HYTE Readings - March 2025
Our monthly running blog post of articles from all around the web. Read what WE read at HYTE.
Kubernetes Patch: 43% of Clusters Face Remote Takeover Risk
Critical vulnerabilities were discovered in Kubernetes' widely-used Ingress Nginx Controller, prompting an immediate call for patching to prevent potential remote takeovers of cloud-based applications and management interfaces by attackers. Approximately 43% of all internet-facing Kubernetes clusters, equating to about 2,795 out of 6,500 surveyed, are at critical risk due to these exposed vulnerabilities. The Kubernetes project has released updates to address these security flaws, which include four critical remote code execution vulnerabilities with a high severity rating, highlighting the necessity for administrators to update immediately or adopt recommended mitigation measures if immediate updating isn't feasible.
Mathew J Schwartz - March 24, 2025 - DataBreachToday
Near Misses Instill Fears Over Widespread Data Center-Induced Blackouts
Data centers in Northern Virginia almost triggered widespread blackouts last summer when 60 facilities simultaneously disconnected from the power grid due to voltage fluctuations, switching to backup generators. This incident, among others, has raised concerns about the growing risk to grid reliability from rapid data center expansion, prompting regulatory authorities and grid operators to consider new measures to ensure stability as the sector's power demand surges.
Dan Rabb - March 19, 2025 - BISNOW
GitHub suffers a cascading supply chain attack compromising CI/CD secrets
A cascading supply chain attack on GitHub Actions, specifically "reviewdog/action-setup@v1" and "tj-actions/changed-files", compromised CI/CD secrets across over 23,000 repositories, with attackers exploiting vulnerabilities to expose sensitive credentials like GitHub Personal Access Tokens and private RSA keys. The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed the breach and a fix has been applied, yet the incident highlights the growing risks and interconnected vulnerabilities within the development tools and infrastructure ecosystem.
Gyana Swain - March 19, 2025 - InfoWorld
IT Leaders are Driving a New Cloud Computing Era
IT leaders are increasingly finding that major cloud providers are not living up to their expectations in terms of cost savings and management simplicity, leading to a shift towards exploring hybrid models and niche providers for enhanced agility and control over infrastructure. Organizations are encountering hidden costs with cloud computing, such as complex pricing structures and data transfer fees, prompting a reevaluation of traditional cloud services. This reassessment is driving a movement towards alternative cloud solutions, like managed service providers and specialized public cloud offerings, to better meet organizational needs while avoiding unforeseen expenses and maintaining flexibility.
David Linthicum - March 14, 2025 - InfoWorld
Kubernetes overspend undercuts cloud cost control efforts
In 2024, a report by Cast AI revealed pervasive overprovisioning with 90% of cloud CPU and 75% of memory capacity underutilized among 2,100 organizations using AWS, Azure, and Google Cloud's Kubernetes workloads, highlighting endemic inefficiencies in public cloud usage. Despite options such as spot-instance discounts and committed spend incentives, companies struggle with cloud cost management, often overprovisioning to avoid service disruptions, leading to excessive costs and underused resources. Cast AI's research suggests that using a mix of on-demand and spot-instance compute or relocating workloads to different regions can significantly reduce expenses, with savings on cloud GPU costs averaging up to 90% through spot instance discounts.
Matt Ashare - March 3, 2025 - CIODive
