One engineer unplugged 100% of a Google Cloud zone's fiber

Today's record has one shape running through it. In every case the protection existed, was designed in, and sat downstream of the event it was supposed to govern.

Redundancy a single procedure could walk through

Google Cloud traced a four-hour outage in its us-central1-b zone to a maintenance procedure in which an engineer sequentially unplugged 100% of the fiber paths across all devices within 13 minutes, with traffic drop rates reaching 100% at the peak of the incident, The Register reports. The redundancy was genuine: many fiber paths, many devices. Nothing in the procedure checked whether it was about to consume all of them, and the answer arrived only once every path was already out.

The prompt fires after the code

Researchers at Manifold Security disclosed a weakness across seven AI coding CLI agents that read and execute commands planted in a Git repository's configuration files, so a downloaded project can run code before the agent asks the user whether it is trusted, according to Risky Business News. The trust prompt is not missing. It is second in line, which makes it a notification rather than a control.

Coder is the same ordering with a different actor: its Cloudflare infrastructure was compromised so that attacker-added registry servers delivered malicious Terraform modules, which stayed live for 14 hours on August 31, per the same bulletin. Nothing between the pointer and the module asked a second question for those 14 hours.

Broadcom patched two VMware Workstation and Fusion flaws that let an attacker with administrative access inside a guest virtual machine run code on the host, the more severe an integer overflow in the VMXNET3 network adapter rated 9.3, with no workarounds available for either, Cyber Security News reports. The guest boundary is the safeguard, and until the patch there was nothing else to fall back on.

The consequence, years downstream

Two items show what happens when the check is left to arrive last of all.

• Honeywell Aerospace agreed to pay more than $2 million to settle False Claims Act allegations that it failed to meet NIST cybersecurity standards on aerospace contracts, with more than $375,000 of that going to the former employee who exposed the failure (Risky Business News). The standard sat in the contract the whole time; what surfaced the gap was a person.
• The Russian government told data center operators to deploy defenses against drone strikes under a presidential decree that lets the state temporarily take over critical infrastructure operators who fail to protect their sites, reaching more than 180 data centers of which over 80% sit in the country's European region within range of Ukrainian strikes (Risky Business News). The concentration is the exposure. The decree is a penalty for still having it.

One default that moved forward

ArtStation switched its NoAI tag on by default for new projects and applied it across existing uploads and profiles, and began using Cloudflare bot management to block known AI crawlers, saying artists should not have to opt in to have their work safeguarded (ArtStation Magazine). Whatever the tag is worth against a crawler that ignores it, the ordering is the part worth noting: the protection now precedes the upload instead of waiting on the artist to find the setting.

Capacity is not the missing piece

OpenAI pledged $1 billion in credits over six months for under-resourced cyber defenders through a Daybreak for Frontline Defenders program open to critical infrastructure operators, community banks, nonprofits and open-source maintainers, alongside a pilot with MS-ISAC for public sector and water system defenders, The Register reports. Under-resourced defenders are real and the credits will be used.

None of today's failures, though, were failures of capacity. A maintenance runbook, a trust prompt, a module registry and a guest boundary each ran in the wrong position relative to the thing they governed. More compute pointed at the aftermath does not move any of them one place earlier in the sequence.