#office-hours - June 2026

https://github.com/features/preview/github-app

if anyone is getting started with hermes, I'd also recommend: https://github.com/OpenRouterLabs/spawn

An git notes alternative to <http://entire.io|entire.io>
https://github.com/git-ai-project/git-ai

Anthropic's open-source framework for AI-powered vulnerability discovery

https://github.com/anthropics/defending-code-reference-harness

You can now run containers on Vercel https://vercel.com/changelog/run-docker-containers-inside-vercel-sandbox

https://arstechnica.com/security/2026/06/for-the-2nd-time-in-weeks-microsoft-packages-laced-with-credential-stealer/

https://github.com/apple/container/blob/main/docs/container-machine.md

Links I mentioned near the end of 2026-06-10 office hours:


Podcast: Adventures in DevOps
Host: Warren Parad, Authress (user authentication)

2026-06-04 Episode – Disaster recovery: Staying resilient in the cloud
Guest: Seth Eliot, Arpio (AWS and Azure backups)
podcasts.apple.com/us/podcast/adventures-in-devops/id1475784710?i=1000771448263

2026-04-16 Episode – Infrastructure as code: Why you can never avoid thinking
Guest: Erik Osterman, CloudPosse (Atmos, Terraform modules)
podcasts.apple.com/us/podcast/adventures-in-devops/id1475784710?i=1000761748130


AWS cost community: Last Week in AWS/Duckbill
Founders: Corey Quinn, Mike Julian; Principal: Eric Pullen

Slack organization
www.lastweekinaws.com/community

Weekly Zoom
www.duckbillhq.com/office-hours


[The LinkedIn profiles and company links are so you can find out about people's work. They're not endorsements, though I do know everyone mentioned, in-person or on-line.]

https://tombedor.dev/human-attention-and-human-effort/

https://x.com/jsrailton/status/2064661778978533571?s=46&t=hxmjEyu5OyUbWbc_cO5EPQ this is rather brilliant/sneaky.

NEW: malware developers added nuclear & biological weapons text to to their spyware.

Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner.

There was one link we forgot to post this week. It's an episode of Adventures in DevOps episodes we mentioned.

The podcast epi is here: https://adventuresindevops.com/episodes/275-disaster-recovery-resiliency-in-the-cloud

Not to be confused with the CNCF software project....

https://www.cnbc.com/2026/06/11/project-prometheus-bezos-bajaj-live-updates.html

🎉 https://www.conductor.build/blog/claude-subscription-update

https://daniel.haxx.se/blog/2026/06/15/curl-summer-of-bliss/

Although I've been busy converting all my Microsoft SQL Server RDS databases to hot new X2m instances, based on x2iedn 🧐 technology, I did come across an interesting piece of AWS trivia and a useful announcement:


"AWS Management Console Private Access now works without internet connectivity"
aws.amazon.com/about-aws/whats-new/2026/06/aws-management-console-private
The headline is confusing but if you have AWS VPN connectivity you can now access the console entirely on the private network. A VPC endpoint for static assets (JavaScript, CSS, images) was missing at launch in May, 2023.


"AWS announces AWS Workload Credentials Provider"
aws.amazon.com/about-aws/whats-new/2026/06/aws-workload-credentials-provider
This is an alternative to the Vault Agent, a replacement for the Secrets Manager Agent, and a way to avoid brittle scripts. Community Builder Ashish Kasaudhan (whom I don't know) has written one of the first articles with examples,
awstip.com/aws-workload-credentials-provider-a-better-way-to-deliver-secrets-and-certificates-a86ca1b73279

A late-breaking announcement, much more interesting than the ones I'd mentioned this afternoon: a third kind of S3 object metadata…

aws.amazon.com/blogs/aws/amazon-s3-annotations-attach-rich-queryable-context-directly-to-your-objects

https://runs-on.com/docs/runners/capabilities/pull-through-registry/

Anyone see this? https://github.com/bitnami/containers/issues/83267

https://mise.jdx.dev/ looks awesome

I am looking for devtest k8s solutions (thread)
• local dev k8s env - preferably 2 worker nodes (used KIND and MiniKube, but these are default 1-node solutions)
• BYIK self hosted - e.g. rke2, microK8s, k3s, Kubespray, kubeadm
• Manging VMs (like opensource free vmware) - e.g. proxmox, oVirt, MicroCloud? (openstack looks too complex)

https://github.com/EpicGames/lore

https://nelson.cloud/.gitignore-isnt-the-only-way-to-ignore-files-in-git/

Pastebin for agents https://display.dev/

https://github.com/microsoft/presidio

https://orchidfiles.com/github-repositories-distributing-malware/

https://namespace.so/

https://support.claude.com/en/articles/14328960-identity-verification-on-claude

We can expect to see a lot more TLDs
https://www.icann.org/en/announcements/details/icann-opens-application-window-for-new-generic-top-level-domains-30-04-2026-en

https://spur.us/blog/smart-tv-apps-residential-proxy-sdks

https://aws.amazon.com/blogs/aws/run-isolated-sandboxes-with-full-lifecycle-control-aws-lambda-introduces-microvms

I finally bite the bullet and created a chrome extension for github, as I was fed up trying to quickly find failed jobs within large matrix workflows. I think this could be interesting for others!
https://runs-on.com/actions-lens/

https://openai.com/index/daybreak-securing-the-world/

https://www.linkedin.com/posts/justin-poehnelt_two-months-ago-i-was-fired-by-google-for-share-7475248041252368385-gnOe/?utm_source=social_share_send&utm_medium=ios_app&rcm=ACoAAABZsBUBWKMGQCIG5JlgZ3-pz7WU35HDCw8&utm_campaign=copy_link

Is this a replacement for Bitnami images? https://images.minimus.io/

An RFC for built-in linting has been merged to OpenTofu: github.com/opentofu/opentofu/pull/3999

https://openknowledge.ai/

Anonymous zero day exploits getting published to GitHub https://github.com/bikini/exploitarium

https://emulate.dev/