The Control Plane — Week of Mon Oct 19, 2026

Node.js fixes 10 CVEs, Kubernetes October patches slip again, a power event downs europe-west2-b, OVHcloud CLI releases get swapped, and renewal timing data.

This week’s theme is trusting the wrong thing. A TLS client that checks the wrong hostname, a release archive that matches its tag but not its build, a calendar date that isn’t the release date. In each case the fix is to check the artifact itself rather than the label on it.

Kubernetes and cloud

The October Kubernetes patch round was postponed by one week to October 20 “to include the latest Go releases and CVE fixes,” with cherry-picks due October 16. As of the morning of October 22, the GitHub release list still showed 1.37.1, 1.36.5, 1.35.9, and 1.34.12 as the newest patches, and the stable-1.34.txt marker still pointed at 1.34.12. The planned 1.37.2, 1.36.6, 1.35.10, and 1.34.13 are now at least nine days past the original October 13 target, which extends the slip we measured in our Saturday analysis.

The timing matters most for 1.34. Its end-of-life date is October 27, and only critical security fixes are accepted. If 1.34.13 ships this week, clusters on 1.34 get a few days with the final patch before support ends. Teams still on 1.34 should plan the move to 1.35 or later now rather than waiting for the last patch.

The CVE fixes the round is waiting for haven’t been announced yet. Watch the official CVE feed and kubernetes-announce for the advisories that will go with the release.

TLS and certificates

Let’s Encrypt is adding two remote perspectives to domain validation. Each validation will make seven requests: one from the primary datacenter and six from remote perspectives, up from four. Staging gets the change on October 27 and production on November 10. The CA/Browser Forum’s multi-perspective issuance rule requires at least five remote perspectives across two Regional Internet Registry regions from December 15, 2026. Let’s Encrypt expects little to no impact. If you allowlist validation traffic by source IP or serve HTTP-01 challenges through geo-restricted infrastructure, test against staging after October 27, because more perspectives means more places a challenge has to be reachable from.

Two of the Node.js fixes this week are TLS bugs, and both are worth reading if you run Node.js services that make outbound HTTPS calls. CVE-2026-105483 let a certificate pass hostname verification when the IP address was written with fullwidth digits. CVE-2026-106069 was a hostname bypass when the host loosely resolves to an IP address. A related medium-severity fix, CVE-2026-106072, stops DNS names in a certificate from authenticating non-canonical IPv4 hostnames. All three affect code that connects to an address supplied by a user or a config file, which is the common case for webhooks, proxies, and SSRF-sensitive fetchers.

Security

Node.js released 26.12.1, 24.22.1, and 22.23.4 on October 21 with fixes for 10 CVEs. Four are rated High: the two TLS hostname bypasses above, a dns.resolve bug that truncates names containing a NUL character (CVE-2026-105482), and a Brotli decoder out-of-bounds write that permits remote code execution (CVE-2026-111497). The Brotli bug matters for any service that decompresses untrusted request or response bodies. One medium fix, CVE-2026-106074, is easy to miss: the entropy caches behind crypto.randomUUID() and randomInt() were saved into user-land startup snapshots and single executable applications, so every process started from the same snapshot repeated the same values. If you build SEAs or snapshots, rebuild them on the new release, not just the runtime.

CISA added BeyondTrust Remote Support CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16. It’s a critical authentication bypass in version 26.2.3 and earlier. Attackers are using it for initial access, persistence, and lateral movement. Self-hosted appliances need the BT26-05-RS patch, and those older than 24.3.1 must upgrade first. The BeyondTrust-hosted service is already patched. Palo Alto’s Unit 42 updated its brief on PAN-OS CVE-2026-0257 on October 20. Ransomware operators are now attempting the GlobalProtect authentication bypass, and Unit 42 keeps finding management interfaces exposed to the internet on ports 4443 and 3879.

The supply-chain story of the week is OVHcloud’s CLI. On October 19, an attacker used a contributor’s GitHub account to replace the archives and checksums.txt on five existing releases, v0.11.0 through v0.15.0, with a build that steals secrets from disk. The swapped files were live from 12:47 to 14:21 UTC. The source, tags, and pipeline were untouched. What caught it was a customer’s CI job that pinned the SHA-256 of one archive and started failing. If you install CLIs from GitHub releases in CI, pin the hash yourself rather than trusting a checksum file that ships next to the archive. Where a project publishes attestations, verify those too.

Web development and tooling

TypeScript 7.1 Beta arrived on October 20. It adds import attributes in ambient module declarations, so you can type import sheet from "./a.css" with { type: "css" } as a CSSStyleSheet. It also adds source phase imports (import source), which give you a WebAssembly.Module you can instantiate yourself. And it makes es2026 a stable --target and --lib, moving declarations like Math.sumPrecise(), Iterator.concat(), and JSON.rawJSON() out of esnext.

For Node.js teams, the security release is the week’s real work item. Upgrade to 26.12.1, 24.22.1, or 22.23.4, rebuild base images, and re-create any snapshots or single executable applications. Node.js 26 enters LTS this month under the old schedule, so if you were waiting for LTS to adopt it, the 26.12.1 security baseline is a good starting point.

SRE and reliability

At 06:08 UTC on October 20, a power event took down Google Cloud’s europe-west2-b zone, one of three in London. The Register reported that Cloud Run, GKE, App Engine, Filestore, NetApp Volumes, Managed Kafka, and BigQuery Data Transfer were affected. Banks and retailers including Lloyds, HSBC, and Revolut had customer-facing outages. Google said it was prioritizing recovery of existing workloads and that customers might not yet be able to create new ones. By 14:03 UTC it said the issue was mitigated for most customers.

The detail to plan around is that last part. During a zonal recovery, a provider puts existing workloads ahead of new capacity, so failover plans that create new resources in the affected region can stall exactly when you need them. Pre-provisioned capacity in a second zone or region is what makes failover actually work.

Google also published its final report on the Cloud Storage write incident from October 8 and 9 in us-central1. A traffic-sorting configuration update intended to relieve a capacity shortfall “inadvertently bypassed standard capacity-aware routing,” and a few nodes with little spare capacity got most of the write traffic. The recurrence the next morning came from an incomplete rollback. Together the two windows ran 18 hours and 11 minutes. Two lessons generalize. A change meant to relieve load can concentrate it. And a rollback you haven’t verified is still a change in flight.

Chart of the week: when developer domains renew

Let’s Encrypt recommends checking ACME Renewal Info (ARI) twice a day and, as a backstop, renewing “when they have a third of their total lifetime left,” which is 30 days for today’s 90-day certificates. With 64-day certificates arriving on February 10, 2027, that backstop becomes about 21 days. To see how real schedules line up, we pulled the certificate history for our usual 60 developer-infrastructure domains from CertIndex on October 22. For each run of 90-day Let’s Encrypt certificates with the same names, we measured how many days the old certificate had left when its replacement was issued.

Most domains renew right at the 30-day mark. That matches both a fixed “renew at 30 days left” rule and the one-third guidance, and the data can’t tell those apart. With 64-day certificates, a fixed 30-day rule renews at day 34, a bit earlier than needed but safe. The second group renews with about 60 days left, two-thirds of the lifetime remaining. If those schedules are fixed day counts, a 64-day certificate would trigger a renewal about four days after each issuance. That’s exactly the hard-coded value Let’s Encrypt warned about. Renewals through ARI are exempt from rate limits, but other renewals count against the limit of five certificates per exact set of names every seven days.

The third group isn’t early renewal. Those domains have several certificates for the same names issued days apart, usually from separate servers or CDN edges, so their overlaps don’t measure renewal timing. Treat all of this as a lower bound, because several inventories were still being backfilled. The pairs are published as JSON. To see the dates for one of your own hosts, use the CT lookup tool.

From the workshop

Two new pieces this week. Kubernetes Patch Releases Are Running Late compares a year of planned patch dates with actual release dates and measures how long AKS takes to pick each patch up. The Same YAML, Eight Different Answers runs 22 tricky values through eight parsers and shows why Kubernetes stores an unquoted key y as "true".

Recommended reading

• Read the Node.js October security release notes and rebuild any snapshots or single executable applications.
• Revisit why ACME renewal quietly broke before changing renewal thresholds.
• Use the TLS inspector to confirm the certificate a host actually serves after renewal.

Tags: #weekly-recap, #nodejs, #tls, #acme, #kubernetes, #supply-chain, #sre