GitHub says Actions Larger Runner jobs could not run for 6 hours 28 minutes on August 18, while runner and runner-group management failed in both the UI and API. A service certificate had been rotated in Key Vault but was not enabled at runtime.
Why it matters: The outage turns certificate rotation into a complete CI execution and control-plane failure for affected runner fleets. Rotation is not complete when a new secret exists; the runtime consumer, health checks, and rollback path must all prove the new…
GitHub says an August 17 incident produced elevated errors and latency for 7 hours 47 minutes across APIs, Actions, Copilot, Issues, pull requests, authentication, and raw-content delivery. At peak, web and API errors were about 20% and archive and raw downloads about 50%; retry behavior drove Copilot Token Service traffic from 7–9K to 70–100K requests per second.
Why it matters: One regional scaling failure propagated through developer identity, source access, automation, and agent authentication, while client retries delayed recovery. CI and agent workflows need explicit degraded-mode behavior rather than assuming the control…
React disclosed CVE-2025-55182, a maximum-severity flaw allowing unauthenticated remote code execution through vulnerable Server Components payload handling. Affected React 19 server-dom packages could expose applications even without user-authored Server Functions; CISA later confirmed exploitation.
Why it matters: The vulnerable packages sit underneath popular web frameworks used for AI applications and administrative surfaces. Remote compromise could expose prompts, credentials, model access, customer data, source code, and deployment infrastructure.