--- title: GitHub Actions outage hits CI pipelines, NatJack attack... description: GitHub Actions and Pages went down for several hours today, breaking workflow runs and API calls mid-execution. Separately, security researcher Malcolm Stagg... canonical: https://daily.dev/posts/github-actions-outage-hits-ci-pipelines-natjack-attack-bypasses-nat-on-32-products-ihwj1he2y twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitHub Actions outage hits CI pipelines, NatJack attack bypasses NAT on 32 products | daily.dev og:description: GitHub Actions and Pages went down for several hours today, breaking workflow runs and API calls mid-execution. Separately, security researcher Malcolm Stagg... og:url: https://daily.dev/posts/github-actions-outage-hits-ci-pipelines-natjack-attack-bypasses-nat-on-32-products-ihwj1he2y og:image: https://api.daily.dev/og/posts/ihWJ1HE2y.png og:image:alt: GitHub Actions outage hits CI pipelines, NatJack attack bypasses NAT on 32 products og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitHub Actions outage hits CI pipelines, NatJack attack bypasses NAT on 32 products **[Backend Digest](https://daily.dev/sources/backend_digest)** · 5 min read · 1 upvotes · 0 comments ## Summary GitHub Actions and Pages went down for several hours today, breaking workflow runs and API calls mid-execution. Separately, security researcher Malcolm Stagg disclosed NatJack at Black Hat USA 2026 — a new attack class that manipulates NAT connection tracking tables and was found to affect every one of the 32 products tested across 95 configurations. On the infrastructure side, AWS released Dogwood, an open-source Cedar extension for temporal AI agent authorization, and the MCP 2026-07-28 spec officially shipped as stateless, with Sentry and Linear already running it in production. Qwen 3.8-Max landed with some genuinely impressive long-horizon coding benchmarks worth looking at. ## Content **TLDR:** GitHub Actions and Pages went down for several hours today, breaking workflow runs and API calls mid-execution. Separately, security researcher Malcolm Stagg disclosed NatJack at Black Hat USA 2026 — a new attack class that manipulates NAT connection tracking tables and was found to affect every one of the 32 products tested across 95 configurations. On the infrastructure side, AWS released Dogwood, an open-source Cedar extension for temporal AI agent authorization, and the MCP 2026-07-28 spec officially shipped as stateless, with Sentry and Linear already running it in production. Qwen 3.8-Max landed with some genuinely impressive long-horizon coding benchmarks worth looking at. --- ## GitHub Actions and Pages outage: workflow runs failing for hours GitHub Actions went down hard today — workflow runs failed to start or died mid-execution, the Actions REST API returned errors, and some users hit unexpected rate limiting. Pages saw intermittent degraded performance alongside it, and GitHub Enterprise Importer migrations were also affected. At least one developer noted Actions had been down for five hours before resolution. The incident is a reminder of how much CI/CD infrastructure now runs on a single platform with no obvious fallback. [Read more](https://daily.dev/posts/cjc7ZiYZl) ## NatJack attack manipulates NAT tables to hijack TCP connections, affects every tested product Malcolm Stagg disclosed NatJack at Black Hat USA 2026 — an attack class that manipulates NAT connection tracking tables to enable TCP connection hijacking, DNS response poisoning, denial of service, and port identification without requiring Layer 2 access or victim interaction beyond sharing a NAT boundary. Testing covered 32 products across 95 configurations, and every single implementation was vulnerable to at least some techniques. The Linux kernel was patched (CVE-2026-63913) at Microsoft's request for Azure Kubernetes Service, and Windows NAT in Hyper-V received CVE-2026-56181. Cisco and Apple declined to classify the findings as vulnerabilities. If you're running shared NAT boundaries in multi-tenant or cloud environments, this is worth reading carefully. [Read more](https://daily.dev/posts/kSuUIJyjx) ## AWS releases Dogwood, a temporal policy language for AI agent authorization AWS open-sourced Dogwood, a Cedar extension that adds temporal conditions to authorization decisions — letting policies examine earlier tool calls and responses within an agent session before allowing the current one. This addresses a real gap: standard per-request authorization can't catch an agent making five $200 transfers in parallel before any register against a limit, or executing step B before step A has actually completed. Alongside Dogwood, Amazon Bedrock AgentCore now includes rate limiting controls scoped to per-user or per-group limits on request rates, inference tokens, and concurrent connections. The reference interpreter is Apache 2.0 on GitHub, explicitly marked for exploration rather than production use — teams would need to handle trusted event histories and tenant isolation themselves. [Read more](https://daily.dev/posts/FEevMHP42) ## Qwen 3.8-Max: 16-day autonomous coding runs and strong long-horizon benchmarks Alibaba launched Qwen 3.8-Max with a focus on long-horizon autonomous coding. Three showcases: a 16-day unattended CLI project (265 commits, 127 PRs), a 125-hour ML paper reproduction run producing 7,600 lines of code that beat the original paper's AIME24 result by 2.7 points, and a 24-hour Tianchi data science competition where the model finished ahead of 87% of human teams. Benchmark highlights include PaperBench at 93.0 (best in class) and SWE-bench Pro at 67.7. Available via DashScope at $2/M input and $6/M output tokens, with setup configs provided for Claude Code, Codex, and others. [Read more](https://daily.dev/posts/yBJ65jj6z) --- ## Also notable - **MCP 2026-07-28 stateless spec ships with Sentry and Linear in production:** The fully stateless MCP spec is now official — each request carries its own context, enabling MCP servers to run as ordinary HTTP workloads without sticky sessions or open streams, and Sentry and Linear are already running it in production. [Read more](https://daily.dev/posts/zbwzrUpm5) - **TONTOU bypasses Spectre v2 mitigations on AMD Zen 1–4, leaks kernel memory at 5.47 bytes/sec:** MIT CSAIL researchers disclosed TONTOU at Black Hat USA, exploiting a timing gap between Spectre v2 neutralization and actual predictor use to re-poison CPU state on AMD Zen 1 through Zen 4; a patch has been merged into the Linux kernel tree. [Read more](https://daily.dev/posts/EeHfznSYD) - **Swiss government SharePoint breach compromised 200 accounts via July 2026 Patch Tuesday CVEs:** Switzerland's BIT confirmed attackers compromised approximately 200 accounts by exploiting SharePoint vulnerabilities CVE-2026-56164 or CVE-2026-50522, both fixed in the July 2026 Patch Tuesday updates — patch if you haven't. [Read more](https://daily.dev/posts/B9UhLFHIq) - **ChainDrop malware infects 1,300+ npm package versions including keyv (600M monthly downloads):** A new npm supply chain attack compromised the keyv maintainer account and spread to flat-cache, file-entry-cache, cacheable-request, and others, pushing malicious versions with valid GitHub Actions provenance signatures that bypass npm's provenance checks. [Read more](https://daily.dev/posts/0kFFJfdOh) - **ElastiCache Graviton4 nodes deliver up to 47% higher throughput and 43% lower P99 latency over Graviton3:** The new M8g, R8g, and C8gn node families are available now across 30+ AWS regions, with C8gn supporting up to 200 Gbps network bandwidth — worth evaluating if you're on Graviton3 M7g or R7g nodes today. [Read more](https://daily.dev/posts/Lb5tO8UFd) ## Similar posts on daily.dev - [TanStack Details Sophisticated npm Supply Chain Attack That Compromised 42 Packages](https://daily.dev/posts/tanstack-details-sophisticated-npm-supply-chain-attack-that-compromised-42-packages-bjod4ssnq) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/github-actions-outage-hits-ci-pipelines-natjack-attack-bypasses-nat-on-32-products-ihwj1he2y) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/github-actions-outage-hits-ci-pipelines-natjack-attack-bypasses-nat-on-32-products-ihwj1he2y","headline":"GitHub Actions outage hits CI pipelines, NatJack attack bypasses NAT on 32 products","text":"GitHub Actions and Pages went down for several hours today, breaking workflow runs and API calls mid-execution. Separately, security researcher Malcolm Stagg disclosed NatJack at Black Hat USA 2026 — a new attack class that manipulates NAT connection tracking tables and was found to affect every one of the 32 products tested across 95 configurations. On the infrastructure side, AWS released Dogwood, an open-source Cedar extension for temporal AI agent authorization, and the MCP 2026-07-28 spec officially shipped as stateless, with Sentry and Linear already running it in production. Qwen 3.8-Max landed with some genuinely impressive long-horizon coding benchmarks worth looking at.","url":"https://daily.dev/posts/github-actions-outage-hits-ci-pipelines-natjack-attack-bypasses-nat-on-32-products-ihwj1he2y","datePublished":"2026-08-07T04:18:55.739Z","dateModified":"2026-09-13T21:09:12.526Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"GitHub Actions outage hits CI pipelines, NatJack attack bypasses NAT on 32 products"}]} ```