Evolution, Benchmarks, and Future Roadmap]() Original publisher: [Read original article]() Author: Olimpiu Pop Published: 2026-09-12T07:07:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Cryptography](), [Security, Privacy and Abuse Prevention](), [interoperability](), [Refactoring]() Tags: [benchmarks](), [development](), [memory-leaks](), [memory-safety](), [news](), [open-source](), [performance](), [post-quantum](), [release](), [retrospective](), [rust](), [rustls-one-decade](), [security](), [tls]() ### AI overview Rustls marks its tenth anniversary with a retrospective on its growth, funding, security work, and performance. The article compares Rustls 0.23.37 with OpenSSL and BoringSSL and notes architectural changes planned for version 0.24. ### Source excerpt Rustls, a Rust TLS library, marks its decade-long progression from a grassroots project to a funded open-source initiative. Key contributions from organisations boosted development, resulting in features like post-quantum cryptography and robust performance. The upcoming 0.24 release aims to enhance architecture and flexibility, including new input buffering and improved session handling By Olimpiu Pop ## HTTP/3 Support in HTTP Client API in Java 26 DevFeed: [HTTP/3 Support in HTTP Client API in Java 26]() Original publisher: [Read original article]() Author: Rajat Garg Published: 2026-09-10T18:50:56Z Content type: tutorial Language: en Sources: [Baeldung]() Topics: [Java HttpClient](), [client](), [Networks](), [Latency]() Tags: [api](), [http](), [java](), [java-httpclient](), [latency](), [networking](), [networking-java-httpclient](), [networks](), [popular](), [tls](), [tutorial]() ### AI overview A tutorial on using Java 26's HttpClient API with HTTP/3, including protocol preference and server-support discovery. ### Source excerpt Learn how HttpClient API supports HTTP/3 now, and how to set your apps to use HTTP/3. The post HTTP/3 Support in HTTP Client API in Java 26 first appeared on Baeldung. ## 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it DevFeed: [1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it]() Original publisher: [Read original article]() Author: Bas Westerbaan Published: 2026-09-10T13:00:00Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Cryptography]() Tags: [1-1-1-1](), [algorithms](), [cryptography](), [dns](), [dnssec](), [post-quantum](), [research](), [security](), [testing](), [tls](), [validation]() ### AI overview Cloudflare's 1.1.1.1 now validates DNSSEC signatures using the post-quantum ML-DSA-44 algorithm. The article discusses testing oversized DNS responses and preventing downgrade to conventional signatures while retaining compatibility with older resolvers. ### Source excerpt 1.1.1.1 now validates DNSSEC signatures using NIST's post-quantum ML-DSA-44 algorithm. Here is how we manage 2,420-byte signatures and downgrade risks at scale. ## Enabling TLS in PXC without Downtime DevFeed: [Enabling TLS in PXC without Downtime]() Original publisher: [Read original article]() Author: Juan Arruti Published: 2026-09-09T23:32:15Z Content type: tutorial Language: en Sources: [Blog - Percona]() Topics: [TLS (Transport Layer Security)](), [Replication](), [Security](), [Network](), [openssl]() Tags: [galera](), [high-availability](), [insight-for-dbas](), [mysql](), [open-source](), [percona](), [pxc](), [replication](), [security](), [ssl](), [tls](), [tls-handshake](), [uncategorized](), [xtradb-cluster-pxc]() ### AI overview This tutorial explains how to enable TLS for replication traffic in Percona XtraDB Cluster without a full cluster restart. Using Galera's socket.dynamic option, operators can perform two rolling restarts: first allowing encrypted and plaintext connections, then enforcing TLS-only communication. ### Source excerpt Starting with Percona XtraDB Cluster (PXC) 8.0, replication traffic encryption is enabled by default. That said, it's common to find clusters running without TLS that suddenly need it: a new compliance requirement, an audit finding, a network segment that is no longer considered trusted. PXC has a variable for exactly that case, pxc-encrypt-cluster-traffic, which handles ... Continued The post Enabling TLS in PXC without Downtime appeared first on Percona. ## A decade of Rustls DevFeed: [A decade of Rustls]() Original publisher: [Read original article]() Author: jzb Published: 2026-09-09T18:11:54Z Content type: news Language: en Sources: [LWN.net]() Topics: [releases](), [Cryptography](), [Security, Privacy and Abuse Prevention]() Tags: [api](), [blog](), [compression](), [cryptography](), [performance](), [post-quantum](), [releases](), [tls]() ### AI overview A retrospective on ten years of the Rustls TLS-library project, covering its release history, the forthcoming 0.24 and eventual 1.0 releases, and features added in the stable 0.23 line. ### Source excerpt Joe Birr-Pixton has written a blog post reflecting on a decade of the Rustls TLS-library project and looking ahead to the upcoming 0.24 release and an eventual 1.0 release. Rustls began with a first commit on May 2, 2016. Progress was quick: a month later, on June 5, it could interoperate with most sites on the web. The first release, 0.1.0, followed on August 27, 2016 - less than four months after the first commit. [...] From the 0.1.0 release, the project moved through a long series of releases over the following eight years, building out functionality, hardening and refining the API. That sequence of release lines culminated in 0.23, released on February 29, 2024. The 0.23 release line has been a stable one: in the time since, it has seen 43 non-breaking releases. That stability didn't come with stagnation. The 0.23 line delivered a wide range of important features, including a FIPS-certified cryptography option, certificate compression, Encrypted ClientHello, post-quantum cryptography, and performance improvements. ## Bring your own client certificate for backend mTLS in Amazon API Gateway DevFeed: [Bring your own client certificate for backend mTLS in Amazon API Gateway]() Original publisher: [Read original article]() Author: Biswanath Mukherjee Published: 2026-09-08T21:46:39Z Content type: tutorial Language: en Sources: [AWS Compute Blog]() Topics: [Amazon API Gateway](), [AWS Certificate Manager](), [Amazon Elastic Container Service](), [nginx]() Tags: [amazon-api-gateway](), [amazon-elastic-container-service](), [announcements](), [architecture](), [authentication](), [aws-certificate-manager](), [aws-fargate](), [intermediate-200](), [rest-api](), [tls]() ### AI overview This tutorial shows how to configure Amazon API Gateway to present a third-party or AWS Private CA-issued client certificate for outbound mTLS to an Amazon ECS backend. ### Source excerpt Enterprises that use Amazon API Gateway often want to bring their own client certificate for backend mutual TLS (mTLS) authentication. With API Gateway, you can now use a third-party or AWS Private CA-issued client certificate for the outbound mTLS handshake. In this post, you build a REST API with an outbound mTLS connection to an Amazon ECS backend. ## Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting) DevFeed: [Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)]() Original publisher: [Read original article]() Author: Alex Krivit Published: 2026-09-08T13:10:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Cryptography](), [SSL](), [Latency](), [Encryption]() Tags: [application-security](), [application-services](), [cloudflare](), [encryption](), [latency](), [performance](), [post-quantum](), [research](), [ssl](), [tls]() ### AI overview Cloudflare announces Automatic Key Exchange, which probes TLS 1.3 origins for supported key-agreement algorithms and uses the preferred option on the first connection attempt. The rollout reduces HelloRetryRequests and handshake latency while automatically preferring post-quantum hybrid connections where supported. ### Source excerpt Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it. ## Java Annotated Monthly - September 2026 DevFeed: [Java Annotated Monthly - September 2026]() Original publisher: [Read original article]() Author: Irina Mariasova Published: 2026-09-07T11:27:14Z Content type: article Language: en Sources: [The JetBrains Blog]() Topics: [Programming](), [AI-assisted coding](), [kotlinllm](), [migration]() Tags: [ai](), [ai-coding](), [articles](), [coding](), [java](), [kotlin](), [migration](), [post-quantum](), [september-2026](), [tls]() ### AI overview The September 2026 Java Annotated Monthly surveys Java news, JDK 27 and its performance and security changes, Java tutorials, Kotlin updates, AI-focused development, and developments across languages, frameworks, libraries, and technologies. It highlights compact object headers, G1 as the default garbage collector, protection for sensitive JFR data, post-quantum key exchange in TLS 1.3, Java migration guidance, and selected Kotlin and AI coding resources. ### Source excerpt This month's Java Annotated Monthly brings you the latest Java news, a generous dose of AI-focused articles, Kotlin updates, and highlights from a variety of technologies and frameworks, plus plenty more worth adding to your reading list. Our featured writer, Aicha Laafia, takes a closer look at upcoming JEPs and shares her key findings on [...] ## Announcing Appwrite Domains: your registrar and DNS host DevFeed: [Announcing Appwrite Domains: your registrar and DNS host]() Original publisher: [Read original article]() Author: Aditya Oberai Published: 2026-09-04T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [TLS (Transport Layer Security)](), [Cloud]() Tags: [api](), [cloud](), [dns](), [domain](), [organization](), [products](), [tls]() ### AI overview Appwrite announces Appwrite Domains, a feature of Appwrite Cloud that combines domain registration, authoritative DNS hosting, TLS management, and hostname connections for Sites, Functions, and project APIs within an organization. ### Source excerpt Appwrite Domains brings registration, DNS, and TLS into your organization. Buy names across 160+ TLDs, host the zone, and connect Sites and Functions. ## ZGateway: Learnings from Putting a Proxy in Front of ZippyDB DevFeed: [ZGateway: Learnings from Putting a Proxy in Front of ZippyDB]() Original publisher: [Read original article]() Author: Rittik Banik; Yunhao Cao Published: 2026-09-03T16:00:20Z Content type: article Language: en Sources: [Engineering at Meta]() Topics: [networking]() Tags: [backend](), [core-infra](), [database](), [engineering](), [meta](), [operations](), [resilience](), [routing](), [tls]() ### AI overview Meta introduces ZGateway, a proxy layer that unifies client traffic to its ZippyDB key-value store. The article explains how a managed proxy centralizes connection management, request batching, load balancing, admission control, routing, and cross-region resilience for a large client fleet. ### Source excerpt We're introducing ZGateway, the proxy we are using to unify traffic through ZippyDB, Meta's most widely-used key value store. As a bonus, it also enables admission control, load balancing, cross-region resilience, and richer operations. ZippyDB is the most widely used key value store at Meta, backing product metadata, counters, and configuration, and can serve billions [...] Read More... The post ZGateway: Learnings from Putting a Proxy in Front of ZippyDB appeared first on Engineering at Meta. ## Acceleration of Curve25519 Field Operations with Java Software and Intrinsics DevFeed: [Acceleration of Curve25519 Field Operations with Java Software and Intrinsics]() Original publisher: [Read original article]() Author: Shawn Emery Published: 2026-09-03T00:00:00Z Content type: article Language: en Sources: [Inside Java]() Topics: [Java](), [JDK 27](), [JDK 28](), [Security](), [Post-Quantum]() Tags: [crypto](), [ed25519](), [java](), [jdk](), [jdk-27](), [jdk-28](), [performance](), [post-quantum](), [security](), [tls](), [x86]() ### AI overview JDK 27 and JDK 28 improve Curve25519 field-operation performance through software changes and architecture-specific intrinsics. The improvements benefit X25519, Ed25519, and X25519MLKEM768 operations, with gains varying by algorithm, JDK build, and x86_64 or AArch64 platform. ### Source excerpt Find out about the improved Curve25519 field performance in JDK 27 and JDK 28. ## curl 8.22.0 DevFeed: [curl 8.22.0]() Original publisher: [Read original article]() Author: Daniel Stenberg Published: 2026-09-02T05:52:46Z Content type: release Language: en Sources: [Daniel Stenberg]() Topics: [cURL](), [Security](), [HTTP](), [openssl](), [API](), [TLS (Transport Layer Security)](), [Command-line interface]() Tags: [bugfixes](), [command-line](), [curl](), [curl-and-libcurl](), [cve](), [cves](), [http](), [openssl](), [release](), [security](), [tls]() ### AI overview The curl 8.22.0 release includes six changes, 302 bug fixes, and nine curl/libcurl security fixes plus one wcurl fix. It adds Apple GSS Framework support, API guards, experimental HTTP Message Signatures support, and Apple fast UDP, while blocking NTLM fallback in SPNEGO and dropping TLS-SRP support. ### Source excerpt Welcome to this new release. Get it as always from https://curl.se. If you rather want a security-patched older release branch, stay tuned for the follow-up Rock-solid curl announcement within a few days. Release presentation Numbers the 276th release6 changes70 days (total: 10,887)302 bugfixes (total: 14,489)525 commits (total: 39,608)0 new public libcurl function (total: 100)4 new ... Continue reading curl 8.22.0 -> ## Announcing native MySQL databases: Bring your MySQL workloads to Appwrite DevFeed: [Announcing native MySQL databases: Bring your MySQL workloads to Appwrite]() Original publisher: [Read original article]() Author: Jake Barnby Published: 2026-09-02T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [MySQL](), [Databases](), [Provisioning](), [Availability](), [Replication](), [autoscaling](), [TLS (Transport Layer Security)]() Tags: [announcements](), [autoscaling](), [availability](), [database](), [databases](), [mysql](), [provisioning](), [replication](), [tls]() ### AI overview Appwrite announces native managed MySQL databases that can run inside the same project as an application's existing backend. The service supports MySQL 8.4 and 8.0, standard drivers and ORMs, TLS, backups and point-in-time recovery, replicas with automatic failover, database branches, scaling, and connection pooling. ### Source excerpt Provision a managed MySQL 8.4 instance inside your Appwrite project and keep using the drivers, ORMs, and tools your applications already depend on. ## Sites using PQC (September 2026) DevFeed: [Sites using PQC (September 2026)]() Original publisher: [Read original article]() Published: 2026-09-01T14:49:46Z Content type: article Language: en Sources: [Signs of Triviality]() Topics: [Post-quantum cryptography](), [Post-Quantum](), [TLS (Transport Layer Security)](), [Cryptography]() Tags: [2026](), [cryptography](), [post](), [post-quantum](), [post-quantum-cryptography](), [quantum](), [september-2026](), [sites](), [tls](), [top](), [using]() ### AI overview A periodic check examines which of the top 1 million domains support post-quantum cryptography in their TLS key exchange. ### Source excerpt One more periodic check of which of the top 1M domains support post-quantum cryptography in their TLS key exchange. ## Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption DevFeed: [Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption]() Original publisher: [Read original article]() Author: Ivan Groenewold Published: 2026-08-31T11:48:11Z Content type: tutorial Language: en Sources: [Blog - Percona]() Topics: [MongoDB](), [TLS (Transport Layer Security)](), [Authentication](), [configuration]() Tags: [authentication](), [certificates](), [insight-for-dbas](), [mongodb](), [private-key](), [rotation](), [security](), [tls](), [x509]() ### AI overview This tutorial explains how to renew same-CA X.509 certificates in Percona Server for MongoDB with minimal service interruption. It covers reloading TLS material with rotateCertificates, certificate and private-key configuration, limitations, validation, and cases where hot reload should not be used. ### Source excerpt Expired TLS certificates can prevent new client connections and, when X.509 is used for Percona Server for MongoDB internal authentication, also prevent members of a replica set or sharded cluster from authenticating to one another. In this post we will discuss performing a same-CA renewal: replacement certificates for server, member, and client leaf are issued ... Continued The post Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption appeared first on Percona. ## Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles DevFeed: [Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles]() Original publisher: [Read original article]() Author: Taahir Ahmed Published: 2026-08-28T18:30:00Z Content type: article Language: en Sources: [Kubernetes Blog]() Topics: [Kubernetes](), [Authentication](), [JSON Web Tokens](), [TLS (Transport Layer Security)](), [Cloud]() Tags: [authentication](), [blog](), [cloud](), [cryptographic](), [json](), [kubernetes](), [post](), [tls](), [tokens]() ### AI overview Kubernetes 1.37 introduces generally available Pod Certificates and Cluster Trust Bundles, adding built-in X.509 certificate issuance for TLS and mTLS. The article explains how this production identity mechanism relates to existing service account JWTs and addresses the security limitations of bearer tokens. ### Source excerpt Pod Certificate / Cluster Trust Bundles Blog Post Kubernetes brings a wealth of features that make it easy to run your production workloads securely and reliably. While aspects like scheduling, health checks and resource limits are probably at the front of your mind, one other important feature of Kubernetes is production identity -- how your workload can authenticate to other systems in order to do its job. Up until now, the primary production identity mechanism built into Kubernetes has been service account JWTs (JSON Web Tokens). These are cryptographically-signed tokens, issued by the control plane of your cluster, that let anyone in the world understand who is calling when your workload uses them. In Kubernetes 1.37, the foundations of a new built-in production identity technology have gone GA. Pod Certificates (and the closely-associated Cluster Trust Bundles) build X.509 certificate issuance for TLS and mTLS directly into core Kubernetes. Why? Service account JWTs have a lot going for them: They are built directly into Kubelet, and work pretty magically. They are written to your workload container's filesystem before your workload starts up, and automatically kept up to date. The issuance system follows least-privilege principles; the node restriction admission plugin ensures that tokens can only be requested by the Kubelet that is actually currently running your pod. They can be federated, allowing you to use them to authenticate to other systems outside of Kubernetes. Service account JWTs underpin the pod-to-cloud authentication store for all of the largest cloud providers, and have widespread support across many additional services and software packages. If it can understand JWTs, you can authenticate to it with a service account token. However, service account JWTs have one big downside -- they are bearer tokens. With bearer tokens, if you have the token, then you are the identity asserted by the token. And since you necessarily have to hand copies of the J ## Security Advisory: CVE-2026-81934 DevFeed: [Security Advisory: CVE-2026-81934]() Original publisher: [Read original article]() Author: Riaz Lakhani Published: 2026-08-28T00:00:00Z Content type: news Language: en Sources: [Redis Blog]() Topics: [vulnerability](), [releases]() Tags: [authentication](), [cloud](), [redis](), [releases](), [security](), [tech](), [tls](), [vulnerability]() ### AI overview Redis remediated CVE-2026-81934, a high-severity use-after-free flaw in TLS pending-data processing that could allow authenticated attackers to execute remote code under specific conditions. The advisory lists fixed Redis releases and recommends upgrading, restricting network access, and enforcing least-privilege authentication controls. ### Source excerpt Update 9/1/2026: Following further review, the public CVE record for CVE-2026-81934 was updated to reflect a revised CVSS score of 7.5 (High). What happened? Redis identified and remediated a use-after-free vulnerability in TLS pending-data processi... ## 【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门 DevFeed: [【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [configuration](), [dry-run](), [TLS (Transport Layer Security)](), [API]() Tags: [admission](), [api](), [apiserver](), [cel](), [configuration](), [distributed](), [kubernetes](), [kyverno](), [mutating](), [timeout](), [tls](), [v1-30-3](), [validating](), [webhook]() ### AI overview A tutorial on configuring and troubleshooting Kubernetes v1.30.3 mutating and validating admission webhooks. It explains configuration fields, timeout and failurePolicy behavior, production availability requirements, reinvocation and idempotency, CEL ValidatingAdmissionPolicy boundaries, and an evidence-based troubleshooting approach. It emphasizes that slow webhooks add latency to the admission path rather than indicating etcd lag. ### Source excerpt 钉 K8s v1.30.3 的 MutatingWebhookConfiguration / ValidatingWebhookConfiguration v1：timeoutSeconds、failurePolicy、sideEffects、reinvocationPolicy 字段语义；webhook 慢如何表现为写路径延迟而非 etcd lag；生产可用性门选取；CEL ValidatingAdmissionPolicy 作为内置替代路径；排障证据包。 ## The best workflow engine is a programming language DevFeed: [The best workflow engine is a programming language]() Original publisher: [Read original article]() Author: Pranay Prakash Published: 2026-08-27T07:00:00Z Content type: opinion Language: en Sources: [Vercel News]() Topics: [SDKs]() Tags: [airflow](), [encryption](), [infrastructure](), [kubernetes](), [programming-language](), [tls](), [typescript](), [workflow]() ### AI overview The article argues that programming languages can express workflow graphs more naturally than manually defined DAGs. It describes using TypeScript for durable execution and contrasts that approach with the operational setup required to run Temporal workers and infrastructure. ### Source excerpt The idea of orchestrating long-running, stateful logic on top of unreliable, stateless infrastructure isn't new. We've had message queues, job runners, microservice choreographies, and full-blown workflow engines for a long time. What we never had was a version of it that felt good to write. I'd spent about six months working on a fork of Temporal, mostly on weekends, trying to turn it into a serverless answer with DX that felt more Vercel-native. Eventually it dawned on me that to ship that experience, I'd need to own the execution environment too. So I dropped the fork, joined Vercel, and started hacking on a new framework from scratch alongside Nathan Rajlich. Code is already a DAG A workflow is a DAG, a directed acyclic graph. Before Temporal (and Cadence before it), nearly every workflow framework made you draw that DAG by hand. Apache Airflow is the canonical example. You describe your pipeline as an explicit graph of tasks and dependencies, and your actual logic gets buried inside the nodes." That always felt backwards to me. We already have a tool for expressing "do this, then that, and these in parallel, and branch here." It's called a programming language. An abstract syntax tree is a DAG. Software itself is a DAG. I knew that in the abstract, but it didn't truly hit me until I saw Temporal, where you write what looks like normal sequential code and the engine makes it durable underneath. It was the dream all along. What running Temporal taught me Temporal is great once your infrastructure exists. I was starting from scratch, and setting it up meant: Standing up Temporal Cloud (or self-hosting the server: Frontend, History, Matching, and Worker services, plus a Cassandra/Postgres/MySQL backend and sharding). Running your own worker fleet: Temporal never executes your code. Your workers poll the server and run your workflows and activities. In practice that's a Kubernetes cluster you own. Wiring it all together: task queues, activity registration, client co ## pgwatch v6: Prometheus becomes a source, not just a sink DevFeed: [pgwatch v6: Prometheus becomes a source, not just a sink]() Original publisher: [Read original article]() Author: Pavlo Golub Published: 2026-08-26T07:43:28Z Content type: release Language: en Sources: [CYBERTEC PostgreSQL | Services & Support]() Topics: [Prometheus](), [PostgreSQL](), [Replication](), [dashboards]() Tags: [metrics](), [news](), [password](), [patroni](), [pgwatch](), [postgresql](), [prometheus](), [release](), [tls]() ### AI overview This blog post introduces pgwatch v6.0.0-beta, whose headline feature allows pgwatch to scrape Prometheus exporters directly as first-class sources alongside PostgreSQL sources. It explains source configuration, metric and label handling, and support for Basic Auth and TLS. ### Source excerpt This blog explains all feature highlights related to PGWatch 6.0.0 beta. You can read to understand and test the features yourself. The post pgwatch v6: Prometheus becomes a source, not just a sink appeared first on CYBERTEC PostgreSQL | Services & Support. [Next page]()