Project
Open-source infrastructure-as-code tool from HashiCorp that defines and provisions cloud and on-prem resources via declarative HCL configs.
HashiCorp's Terraform provider for Google Cloud 8.0 switches the default scheme on two load balancer resources from EXTERNAL to EXTERNAL_MANAGED. Teams still on Classic have to pin the old value before they upgrade, or the first plan may propose changes to their live load balancers.
Reality
Zscaler ThreatLabz says North Korea's TraderTraitor hid a malware loader inside a fake HashiCorp Terraform provider that runs the moment Terraform loads it. The crypto-theft group has pushed its operation into infrastructure-as-code, the tooling that provisions cloud environments.
Reality
OpenTofu 1.13 adds assume functions that let module authors declare an unknown value's shape, so null and prefix checks get answered at plan time. Plan reviews lean less on guesswork wherever shared modules wrap their outputs this way.
Reality
Terraform 1.16 lets Actions fire on before_destroy and after_destroy events, putting backups and deregistration beside the resource and in the plan. Pipelines pay for that with two-step deletions and a failure mode someone has to choose on purpose.
Reality
AWS opened a preview of Well-Architected Agent, a service that reads live accounts across 65+ services and ranks fixes against goals each team declares. The review becomes a job run against the real environment, and every fix comes back as code or commands for the team to apply.
Perspective Coverage
3 publishersReality
Front Door, API Management and private networking cost about $1,730 a month in West Europe in a dev.to Container Apps reference stack for .NET. With the .NET compute at $20 to $140 a month, the risk sits in the hand-offs between its layers.
Reality
env zero's EZ Control lets agents repair infrastructure drift across nearly 2,300 resource types, at an autonomy level each platform team picks. How much autonomy a team grants will depend on how far it trusts the product's map of who owns each resource.
Reality
One ML team moved Airflow off on-prem boxes onto a single GCP VM estimated at under $150 a month, against about $350 for Cloud Composer 3. Its published repo gives other teams a working build to price against their own Composer quote.
Reality
EKS Pod Identity, launched at re:Invent 2023, replaces IRSA's per-cluster OIDC trust with one pods.eks.amazonaws.com principal on every IAM role. A dev.to migration guide has each role trust both paths during cutover, so teams can move and verify one workload at a time.
Reality
September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.
Reality
Unit 42 worked a ransomware intrusion where the operator handed tactical execution to frontier AI agents, and the chain from a public API endpoint to stolen cloud AI keys closed inside a single working day with no zero-day.
Reality
Coder says an unidentified actor reached its Cloudflare infrastructure and pointed part of registry.coder.com at servers it controlled. Because those servers are unreachable, nobody can enumerate who downloaded what.
Reality
SentinelOne has documented North Korea's Jade Sleet inside a small Indian IT services provider, using Rust backdoors built for Apple Silicon and a Terraform lock file that points developers at a fake HashiCorp registry.
Reality
Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.
Reality
Aikido found the Graphalgo campaign's Go port inside two Terraform providers, one of them a typosquat of kreuzwerker/docker. The payload decrypts only when containerName and networkID hash to a hardcoded SHA256.
Reality
The fix was a single new image tag, and it had to land on hundreds of laptops with no channel back to them. That requirement is what pushed a platform team off bash and onto a self-updating Go binary.
Reality
A dev.to account puts one weekend of Databricks serverless compute at $14,000 and traces it to a Tableau connection that polled information_schema every eight minutes, restarting a 10-minute auto-stop timer it never let expire.
Reality
An operator writing on dev.to describes a CPU target-tracking policy and a per-instance free-slot step policy taking turns on the same Auto Scaling Group, with tripling the alarm window only slowing the oscillation to six minutes.
Reality
Remote config edits skip CI entirely, so the case for validating values where they are saved is easy. The check worth copying refuses a new JSON schema while any environment still holds a value it would reject.
Reality
A dev.to checklist treats the model endpoint as a promotion surface with six gates, each requiring an artifact. Its enforcement is a grep over deploy manifests, so a base URL injected at runtime slips past.
Reality
Security · September 15, 2026 · Confirmed3 publishers
Build · September 11, 2026 · One report1 publisher
Science · September 5, 2026 · Confirmed2 publishers
Build · August 24, 2026 · One report1 publisher