# trust-security Published articles for trust-security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Patching at Fleet Scale, Twice: How DigitalOcean Closed Januscape and the AMD Safe RET Issue Without Customer Impact DevFeed: [Patching at Fleet Scale, Twice: How DigitalOcean Closed Januscape and the AMD Safe RET Issue Without Customer Impact]() Original publisher: [Read original article]() Author: Tim Lisko Published: 2026-08-24T21:25:19Z Content type: article Language: en Sources: [DigitalOcean]() Topics: [Digital Ocean](), [virtualization](), [vulnerability](), [Cloud](), [cloud security](), [Security](), [Exploit](), [Kernel](), [Linux]() Tags: [cloud](), [cloud-computing](), [cve](), [digitalocean](), [engineering](), [exploit](), [infrastructure](), [kernel](), [linux](), [security](), [trust-security](), [update](), [virtualization](), [vulnerability]() ### AI overview DigitalOcean describes how it responded to two serious vulnerabilities affecting its hypervisor fleet: Januscape, a KVM nested-virtualization flaw, was addressed with fleet-wide livepatching, while a separate AMD hypervisor vulnerability required kernel updates and reboots across roughly 1,600 hypervisors. The article reports zero confirmed customer-facing impact. ### Source excerpt Setting the stakes In early July, security researcher Hyunwoo Kim discovered Januscape (CVE-2026-53359), a flaw in KVM's handling of nested virtualization that could allow a malicious guest to escape into the host hypervisor. It was disclosed publicly on July 6 via the Linux oss-security mailing list. For a cloud provider, a guest-to-host escape is the most serious class of vulnerability there is: the hypervisor is the boundary that keeps each customer's workloads isolated from each other, and from our infrastructure itself. We responded, patched the entire fleet in eight days with zero confirmed customer-facing impact, and drafted a post about how we did it. Then, before we could hit publish, it happened again. In late July we learned of a second and unrelated vulnerability affecting our entire AMD hypervisor fleet, that could not be livepatched. Roughly 1,600 hypervisors needed a kernel update and a reboot. So now this story is about two responses, three weeks apart. The first built the muscle. The second proved it was repeatable, at a larger scale, and on a harder constraint. Here's how both played out, and why two of the most serious vulnerability classes in cloud computing ended up feeling like just another couple of weeks for us. Act one: Januscape The fast path: fleet-wide livepatching Our response kicked off the same night the vulnerability was disclosed. When public exploit code surfaced late in the evening of July 6, the Kernel Engineering team was paged and dug in immediately. Engineers reproduced the exploit in an isolated environment, confirmed which kernel lines were affected, and built the first working livepatch before 1 AM, roughly 45 minutes after answering the page. Livepatching lets us fix a running kernel in place, with no reboot, no migration, and no observed disruption to the customer. A few hours later, patches for the kernel versions (6.1 and 6.12) that run the majority of our hypervisor fleet were ready to ship. For the remainder, we had to ## Enhancing Security with User-Specific Access Keys for DigitalOcean Functions DevFeed: [Enhancing Security with User-Specific Access Keys for DigitalOcean Functions]() Original publisher: [Read original article]() Author: Amulya Tomer Published: 2026-03-23T19:30:06Z Content type: release Language: en Sources: [DigitalOcean]() Topics: [Digital Ocean](), [Security](), [Access Control](), [Authorization](), [Serverless](), [upgrade]() Tags: [access-control](), [auditability](), [automation](), [digitalocean](), [security](), [serverless](), [trust-security](), [update](), [visibility]() ### AI overview DigitalOcean introduces user-specific namespace access keys for DigitalOcean Functions. The update replaces shared namespace credentials with keys tied to individual users, supporting automatic revocation when team members leave, multiple keys per namespace, improved accountability, and optional expiration. ### Source excerpt As teams grow and scale their serverless workloads, managing security postures becomes just as critical as managing code. Our goal at DigitalOcean is to support your growth at every stage. One way we support you is by iterating on our security architecture. Historically, DigitalOcean Functions used a shared credential model within a namespace that is configured in the settings tab of the function view. Same is shared among all users for a functions namespace While simple to start, this model presented challenges for growing teams: if a team member left or changed roles, the shared credentials remained valid. To secure the namespace, admins had to manually revoke and regenerate keys, disrupting workflows for every other developer and production workload using that shared key. Today, we are excited to announce a considerable upgrade to our access model: user-specific namespace access keys. This update shifts access control from the namespace level to the individual identity level, ensuring that access is granted to specific users rather than through a shared key. How user-specific access keys enhance security This transition to user-specific keys solves several critical use cases for teams: Automated access management: When a team member is removed from your DigitalOcean team, their specific access keys are automatically revoked by the platform. This removes the need for manual key rotation and ensures zero disruption to remaining team members. Multiple keys per namespace: A user can create multiple access keys for a namespace, this would allow for easier manual rotation and management of environment-specific keys. Streamlined accountability: Because actions are now associated with unique user-specific keys, you gain better visibility and auditability into resource management. Expiration support: To limit the attack surface further, access keys can optionally have expiration (TTL). The access key will fail to authenticate for any operation(s) after the expirat ## OAuth App Based Workload Identity for Droplets DevFeed: [OAuth App Based Workload Identity for Droplets]() Original publisher: [Read original article]() Author: John Andersen Published: 2025-10-22T18:51:32Z Content type: tutorial Language: en Sources: [DigitalOcean]() Topics: [OAuth](), [OpenID connect (OIDC)](), [Digital Ocean](), [API](), [Cryptography](), [Security](), [GitHub Actions]() Tags: [access-control](), [api](), [authentication](), [authorization](), [cryptography](), [digitalocean](), [github-actions](), [identity](), [oauth](), [oidc](), [secrets](), [tokens](), [trust-security]() ### AI overview This article introduces workload identity federation and explains how to implement it with DigitalOcean's OAuth API. It describes using asymmetric cryptography and OpenID Connect tokens so Droplets and GitHub Actions workflows can authenticate and access DigitalOcean resources without static, long-lived credentials. ### Source excerpt This post is the first entry in a three part series on workload identity federation: Part 1: Architecture (this post) Part 2: Deployment and Configuration Part 3: Usage from Droplets and GitHub Actions This entry will cover what workload identity federation is and how it can be implemented leveraging DigitalOcean's OAuth API. In the following entries in this series, we'll deploy an open source Proof of Concept (PoC), configure roles and policies for workload identity access control, spin up a Droplet, write a GitHub Actions workflow, and access databases and Spaces keys from them using their respective workload identity tokens. What is workload identity federation? Workload identity is used to reduce the amount of secrets involved in deploying and administrating software systems. Instead of authentication being done based on something a workload knows, for example passwords or API tokens, authentication is done based on what the workload is. The heart of workload identity federation is asymmetric cryptography. By leveraging public / private key pairs, tokens can be issued to workloads, such as Droplets, and used for authentication and authorization to APIs exposed by resource servers. Workload identity tokens are exchanged for domain specific access tokens, or grant access to resources directly. This series showcases how we can use DigitalOcean's OAuth API and fine grained permission scopes to implement and leverage workload identity federation using OpenID Connect (OIDC) protocol tokens. We'll enable secretless access to DigitalOcean hosted databases and Spaces buckets from Droplets and GitHub Actions workflows. Eliminating the need to provision static, long-lived credentials for databases and Spaces buckets for those environments. Workload identity RBAC Security properties Authentication based on what the workload is requires that the infrastructure orchestrating the workload be able to make verifiable claims about a workload's properties. To do this, the infrastr