--- title: EKS gets 7-day rollback, FFmpeg RCE hits media servers description: Amazon EKS now supports Kubernetes control plane version rollbacks within 7 days of an upgrade, closing a long-standing gap that previously required blue/green... canonical: https://daily.dev/posts/eks-gets-7-day-rollback-ffmpeg-rce-hits-media-servers-md6cwyxcy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: EKS gets 7-day rollback, FFmpeg RCE hits media servers | daily.dev og:description: Amazon EKS now supports Kubernetes control plane version rollbacks within 7 days of an upgrade, closing a long-standing gap that previously required blue/green... og:url: https://daily.dev/posts/eks-gets-7-day-rollback-ffmpeg-rce-hits-media-servers-md6cwyxcy og:image: https://api.daily.dev/og/posts/mD6CwyXCY.png og:image:alt: EKS gets 7-day rollback, FFmpeg RCE hits media servers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # EKS gets 7-day rollback, FFmpeg RCE hits media servers **[Backend Digest](https://daily.dev/sources/backend_digest)** · 4 min read · 1 upvotes · 0 comments ## Summary Amazon EKS now supports Kubernetes control plane version rollbacks within 7 days of an upgrade, closing a long-standing gap that previously required blue/green workarounds. A 16-year-old heap out-of-bounds write in FFmpeg's MagicYUV decoder (CVE-2026-8461) enables RCE via a 50KB video file across Jellyfin, Nextcloud, and any app using libavcodec. A prompt injection flaw in Azure DevOps MCP lets an attacker with write access to one repo traverse an entire org using the victim agent's permissions. On the performance side, a team rewrote a Go caching layer in Rust and dropped P99 latency from 50ms to 1.5ms while cutting memory 70%. ## Content **TLDR:** Amazon EKS now supports Kubernetes control plane version rollbacks within 7 days of an upgrade, closing a long-standing gap that previously required blue/green workarounds. A 16-year-old heap out-of-bounds write in FFmpeg's MagicYUV decoder (CVE-2026-8461) enables RCE via a 50KB video file across Jellyfin, Nextcloud, and any app using libavcodec. A prompt injection flaw in Azure DevOps MCP lets an attacker with write access to one repo traverse an entire org using the victim agent's permissions. On the performance side, a team rewrote a Go caching layer in Rust and dropped P99 latency from 50ms to 1.5ms while cutting memory 70%. --- ## Amazon EKS adds 7-day Kubernetes control plane rollback EKS now lets you revert a cluster to its previous Kubernetes version within 7 days of an upgrade, preserving etcd data, workloads, and persistent volumes. The feature runs cluster insights checks before proceeding and includes a cancel API for node rollbacks; Auto Mode clusters roll back worker nodes before the control plane automatically. GKE already had this; AKS still only supports node pool rollbacks. No extra cost, available in all EKS regions. [Read more](https://daily.dev/posts/5IBSTLbyM) ## FFmpeg MagicYUV decoder RCE (CVE-2026-8461) affects Jellyfin, Nextcloud, and cloud transcoders JFrog disclosed a 16-year-old heap out-of-bounds write in FFmpeg's MagicYUV decoder that allows RCE or DoS by delivering a crafted AVI, MKV, or MOV file — no authentication required. Researchers demonstrated full RCE on Jellyfin and Nextcloud by uploading a 50KB AVI. Affected surface is wide: desktop players, media servers, cloud transcoding pipelines, IoT and NAS devices. Fix is upgrading to FFmpeg 9.0+, applying a 7-line patch to libavcodec/magicyuv.c, or rebuilding without the MagicYUV decoder. [Read more](https://daily.dev/posts/oEQKbxaFA) ## Azure DevOps MCP prompt injection lets one repo compromise an entire org Manifold Security found that Azure DevOps MCP's PR retrieval tool passes untrusted PR description content directly to the model as trusted text — unlike wiki and build log tools, it uses no delimiters. An attacker with write access to a single repo can embed hidden HTML instructions that hijack a victim's agent and traverse the whole organization using the victim's permissions. No CVE or patch exists yet. Practical mitigations: scope PATs to single projects, restrict MCP tool domains to the task at hand, require human approval for cross-project actions, and log agent activity. [Read more](https://daily.dev/posts/7JFkLlz1z) ## Go GC pauses drove a team to Rust: P99 dropped from 50ms to 1.5ms A team running a high-throughput in-memory caching layer on Go found GC pauses causing P99 latency spikes of 50–100ms at millions of requests per second. They rewrote the cache in Rust using DashMap, eliminating GC pauses entirely. Results: P99 fell from 50ms to 1.5ms, memory usage dropped 70%, CPU halved. Their conclusion is measured — Go stays the default for standard microservices, Rust earns its place only at the extreme latency-sensitive end. [Read more](https://daily.dev/posts/MnZbCRfMJ) --- ## Also notable - **Bing Images RCE via ImageMagick SVG delegate (CVE-2026-32194, CVE-2026-32191):** XBOW disclosed two RCE vulnerabilities in Bing Images where a three-line SVG with a pipe character in xlink:href caused ImageMagick to shell out, achieving NT AUTHORITY\SYSTEM — the same bug class as ImageTragick (2016), still unpatched in many self-hosted pipelines; mitigate by disabling SVG/MVG/EPS coders in policy.xml and sandboxing conversion workers. [Read more](https://daily.dev/posts/JWvJhRg1v) - **Shark vacuum AWS IoT misconfiguration exposes ~674K devices across an entire region:** A researcher extracted a certificate from one Shark vacuum via an unauthenticated U-Boot console and used it to subscribe to wildcard MQTT topics covering all Shark devices in an AWS region, with shell access via the shadow's Exec_Command field — ~674K devices confirmed vulnerable, no patch four months after disclosure. [Read more](https://daily.dev/posts/5GQuMa1jc) - **BuildBuddy CDC skipped ~300 TiB of duplicate uploads over two weeks in Bazel remote cache:** BuildBuddy's Content-Defined Chunking implementation for Bazel's remote cache achieved ~85% deduplication on eligible writes and 40% less data uploaded in benchmarks; opt in with --experimental_remote_cache_chunking on Bazel 8.7 or 9.1+. [Read more](https://daily.dev/posts/b2fV2Gke6) - **Local SQL agent accuracy jumped from 13% to 72% by replacing ReAct with a deterministic 5-step pipeline:** Switching from a ReAct agent to a deterministic pipeline with domain classification, hybrid BM25+MMR schema retrieval, and LLM self-correction — plus fixing an Ollama context window inconsistency that caused 67-second latency — brought a PostgreSQL SQL agent from 13% to 72% accuracy on a consumer RTX 3070. [Read more](https://daily.dev/posts/WHtfQeqXg) - **Docker Hub OIDC auth from GitHub Actions replaces long-lived org tokens as of July 21, 2026:** Docker now supports OIDC-based authentication to Docker Hub from GitHub Actions using short-lived tokens (5 min to 1 hour) via docker/login-action v4.5.0+, available for Team, Business, and DSOS plans — eliminates the need to store static Organization Access Tokens in CI secrets. [Read more](https://daily.dev/posts/ir3yfs5mk) ## Similar posts on daily.dev - [AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC](https://daily.dev/posts/ai-enabled-security-researchers-discover-how-a-crafted-video-can-provide-attackers-access-to-your-pc-oeqkbxafa) · InfoQ · 1 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#kubernetes](https://daily.dev/tags/kubernetes), [#backend](https://daily.dev/tags/backend), [#rust](https://daily.dev/tags/rust), [#mcp](https://daily.dev/tags/mcp) [View this post on daily.dev](https://daily.dev/posts/eks-gets-7-day-rollback-ffmpeg-rce-hits-media-servers-md6cwyxcy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/eks-gets-7-day-rollback-ffmpeg-rce-hits-media-servers-md6cwyxcy","headline":"EKS gets 7-day rollback, FFmpeg RCE hits media servers","text":"Amazon EKS now supports Kubernetes control plane version rollbacks within 7 days of an upgrade, closing a long-standing gap that previously required blue/green workarounds. A 16-year-old heap out-of-bounds write in FFmpeg's MagicYUV decoder (CVE-2026-8461) enables RCE via a 50KB video file across Jellyfin, Nextcloud, and any app using libavcodec. A prompt injection flaw in Azure DevOps MCP lets an attacker with write access to one repo traverse an entire org using the victim agent's permissions. On the performance side, a team rewrote a Go caching layer in Rust and dropped P99 latency from 50ms to 1.5ms while cutting memory 70%.","url":"https://daily.dev/posts/eks-gets-7-day-rollback-ffmpeg-rce-hits-media-servers-md6cwyxcy","datePublished":"2026-07-27T04:19:22.171Z","dateModified":"2026-09-13T21:14:51.897Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"EKS gets 7-day rollback, FFmpeg RCE hits media servers"}]} ```