The Control Plane — Week of Mon Sep 28, 2026

Cloudflare's CA plan, Kubernetes patch releases, exploited NetScaler flaws, Firefox 157, the NATS incident report, and a CT sample of who issues dev certificates.

A new certificate authority does not change your configuration on the day it is announced. It changes the list of issuers your monitoring treats as normal, the CAA records you publish, and the questions you ask during the next renewal review. Most of this week’s items work the same way. The announcement is the start of a review, not the end of one.

Kubernetes and cloud

The Kubernetes release team cut four patch releases on September 23: v1.37.1, v1.36.5, v1.35.9, and v1.34.12. Each one carries fixes for two Medium-severity advisories. CVE-2026-2270 (CVSS 5.9) is a confused-deputy issue in the StatefulSet controller. A user with namespace-scoped write access to both StatefulSets and ControllerRevisions could cause kube-controller-manager to create a Pod in another namespace. The fixed builds restore only the StatefulSet spec field from a ControllerRevision. CVE-2026-76654 (CVSS 5.8) affects Windows nodes only. A subPath symlink that points to a UNC path makes the kubelet try NTLM authentication against an attacker-controlled share.

Neither fix needs a configuration change; both need the control plane and node pools upgraded. Audit which roles can write ControllerRevisions, since few humans need that permission. The patch release schedule puts the next monthly round in October. Use the Kubernetes YAML linter to review the RBAC manifests while you are in them, and the 1.37 upgrade readiness checklist for the minor-version path.

TLS and certificates

Cloudflare announced on September 29 that it intends to become a public certificate authority. It is not issuing certificates yet. It has applied to the Chrome, Apple, Microsoft, and Mozilla root programs. It has also signed an agreement to acquire an established, publicly trusted root from GlobalSign, so its certificates can be trusted on existing devices from the first day of issuance. The press release says the CA will issue both classic certificates and Merkle Tree Certificates (MTCs), with production MTC issuance planned for the first quarter of 2027.

The companion engineering post adds the operational detail. The ACME service will be a fork of Boulder, the software that runs Let’s Encrypt. Chrome’s draft Quantum-resistant Root Program policy requires at least two cosignatures on an MTC, one of them from an independent mirroring cosigner. For operators the near-term work is small but real. Decide whether a future Cloudflare issuer belongs in your CAA records. Make sure CT monitoring alerts on an unexpected issuer, not just an expiry. And plan for clients that will need to verify MTC proofs before post-quantum certificates go into production.

Security

CISA added two Citrix NetScaler ADC and Gateway flaws to the Known Exploited Vulnerabilities catalog on September 27, with a federal remediation deadline of September 30. Both are rated critical. CVE-2026-88771 is an improper input validation flaw that lets an unauthenticated attacker run arbitrary commands, and it affects default configurations. CVE-2026-88772 is a memory-buffer flaw that can lead to remote code execution or denial of service. It requires DTLS, which is on by default for VPN virtual servers. CISA’s alert covers eight NetScaler CVEs in total, CVE-2026-88771 through CVE-2026-88778.

For defenders, the order of operations matters. The fixed builds are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1-37.279 FIPS/NDcPP. Versions 12.1 and 13.0 are end-of-life and need a migration, not a patch. Check the indicators of compromise in NetScaler Console before you update, and preserve forensic evidence first: CISA warns that updating can destroy forensic visibility. The UK NCSC guidance recommends isolating and replacing affected systems where possible, restricting management access to your own IP ranges, and investigating fully before you return an appliance to service.

Web development and tooling

Firefox 157 reached Stable on September 29. Three changes are worth a test. The at-rule() function inside @supports can now detect whether the browser supports a given at-rule, for example @supports at-rule(@scope), and it also works in @import’s supports() condition. The overscroll-behavior properties accept a new chain value, which passes scrolling to the parent scroll container without the browser’s bounce effect. WebGPU adds the TRANSIENT_ATTACHMENT texture usage, which keeps render-pass attachments in tile memory and avoids allocating VRAM for them.

Chrome’s September 29 Stable update moved desktop to 154.0.8037.92/.93 with 32 security fixes, including a critical buffer overflow in ANGLE (CVE-2026-102331) and several high-severity V8 type confusion bugs. Treat that as a forced browser refresh for your test fleet. Pin the build number in CI results, and re-run any WebGPU or canvas tests you rely on. When a front-end change sits behind a CDN, the HTTP header inspector is a quick way to confirm that caching and security headers survived the deploy.

SRE and reliability

NATS published its preliminary report on the September 8 UK air traffic control incident. The fault was in the part of the National Airspace System that assigns identification codes to aircraft when a controller requests one manually. While one manual request was being processed, a higher-priority message arrived. The request was paused, and when processing resumed the software did not resume it correctly. The corrupted output then affected later flight-data updates. NATS restricted traffic across the UK for about six hours while it restarted the system and reloaded flight data. Clearing the passenger backlog took more than two days.

The full preliminary report is worth reading for one engineering lesson: the defect sat in a pause-and-resume path that only runs when two rare events overlap. Your own systems almost certainly have paths like that. Inventory where work can be preempted. Write a test that interrupts each one at the worst moment. And measure how long a cold restart with a full data reload really takes, because that number becomes the length of your outage.

Chart of the week: who issues certificates for developer infrastructure

Cloudflare’s announcement prompted a simple question: which CAs do the sites developers depend on actually use today? On October 1 we pulled the currently valid leaf certificate for 15 package registries, platforms, and project sites from CertIndex, our index of public Certificate Transparency logs. Lifetime is not_after minus not_before.

Fifteen hosts use six CA operators. Let’s Encrypt issues five of the certificates and Google Trust Services three, so ACME-native issuers cover more than half the sample. Sectigo, Amazon, and DigiCert issue two each, and GlobalSign one. Cloudflare’s own site currently uses Google Trust Services. The issuer is about to move into this market, but it doesn’t yet issue for its own domain.

Lifetimes tell the same story we have seen before. Nine certificates sit at 84 to 90 days. Three sit just under the 200-day cap. Three are long pre-cutover certificates issued before March 15, 2026, which remain valid until early 2027. This is a reproducible sample, not a market-share estimate. For your own estate, record the issuer and intermediate alongside the expiry, and look up any host in the CT lookup tool to confirm which CA is actually issuing for it.

From the workshop

The HTTP header inspector guide shipped on September 26. It covers redirect chains, cache validators, HSTS, CSP, CORS exposure, and how to handle response fields safely when you copy them into a ticket. On September 28 the DNS reference grew to 38 entries with IPSECKEY, RESINFO, EUI48, and EUI64. Each entry has a record format, a worked example, and lookup commands. Every tool on the site also got a larger workspace and an accessible fullscreen mode, which helps most with the longer inputs pasted into the YAML, JSON, and regex tools.

Next week, pair this recap’s three review items with a calendar entry: check the RBAC on ControllerRevisions, confirm your CAA records name every CA you intend to use, and time a cold restart of one critical service.

Recommended reading

• Read Cloudflare’s post-quantum CA engineering post for how Merkle Tree Certificates use CT-style logs.
• Use the YAML to JSON conversion guide before you rewrite manifests during the patch upgrade.
• Revisit Certificate Transparency explained to see why an unexpected issuer is a stronger alert than an expiry date.

Tags: #weekly-recap, #tls, #certificate-transparency, #kubernetes, #security, #sre, #web-development