CommPulse

Can you recommend either general features to look for in UPS units to stay on during storms or specific models that work properly? Something I have been frustrated by recently is UPS units shutting off when the power flickers during a storm rather than switching to battery. I presume this is because there was a power surge not just a dropout, but it seems to happen with great frequency. As an example, one customer's server is connected to two different 1000VA UPS tower form factor, one from Cyberpower and one from APC. I think they have both turned off instantly during power outages more often than either has actually stayed on during the outage. Both work fine if simply unplugged. submitted by /u/Kamikaze_Wombat to r/sysadmin [link] [comments]

Hi, i don't really know if this the correct place to ask but i hope to get insight and maybe if anyone ever get into the same case. what happen: I was playing with vertex and trying out different model, and after a while want to try claude api from vertex (now they called agent platform) tried to activate the api and run some req, but getting no quota, manually request from console also give no upgrade at all, so i tried contacting the sales support, asking for an increase quota for some sonnet and haiku model, I ask for just mere 20 rpm and 100k tpm output limit increase, because I am just trying out few days later, as of today got an email from ai studio of my billing tier upgraded to tier 3 https://preview.redd.it/gzqn400tkvjh1.png?width=1647&format=png&auto=webp&s=a55dc52f6ec66427d8dc01d1c19a4e842d5d558a I check on my gcp console, now i get the anthropic limit raised to a whopping lot of 2M input, 200k output, and 2k rpm https://preview.redd.it/6lldf52flvjh1.png?width=1853&format=png&auto=webp&s=9debe3966cc109ffb661eb38d3deccb30c06162f what scares me now that my limit are actually increased to the max limit of USD 100,000 and any random shit happen and it potentially ruin my finance. https://preview.redd.it/urg5paexjvjh1.png?width=847&format=png&auto=webp&s=bcde642217a63a23bdb963316d9914a9d651d119 What i want to know did anyone every get into this before? can i actually downgrade to tier 1? as my spending actually small just 1-3usd per month on few months back where can i get the support for this particular issue? Thank in advance :) submitted by /u/x-xiaolongbao to r/googlecloud [link] [comments]

Something looks off on a server, policy blocks installing Sysinternals, and on Server Core there's no GUI either. All of this is built in and works over PowerShell remoting. Most of my work is incident response, which in practice means turning up to networks where I'm not allowed to install anything and being asked to have an opinion anyway. Not an EDR replacement. It's the DIY version for when there's no agent on that box, or you'd rather check yourself than take a vendor's word. Signature , including the catalog-signed system files many Windows binaries use rather than embedded ones: Get-AuthenticodeSignature -FilePath "C:\Windows\System32\suspect.exe" | Format-List * Status should be Valid. HashMismatch means the file changed after signing. Valid isn't the same as safe. What name it was compiled under : (Get-Item "C:\Windows\System32\suspect.exe").VersionInfo | Select-Object OriginalFilename,CompanyName,FileDescription A binary keeps the OriginalFilename it was built with, so a plain rename announces itself where hashing can't see one. The field is attacker controlled though, so it only means something read next to the signature. Unsigned plus "Microsoft Corporation" is loud. Expect noise, roughly 4% of a clean System32 mismatches because Microsoft ships typos and abbreviations. Part of the protected OS set (needs elevation): sfc /verifyfile=C:\Windows\System32\suspect.exe Downloaded rather than shipped : Get-Item "C:\Windows\System32\suspect.exe" -Stream * A Zone.Identifier stream on a system binary is close to conclusive. Timestamps against its neighbours : Get-Item "C:\Windows\System32\suspect.exe" | Select-Object CreationTime,LastWriteTime Timestomping is trivial, so matching timestamps prove nothing while mismatched ones prove a lot. If it's running : Get-CimInstance Win32_Process -Filter "Name='suspect.exe'" | Select-Object ProcessId,ParentProcessId,ExecutablePath,CommandLine Get-NetTCPConnection -OwningProcess <PID> Hashes, and public datasets you can query yourself : Get-FileHash -Path "C:\Windows\System32\suspect.exe" -Algorithm SHA256 Get-FileHash -Path "C:\Windows\System32\suspect.exe" -Algorithm SHA1 winbindex.m417z.com indexes what Microsoft actually shipped. A system binary's name carrying a hash Microsoft never shipped is the clearest signal you'll get. CIRCL hashlookup wraps NSRL and friends, no API key: Invoke-RestMethod "https://hashlookup.circl.lu/lookup/sha1/<sha1>" Query by SHA1, not SHA256. Classic NSRL records carry MD5 and SHA1 only, so SHA256 can't reach them. Coverage skews old, so it's more useful on legacy boxes than a patched 2022 server. One caveat before looking anything up. Submitting a hash is itself a disclosure, and a first ever lookup tells whoever built it that you're looking. What would you add? Genuinely interested in what people check that isn't in here, most of this list came from someone else's answer to the same question ;) submitted by /u/Haunting_Ganache_850 to r/sysadmin [link] [comments]

On the heels of an epic outage, Securence is getting out of their email, web and other cloud online services businesses, with a drop-dead date of November 11, 2026. Feel free to share your comments. Here is the content of an email I received today: First, thank you for your loyalty to US Internet. As you know, USI joined the Metronet family last year. As part of this transition, we are simplifying our product portfolio to focus on delivering fiber internet, voice and network connectivity solutions. We are writing to give you advance notice that the following USI products and services will be retired after Wednesday, November 11, 2026. All Securence services, including: - Standard Email/POP/IMAP Email - Hosted Exchange Mail - Email Filtering (Incoming, Outgoing, Mail Continuity, Archiving and Cyphermail). Hosting services: - Web Hosting - SSL Certificate Services - Domain Registration - DNS Hosting - Managed Database Services VM services: - Backup Storage - VMware Server Hosting Data center network services: - Managed Firewall Email Addresses: - u/usinternet .com - u/usiwireless .com Affected services will remain available through Wednesday, November 11, 2026.Your account uses one or more of these services, and you must transition to another provider before that date to avoid a service interruption or loss of data. Migration instructions and additional resources are available at securence.com/migratefor Securence products or at usinternet.com/migratefor all other services. We recognize this change may affect your day-to-day operations and apologize for any disruption. We are providing advance notice to allow sufficient time to plan and complete your transition, and we remain committed to assisting you throughout the process. You have been a valued customer, and we thank you for many years of service. If you have technical questions or need support, please email us at [ [email protected] or](mailto: [email protected] ) call (952) 253-3290. submitted by /u/MorseScience to r/sysadmin [link] [comments]

RDST (Readyset Diagnostic & SQL Toolkit) is a free desktop app that connects to your RDS or Aurora instances and tells you which queries are driving the load you are paying for. The reason I built it is that Performance Insights is decent at telling you there is load, but going from "there is load" to "here is the query, here is why it is slow, and here is whether fixing it lets me drop an instance class" is still a repetitive manual process: open Performance Insights and find the top SQL by load copy the digest out and go run EXPLAIN ANALYZE against the instance yourself go find the table definitions and check whether the statistics are current work out whether the index you have in mind already exists check max_connections, to see if this is what’s actually biting during the spike go back to the pricing page and work out whether any of this justifies the instance class you are on do it again for the next instance That last step is where the money is. Fix one query dominating CPU and you can often downsize, which on a large instance is hundreds/thousands per month. Full disclosure - I work for Readyset (which is a caching layer for postgres / mysql), and this tool spawned from a recurring question our caching customers kept asking - which queries should we actually cache? And these same queries are the ones that, even without a caching solution, could heavily benefit from performance diagnostics. It runs locally using credentials you already have, SSO or a named profile. Nothing gets installed on the instance and there is no cross-account role to create. It discovers your Aurora clusters and RDS instances, audits all of them, saves query snapshots so you can track regressions over time, and even allows you to ask plain english questions about any / all of your nodes and their queries. The health check feature gives you a sizing verdict with your current monthly cost and a suggested instance class, so making the decision to downsize/upsize should become very clear. The reason this is worth doing: the instance in that report is an Aurora db.r6g.4xlarge running about $1,180 a month on demand. Three unindexed access paths account for roughly 66% of its total database time, and those are what the CPU peaks are made of. With those three indexes in place the audit puts the same workload on a db.r6g.xlarge at about $295. That is $885 a month, a little over $10,600 a year, for what amounts to an afternoon of work. The tool is completely free to use, and we provide free trial tokens for all of the AI powered features. The app is in beta and we plan to release it under an MIT license. It runs locally, stores locally and everything it does is read-only. Full privacy related details: https://readyset.io/docs/readyset-ai/rdst/desktop/privacy Would love feedback from people running Postgres or MySQL on RDS, particularly: Does the sizing verdict line up with what you'd have concluded from Performance Insights? Does it surface the queries you'd investigate first? Would you be comfortable pointing it at a production instance? If not, what would stop you? What's missing? Source: https://readyset.io/docs/readyset-ai/rdst/desktop https://github.com/readysettech/rdst submitted by /u/Frone0910 to r/aws [link] [comments]

Hi everyone, I'm hoping someone with Google Workspace or Google Cloud Billing experience can help me understand this situation. For the past few weeks, I've been receiving collection emails from ABC-Amega (American Bureau of Collections) claiming that I owe Google Workspace approximately INR 1.47 million. The emails contain: Customer: ApexZen - Dhruv Kanziya Collection File: 3531039 Domain: apexzen.store The email says my Google Workspace account has been placed into collections. The problem is: • I have never intentionally purchased or owned apexzen.store. • WHOIS shows the domain was registered on 11 January 2026 through Namecheap. • The domain currently appears offline. • Google Admin recovery recognizes [ [email protected] ](mailto: [email protected] ) as a Workspace account, but I do not know the password. • The recovery Gmail shown by Google is NOT mine. • I cannot recover the account. • I cannot access the Admin Console. • Google Cloud Billing shows I am not an administrator of any billing account. • Google Payments shows no Workspace billing profile. • I have never seen any invoices or billing history related to this account. Another thing I noticed: The collection email tells me to: "Select the account ID mentioned above" However, the email does not include any Google Workspace Customer ID, Billing Account ID, Payments Profile ID, Invoice Number, or Admin Email. The only identifiers in the email are: Customer: ApexZen - Dhruv Kanziya File: 3531039 I have already disputed the debt with ABC-Amega and requested debt validation. My questions are: Has anyone seen Google Workspace collection emails that do NOT include Billing IDs or Customer IDs? Can someone accidentally add unrelated Gmail addresses as billing or notification contacts? Could this be a Google Workspace identity mix-up? What evidence should I request from Google or ABC-Amega to prove whether this account actually belongs to me? I'm attaching screenshots of: - the collection email - WHOIS information - Google Admin recovery - Google Cloud Billing - Google Payments Any advice from Workspace admins or Google Cloud experts would be greatly appreciated. Thank you. https://preview.redd.it/jz3gxpvb4shh1.png?width=1917&format=png&auto=webp&s=c34f77b1516b8ede1e5c385b8a1a7ffaf205c8d4 https://preview.redd.it/1f3xe0da4shh1.png?width=792&format=png&auto=webp&s=71b85ee0abeb80f9d5cfa44ce27ea6b77eda2d6a https://preview.redd.it/bki0ymr84shh1.png?width=955&format=png&auto=webp&s=74d33b34940e91bf935593585c31da8e36c8b551 https://preview.redd.it/n5xb1vb54shh1.png?width=1813&format=png&auto=webp&s=5c1d0f0d62d98e06a5f4f638df4c0e7a83011e24 https://preview.redd.it/2121wqhy3shh1.png?width=1917&format=png&auto=webp&s=318d3a6651e5e8912e31e01279141aadc583ddb5 submitted by /u/Inside-Phone-623 to r/googlecloud [link] [comments]

Hi and Thank you for reading this. I came into finance sideways. I started in technical support at a SaaS company and gradually became the person handling billing technical escalations: Stripe API integration issues (subscriptions, stripe Connect). That turned into owning bigger pieces, like enabling (using stripe features) revenue teams with some initiatives that didn’t have support on the backend yet. That work got me promoted into what we call a “FinOps” role, and the team wants me as the person driving new initiatives in finance operations. Right now the work is mostly reactive: resolving billing issues, scripting repetitive tasks, and using AI agents where it actually makes sense. There are some projects around ai but nothing related to cloud architecture. Reading this community, I’ve realized my role doesn’t map to what most professionals mean by FinOps. I’m not trying to claim the FinOps title, since I have no DevOps background. But I’d like to hear opinions on how to develop in my current role and what directions are logical. I’d really appreciate any thoughts on this. Thank you. submitted by /u/Responsible_Put_2876 to r/FinOps [link] [comments]

I’m coming back to SF Sept. 4 for a somewhat ridiculous experiment. I’m helping a small technology company get its services/platform/hardware packaged for AWS Marketplace, and instead of sitting at home in San Diego trying to figure everything out through documentation, I want to see how much progress I can make in one week by actually meeting people in the Bay Area. My goals: • understand the fastest realistic Marketplace path • meet people who have actually launched AWS Marketplace offers • find AWS/channel/enterprise sales people willing to share advice • attend relevant cloud, infrastructure and startup events • develop a repeatable launch checklist I can publish afterward • hopefully come out of the week with actual customer opportunities I’ll post an update afterward with what worked, what didn’t, costs, events, contacts/resources people recommended, and what I learned about getting a small company into the AWS ecosystem. If you know someone I should meet, an event I should attend, a founder gathering, AWS person, cloud consultant, MSP, reseller, or enterprise infrastructure person, I’d love an introduction. I’m also doing this on a pretty lean budget, so if anyone wants to contribute a coffee, BART fare, lunch, event ticket, workspace, spare room, or otherwise sponsor part of the experiment, I won’t turn it down. But introductions and information are genuinely more valuable to me than money. I’ll keep a running tally of what Reddit contributed and what came out of it. A few people have asked me previously how they can contribute directly, so I can provide my Venmo by DM. Mike 707-267-1768 submitted by /u/ahahabbak to r/aws [link] [comments]

I got a call from one of our rural customers at this MSP and their coaxial internet was down again. They lose like $1000+ an hour if they're down so they told me they called Verizon, their business cell provider, and asked if they had something. I assume a salesman mentioned it in the past. After one phone call where I said "our networking guy is out today but I'm pretty sure you can plug just about anything into the WAN port on the Fortigate and it'll work" they called back an hour later saying they got an a XC46BE. I've never even heard of that family of devices so I thought this is gonna be a shit day. Luckily for my non-networking specialist self, was easier to set up than a 54g linksys in 2002. Basically it just jumps on and spits out wifi and ethernet. I ran a test on my non-verizon smartphone and got 16mbps to the tower. Then I hooked my laptop up to the device and got 220x40 so fuck net neutrality I guess. It even has a battery and their switches had UPSes so that's a bit interesting. I slapped it into the Fortigate and tada, everyone's back online...with about 10mbps and 500ms ping time. I assumed all their Outlooks were syncing at once or something but they told her the device can do about 20 people. They have about 10 highly active computers. Pretty unimpressive for $350! But they intended to return it when the outage was fixed and their rep said that was fine. The very millisecond I walked out the door, the ISP truck showed up and started messing with the box on the front lawn. Awesome use of my time. But I keep hearing about these magical devices that can switch over to 5G and we do have WAN1 and WAN2 on the Fortigate so they're considering keeping it and programming in a switchover of some sort. I assume they do that. Anyone have one that doesn't suck? Because this one impressed me until it was actually in use. I saw one at a trade show years ago that was a UPS + 5G modem. That sounded kinda neat but so did this Verizon device until it performed poorly. submitted by /u/CeC-P to r/sysadmin [link] [comments]

I've had multiple computers in our network failing every single Intune install immediately. Like, it fails to even download. The devices are obviously connected to the network, as they are getting an Intune sync (when sent from the Intune portal or requested via Company Portal) but then continuous notifications about apps failing. My gut is telling me that there is some kind of malware that is somehow allowing the Intune sync to go through, but blocking the download traffic. I know it's not a network issue, because it's only certain computers doing this, and even at the same physical site some are fine while others are broken. And the computers can get out to the web, it seems to be just certain traffic, like this, that is not going through. The IntuneManagementExtension.log has this: [Win32App][Win32AppDownloadExecutor] Execution completed with action status: Failed, enforcement state: InProgressPendingManagedInstaller, error code: , and download running in background: False. ... [SendWebRequestInternal] Sending network request... Current proxy is https://agents.msua06.manage.microsoft.com/TrafficGateway/TrafficRoutingService/SideCar/StatelessSideCarGatewayService/SideCarGatewaySessions('955b27ad-37ba-4622-9b92-00a8f01e1737')%3Fapi-version=1.6 [SendWebRequestInternal] Succeeded, client-request-id: 5d90a1b0-f063-40b3-ab88-d9b2d17847eb, AfdRef: Found 1 MDM certificates from Local Computer Store. [Win32App][Win32AppDownloadExecutor] Execution completed with action status: Failed, enforcement state: InProgressPendingManagedInstaller, error code: , and download running in background: False. Checking throttle setting Successfully updated throttling info. workload AgentCheckIn, currentCnt = 5 Finish throttle checking. It's weird that the error code is just empty. And that line is just continuously there, appearing about every 2-3 seconds as it continues to try to pull more apps. Any ideas on how I can troubleshoot this? submitted by /u/havens1515 to r/sysadmin [link] [comments]

Today we had 3 AVD multisession hosts that went through the Live Migration process at different times of the day (just learned about this today so go easy on me) - https://learn.microsoft.com/en-us/azure/virtual-machines/maintenance-and-updates#live-migration I don't see any errors of the live migration failing, as its showing succeed, but my users are getting kicked off then unable to connect. The error I see when a user tries to connect is: ConnectionFailedUserHasValidSessionButRdshIsUnhealthy So I checked the host and its in a stuck/updating state. PS C:\Users\bob> (Get-AzVM -ResourceGroupName $rg -Name $hostname -Status).VMAgent.Statuses Code : ProvisioningState/Unavailable Level : Warning DisplayStatus : Not Ready Message : VM Agent is unresponsive. Time : 8/4/2026 9:51:20 PM And PS C:\Users\bob> (Get-AzVM -ResourceGroupName $rg -Name $hostname -Status).Statuses | ft Code,DisplayStatus -Auto Code | DisplayStatus ProvisioningState/updating | Updating PowerState/running | VM running Host information: West-US 2 E8s_v6 Windows 11 multisession NERDIO managed I tried connecting through NERDIO Console Connect, RDP IP and Hostname, and then tried running Azure Run Commands, all failed. Was trying to get in to try and fix the agent by restarting it or reinstalling in hopes to fix it. I put the host in Drain Mode, but users were still getting directed to that host if they had a session already there (according to google that's intended). So my only fix was to restart the hosts. Looking for ideas on how to prevent this and or a simple fix when it happens. submitted by /u/SendMe_YourPasswords to r/AZURE [link] [comments]

Single Proxmox host today, budget approved to grow to two nodes. A proper Dell/HPE storage array is far out of reach at this budget — but a business-class NAS is not, and that's exactly my question: **would a business NAS actually be enough for us, or am I fooling myself?** Small manufacturing company, ~50 workstations, I'm the only IT person. ## Current host Lenovo ThinkSystem SR650 - 1× Xeon Silver 4210R (10c/20t). Second socket empty. - 32 GB RAM in a single DIMM. 23 slots free. - VM datastore: RAID1 of 2× 2.4TB 10K SAS HDD → 2.2 TB, **94% full**. - Boot/local: RAID1 of 2× 960GB SATA SSD → 893 GiB, ~30% used. - ThinkSystem RAID 730-8i (hardware RAID, no proper JBOD passthrough). - Intel X722 LOM, 4 ports. No 10GbE add-in card, but free PCIe slot. - Core switch is 48-port gigabit with 10G SFP+ uplinks available. - Proxmox VE 8.4.14. ## Workload | Role | vCPU | RAM | |---|---|---| | AD DS + DNS | 4 | 12 GB | | Zabbix + Grafana (LXC) | 4 | 4 GB | | Internal web app | 4 | 2 GB | | Quoting web app | 2 | 4 GB | | UniFi controller | 2 | 2 GB | | GLPI (Docker) | 2 | 2 GB | | API gateway | 1 | 2 GB | **Allocated: 19 of 20 vCPU, 28 of 32 GB RAM.** **Actually used: under 5% CPU, ~17 GB RAM.** A second DC and the SIEM live outside this host. **Veeam runs on its own separate machine and backups also land offsite**, so backup does not depend on this host or on whatever storage we buy. **Coming soon:** internal ERP — web app plus a **MySQL** database. --- ## Option 1 — Two full nodes, local storage, ZFS replication - **New node:** better CPU than current, max 16 cores, 64 GB RAM, 2× 960GB SSD + 3× 3.2TB SAS for capacity. - **Current node:** RAM upgrade, HBA to replace hardware RAID. - ZFS both sides, 10GbE direct link, external QDevice, async replication (~15 min). Two independent copies of the data. Local disk latency. But async replication means up to 15 minutes lost on failover, and I have to swap the RAID controller for an HBA on the existing box. ## Option 2 — Business NAS as shared storage + thin node - **New node:** 2× SSD purely for Proxmox itself, no VM storage. Budget goes into RAM instead of disks. - **Current node:** RAM 32 → 64 GB. Keep the existing controller — **no HBA swap, no ZFS to design.** - **Business-class NAS** holds all VM disks, 10GbE to both nodes. Both nodes mount shared storage → live migration and HA with no RPO gap. Clears the 94% problem on day one. Simpler to build. But one NAS, one controller, and if it dies the whole virtual environment is down until a replacement arrives. ## Budget Up to **R$100,000 ≈ US$19,400** total, covering the new node and either the disks or the NAS. This is Brazil — import duties and local margins mean enterprise hardware here lands well above US list, so that number buys maybe half of what it would in the US. --- ## Questions **The main one: is a business-class NAS genuinely adequate as primary storage here?** Our VMs currently run off two 10K spinning disks in RAID1, so almost anything is an improvement on paper. But "business NAS" covers everything from a 4-bay desktop box to a rackmount unit with redundant PSUs and all-flash. What tier do I need to insist on, and what specs are non-negotiable? **MySQL over the network.** Is a small ERP database the workload where NAS-backed storage falls apart, or is that overblown at this scale? Would you keep the DB on the node's local SSD even in Option 2? **iSCSI + LVM-thin or NFS + qcow2?** iSCSI performs better but I lose snapshots; NFS keeps snapshots but adds latency. Which are you running in production and what do you regret? **Option 2 lets me skip the HBA swap and skip designing ZFS entirely.** Is that a real advantage, or am I trading a solved problem for a worse one? **In Option 1, is 3× SAS HDD sane for a VM datastore in 2026,** or should the whole VM pool be SSD and the spinning disks reserved for documents and archives? **Given the budget and this workload, which would you build?** We already have Veeam on a separate machine with offsite copies, so the question is less about losing data and more about how long we'd be down. Happy to answer questions about the workload. submitted by /u/gianheller to r/sysadmin [link] [comments]

Did a cleanup pass this month after the bill crept up again and it was grim. Over 1k a month going to stuff nothing was using. The usual suspects are unattached EBS volumes from instances we killed months ago, a pile of snapshots from nonexistent volumes, NAT gateways 3 of them just idle in a dev account at 32 bucks a month each and a couple of load balancers with no targets. There was also an elastic IP quietly billing by the hr since AWS started charging for those. Worse than last year, a chunk of it traced back to our own agents. Devs run coding agents that spin up test infra to try something and the agent never tears it down, teardown isn't in the happy path. So every abandoned experiment leaves a little orphaned tail nobody's watching because it's 20 bucks here and forty there til a year of it adds up. Tagging would catch some of this which of course it isn't and the untagged stuff is the orphaned stuff because it got made in a hurry. Cost Explorer shows me the number, never the owner. This is the boring waste that never trips an alarm, it just quietly rents space in your bill forever. submitted by /u/Chris-Hart_232 to r/aws [link] [comments]

A rollback is straightforward when one release causes one clear regression and the previous version is known-good. It is less obvious when metrics disagree, data migrations are irreversible, an external dependency is failing, queues contain mixed-version work, or the rollback itself would create a second outage. What conditions should move remediation from automatic to human-approved? A useful policy might combine error-budget burn, confidence that the release caused the change, reversibility, data compatibility, blast radius, time since deployment, and whether the previous version still satisfies current contracts. How do you encode an explicit unknown state so automation can contain harm without pretending it knows which version is safe? submitted by /u/RocketSeven to r/devops [link] [comments]

I’m trying to understand the best way to investigate a sudden increase in Azure spending. Beyond Azure Cost Management alerts, what tools or practices do you use to identify which resources or workloads are responsible for unexpected cost changes? I’m particularly interested in approaches that work well in environments with multiple subscriptions and resource groups. submitted by /u/DianeAtkinson to r/AZURE [link] [comments]

Everyone has been waiting for the Azure price increase tied to the memory shortage. My two cents: it's already here. Normally a generational compute update — v1 through to v5 — costs the same per hour and gives you a performance bump - free of charge.. It also helps Microsoft exit their old End Of Life hardware. Everybody wins. You move v2 to v3 on a 16 vCPU box and the rate is more or less identical, right the way up to v5. That's over. From v6 onwards there's a fundamental shift. The generational upgrade is no longer free. v1 to v5: same price. v6: roughly +10%. v7: roughly +35%. Read that again, because it changes how you have to think about your estate. EOL now exists in the cloud. Not as a migration exercise — as a cost event. Previously, hardware retirement was Microsoft's problem. They wanted you off the old fleet, so they made the move painless and you got free performance out of it. Now the retirement notice comes with a bill attached, and you have no route to decline it. Sub-v5 capacity is already constrained. Once the capacity pressure tightens further, "stay where you are" stops being an option. So combine three things: → Generational moves are now priced increases, not neutral swaps → Capacity constraints on older SKUs push you up the generations whether you budgeted for it or not → Nobody's three-year plan has a compounding uplift modelled into it That's a ticking time bomb. Your Azure VMs are now going to get generationally more expensive by default. Not because anyone announced a price rise — because the escalator only goes one way and you're standing on it. submitted by /u/AcceptablePicture329 to r/AZURE [link] [comments]

Wondering if anyone else is experiencing a slowdown with Firestore query in the last few weeks, which has really started to tick up in the last few days for us. We’re seeing recurring waves of timeouts across multiple unrelated Google Cloud projects and I’m trying to figure out whether anyone else is seeing something similar. Setup: - Firebase Functions Gen 2 / Cloud Run - Node.js Admin SDK - Firestore Native mode - Region: us-central1 - Multiple separate projects affected - Request timeout varies by service, usually 30s or 60s (depending on the function timeout we've set) During a wave, unrelated HTTP routes start returning 504s that approach the function's configured timeout (e.g. 29.997s for a 30s timeout). The failed requests are not tied to one endpoint or one query shape. Logs show Firestore operations continuing after the Cloud Run request has already timed out. Examples from one incident: - `devices.read` direct document read: 116,019ms - `leads.read` direct document read: 57,487ms - `postalCodes.read` direct document read: 33,093ms - `cache.list limit=1`: 61,590ms - `preferences.read` direct document read: 36,324ms - `leads.list limit=500`: 79,723ms The `postalCodes.read` example is especially confusing because that document is tiny. But honestly all of these documents are a few kb at the most. So this doesn’t look like just a large document, missing index, or bad query issue. Other observations: - Failures often cluster on one Cloud Run instance/revision instance ID. - Other instances may continue serving traffic normally. - The request hits the Cloud Run timeout, but the Firestore operation later logs completion. - We’ve seen this on three separate projects. - We’ve reduced external API calls and removed some broad Firestore scans, but the issue still recurs. - We briefly tried `preferRest: true`; it may have helped temporarily but did not clearly eliminate the issue. Has anyone else seen Firestore Admin SDK calls intermittently hang like this from Cloud Run / Firebase Functions Gen 2? Is there a known issue with Firestore gRPC/transport connections getting unhealthy per instance? Are there recommended client-side mitigations besides lowering concurrency, recycling instances, or reducing reads (i.e. increasing cache usage)? Is there a good way to prove this is client transport/backend behavior versus application query pressure? I'm trying to understand whether this is a known pattern and what people have done to debug or mitigate it. submitted by /u/ehed to r/googlecloud [link] [comments]

The Paradigm Shift in Enterprise Attack Surfaces The integration of autonomous artificial intelligence agents and dynamic execution layers into enterprise software has fundamentally altered the modern corporate attack surface. When an organization deploys an AI platform capable of generating and executing code on the fly, it effectively introduces an internal multi-tenant execution environment within its perimeter. The security of this architecture relies entirely on the absolute integrity of the boundary separating untrusted, AI-generated code from the underlying host operating system. When this boundary fails, the consequences are immediate: remote code execution (RCE) with the privileges of the orchestration service. I observe that security teams frequently treat AI platforms as standard web applications, focusing their defense-in-depth strategies on traditional web vulnerabilities like SQL injection or Cross-Site Scripting (XSS). However, the deployment of LLM-driven code interpreters introduces a fundamentally different threat model. In this paradigm, the application is designed to execute arbitrary code by design. The primary security control is no longer input sanitization alone, but robust, low-level virtualization and process isolation. In this analysis, I examine the structural mechanics of sandbox escape vulnerabilities within enterprise AI platforms, using the architectural patterns of CVE-2026-6875 as a reference model. I will dissect how these boundaries are bypassed, evaluate the operational trade-offs of various isolation technologies, and provide a concrete blueprint for hardening your runtime infrastructure. My objective is to move beyond superficial patching advice and equip engineering leaders with the technical depth required to design resilient execution environments. An in-depth technical analysis of CVE-2026-6875, a critical CVSS 9.5 sandbox escape vulnerability in the ServiceNow AI Platform under active exploitation. Learn the mechanics of AI execution layer esc 🤖 Architectural Analysis of AI Execution Layers To understand how a sandbox escape occurs, one must first analyze the typical architecture of an enterprise AI execution engine. These systems generally consist of three primary components: the orchestration layer, the communication bridge, and the isolated guest runtime. The Orchestration Layer This component runs on the host system, often with high privileges. It interfaces with the broader enterprise application, manages user sessions, and coordinates with the LLM. When the LLM determines that a task requires code execution (such as data analysis, mathematical computation, or file parsing), the orchestration layer receives the generated code block and prepares the execution environment. The Communication Bridge Because the host must pass code into the sandbox and retrieve the execution output, a communication channel must exist. This is typically implemented via Unix domain sockets, local loopback TCP connections, or shared memory segments. A daemon running inside the sandbox listens on this channel, receives the code, executes it via a local interpreter (such as Python or Node.js), and returns the stdout, stderr, and generated files. The Isolated Guest Runtime This is the sandbox itself. In many standard deployments, this is a lightweight container managed by runc, Docker, or containerd. The isolation relies on standard Linux kernel features: namespaces (to isolate processes, network interfaces, mount points, and IPC), control groups (cgroups, to limit CPU, memory, and I/O), and seccomp filters (to restrict available system calls). I must emphasize that this architecture contains an inherent structural tension. The AI agent requires access to libraries, packages, and sometimes external APIs to perform useful work. However, every capability granted to the guest runtime increases the available attack surface. If the guest runtime shares the host operating system's kernel—as is the case with standard containerization—any vulnerability in the kernel's system call interface or any misconfiguration in the orchestration layer can be leveraged to escape the container. Deconstructing the Escape Mechanics My analysis of sandbox escapes reveals that failures rarely occur within the isolated guest runtime itself. Instead, the breakdown typically occurs at the interface between the host and the guest, or through the exploitation of shared kernel resources. I have categorized the primary escape vectors into four distinct operational patterns. 1. Kernel Interface Exploitation and Shared Syscalls When standard containers are used for sandboxing, the guest processes execute directly on the host kernel. If an attacker can execute arbitrary code inside the guest, they can interact directly with the host kernel via system calls. If a local privilege escalation (LPE) vulnerability exists in the host kernel (for example, in memory management or network namespaces), the attacker can exploit it from within the container to gain root privileges on the host, subsequently breaking out of the container namespaces. 2. Orchestration Agent Command Injection This is a common vulnerability pattern in custom-built AI platforms. The orchestration layer on the host often uses command-line utilities to manage the lifecycle of the sandbox (e.g., spawning containers via docker run or executing commands inside them via docker exec ). If the orchestration layer fails to properly sanitize parameters passed to these commands—such as environment variables, volume mount paths, or container names—an attacker can inject shell metacharacters. This results in command execution on the host system, completely bypassing the sandbox. 3. Socket and IPC Hijacking To monitor container health or manage files, developers sometimes mount the host's container runtime socket (such as /var/run/docker.sock ) inside the sandbox. This is an architectural anti-pattern of the highest severity. If an attacker gains code execution inside a sandbox with access to this socket, they can issue API commands to the host's container daemon to spawn a new container. This new container can be configured with host namespaces, host network access, and the host's root directory mounted as a volume, yielding immediate and total control over the host system. 4. Path Traversal and Shared Volume Manipulation To facilitate file input and output, the host must share a directory with the sandbox. This is typically achieved via bind mounts. If the host-side application processes files written to this shared directory without rigorous validation, several vulnerabilities can emerge. For example, if the guest runtime creates a symbolic link pointing to a sensitive host file (such as /etc/shadow or /root/.ssh/authorized_keys ) within the shared directory, and the host application reads or writes to that link without verifying that it resolves within the allowed boundary, the host will inadvertently read or overwrite its own system files. Operational Trade-offs of Isolation Technologies When designing a remediation strategy, engineering leaders must choose an isolation technology that balances security, performance, and operational complexity. I have evaluated the three primary paradigms currently used in production environments. Standard Containers (runc / Docker / Kubernetes) Mechanism: OS-level virtualization sharing the host kernel, isolated via namespaces and cgroups. Security Posture: Low. The shared kernel design means any kernel vulnerability can lead to a complete host compromise. It is highly susceptible to configuration drift and misconfigurations. Performance: Excellent. Near-zero virtualization overhead; sub-second startup times. Operational Complexity: Low. Standard tooling and deep ecosystem integration. User-Space Kernels (gVisor) Mechanism: A runc-compatible container runtime that intercepts system calls from the guest application and filters them through a user-space kernel (written in Go) before passing a limited subset to the host kernel. Security Posture: Medium-High. It drastically reduces the host kernel attack surface by blocking direct system calls. Even if a guest process attempts to exploit a kernel vulnerability, the system call is intercepted and handled safely in user space. Performance: Moderate. The system call interception introduces latency, which can impact I/O-heavy or system-call-intensive workloads. Operational Complexity: Moderate. It integrates with existing container orchestrators like Kubernetes but requires specific runtime class configurations. My Recommendation: I recommend gVisor as an excellent compromise for organizations with existing Kubernetes infrastructure that cannot easily transition to hardware virtualization. MicroVMs (AWS Firecracker / Kata Containers) Mechanism: Hardware-assisted virtualization using the Linux Kernel-based Virtual Machine (KVM) hypervisor to launch extremely lightweight, minimalist virtual machines with their own dedicated kernels. Security Posture: High. The boundary is enforced at the hardware level. A sandbox escape requires exploiting the hypervisor itself, which is a significantly smaller and more secure interface than the Linux kernel system call interface. Performance: High. Startup times are measured in milliseconds (typically under 100ms), and memory overhead is minimal compared to traditional virtual machines. Operational Complexity: High. Requires bare-metal instances or nested virtualization support in cloud environments. It also requires specialized orchestration tooling. My Recommendation: For dedicated AI execution engines handling highly untrusted code, I consider microVMs to be the gold standard. The security benefits far outweigh the initial setup complexity. ⚙️ Implementation: A Secure Execution Wrapper To illustrate the practical application of these hardening principles, I have designed a robust Python execution wrapper. This implementation demonstrates how to enforce strict resource constraints, drop privileges, and isolate execution using standard Linux system controls before running untrusted code. I must emphasize that while this wrapper significantly hardens standard process execution, it should be deployed inside an isolated container or microVM to achieve true defense-in-depth. import os import sys import pwd import grp import resource import subprocess import tempfile import shutil from pathlib import Path def enforce_sandbox_limits(uid: int, gid: int, max_cpu_seconds: int = 5, max_memory_bytes: int = 128 * 1024 * 1024): """ Configures process limits and drops privileges to an unprivileged user. This function must run in the child process before executing untrusted code. """ # 1. Establish strict resource limits (cgroups equivalent at process level) # Limit CPU time to prevent infinite loops and denial of service resource.setrlimit(resource.RLIMIT_CPU, (max_cpu_seconds, max_cpu_seconds)) # Limit virtual memory allocation to prevent memory exhaustion resource.setrlimit(resource.RLIMIT_AS, (max_memory_bytes, max_memory_bytes)) # Limit file creation size to prevent disk filling resource.setrlimit(resource.RLIMIT_FSIZE, (1024 * 1024, 1024 * 1024)) # 1 MB # Limit number of processes to prevent fork bombs resource.setrlimit(resource.RLIMIT_NPROC, (20, 20)) # Disable core dumps to prevent sensitive data leakage resource.setrlimit(resource.RLIMIT_CORE, (0, 0)) # 2. Drop privileges to the designated unprivileged user try: os.setgroups([]) # Clear supplementary groups os.setgid(gid) os.setuid(uid) # Ensure we cannot regain root privileges os.environ["USER"] = pwd.getpwuid(uid).pw_name os.environ["HOME"] = pwd.getpwuid(uid).pw_dir except Exception as e: sys.stderr.write(f"[FATAL] Failed to drop privileges: {str(e)}\n") sys.exit(1) def execute_untrusted_code(code_payload: str, sandbox_user: str = "sandbox_worker") -> dict: """ Executes untrusted Python code within a restricted, temporary directory under an unprivileged system account with strict resource constraints. """ # Resolve the unprivileged user credentials try: user_info = pwd.getpwnam(sandbox_user) uid = user_info.pw_uid gid = user_info.pw_gid except KeyError: return { "success": False, "error": f"System user '{sandbox_user}' does not exist. Aborting for safety." } # Create an isolated temporary directory for execution temp_dir = tempfile.mkdtemp(prefix="ai_sandbox_") temp_path = Path(temp_dir) script_path = temp_path / "payload.py" try: # Write the payload to the temporary directory script_path.write_text(code_payload, encoding="utf-8") # Adjust ownership of the directory and file to the unprivileged user os.chown(temp_dir, uid, gid) os.chown(str(script_path), uid, gid) # Restrict permissions: only the owner can read/write/execute os.chmod(temp_dir, 0o700) os.chmod(str(script_path), 0o500) # Read and execute only for the worker # Execute the untrusted script in a isolated subprocess process = subprocess.run( [sys.executable, str(script_path)], preexec_fn=lambda: enforce_sandbox_limits(uid, gid), capture_output=True, text=True, timeout=10, # Hard wall-clock timeout cwd=temp_dir ) return { "success": True, "return_code": process.returncode, "stdout": process.stdout, "stderr": process.stderr } except subprocess.TimeoutExpired as e: return { "success": False, "error": f"Execution exceeded maximum wall-clock time limit of {e.timeout} seconds.", "stdout": e.stdout.decode() if e.stdout else "", "stderr": e.stderr.decode() if e.stderr else "" } except Exception as e: return { "success": False, "error": f"Internal execution failure: {str(e)}" } finally: # Securely clean up the execution directory try: shutil.rmtree(temp_dir) except Exception as cleanup_error: sys.stderr.write(f"[ERROR] Failed to clean up sandbox directory {temp_dir}: {str(cleanup_error)}\n") Immediate Incident Response and Remediation Playbook If you are running enterprise AI platforms that execute dynamic code, you must assume that your systems are targeted. I recommend executing the following response protocol immediately to identify potential compromises and secure your infrastructure. Step 1: Asset Discovery and Mapping You must identify every instance of the AI execution engine within your environment. This includes production servers, development environments, staging environments, and any local testing instances. Attackers frequently target unmonitored staging environments to establish an initial foothold, then pivot laterally into production networks. 🔐 Step 2: Log Analysis and Threat Hunting Do not rely solely on automated alerts. I recommend performing a manual, structured audit of your system and application logs, looking back at least 90 days. Focus your investigation on the following indicators: Process Creation Logs: Audit your host operating system logs (such as auditd or Sysmon) for anomalous processes spawned by the AI service user. Look specifically for shells ( /bin/sh , /bin/bash , /bin/zsh ), network utilities ( curl , wget , nc , socat ), or compiler tools ( gcc , make ). Network Flow Logs: Analyze outbound connection records from your AI worker nodes. Any connection initiated by an AI worker to an external IP address—especially those not explicitly whitelisted—must be treated as highly suspicious. Pay close attention to connections targeting cloud metadata services (e.g., 169.254.169.254 ). File Integrity Monitoring: Check for modifications to critical system files, SSH configuration directories ( ~/.ssh/ ), cron jobs, or systemd service files on the host operating system running the AI platform. Step 3: Network Segmentation and Virtual Patching If an official patch cannot be applied immediately due to operational constraints, you must implement strict network segmentation. Isolate the AI execution hosts. Block all outbound internet access from these hosts, and restrict inbound traffic to authenticated, internal corporate networks. If the AI engine requires external data, route those requests through a secure, validating proxy server on the host. Long-Term Hardening Framework To move beyond reactive patching and build a truly resilient AI infrastructure, engineering teams must adopt a zero-trust model for code execution. I have compiled a structured checklist of critical controls that you should audit and implement immediately. Control Domain Security Requirement Implementation Verification Process Isolation AI execution runtimes must run under dedicated, non-root, unprivileged system accounts. Verify that the UID of the running process inside the container is not 0. Resource Constraints Hard limits must be enforced on CPU, memory, process count, and disk write sizes. Verify cgroup configurations and process limits ( ulimit ) on the host. Network Isolation Outbound network access from the sandbox to internal networks and cloud metadata APIs must be blocked. Attempt to curl 169.254.169.254 or an internal IP from within the sandbox; it must fail. Filesystem Security The root filesystem of the sandbox must be mounted as read-only. Attempt to write to /usr , /bin , or /etc from within the sandbox; it must fail. Boundary Validation All data passed between the host and the sandbox must be strictly validated against a schema. Ensure that the communication bridge does not accept raw shell commands or unvalidated file paths. Ephemeral Lifecycles Sandbox environments must be destroyed and recreated after every execution task. Verify that no state or files persist between separate execution requests. 🎯 Conclusion The emergence of sandbox escape vulnerabilities in enterprise AI platforms is a predictable consequence of the rapid integration of dynamic execution layers. When we design systems that allow models to write and execute code, we must abandon the assumption that the code is benign. We must design our architectures with the fundamental assumption that the sandbox will be compromised. By transitioning from shared-kernel container isolation to hardware-level microVM virtualization, enforcing strict system call filtering, dropping process privileges, and implementing zero-trust network policies, you can ensure that a sandbox escape remains an isolated event rather than an enterprise-wide catastrophe. Security must not be treated as a feature to be added later; it must be the architectural foundation upon which your AI infrastructure is built. 🔗 Originally published on ixuvo.com

&#x200B; I recently opened an AWS Support case regarding an unexpected billing issue. The case was created successfully, but its status is currently showing as “Unassigned.” Case number: 178740096600724 It has been 24 hr since I created the case. Has anyone experienced this before? How long did it take for your AWS Billing Support case to get assigned to an agent? I’m mainly looking to understand whether I should just wait or take any further action. Thanks! submitted by /u/Separate_Break8620 to r/FinOps [link] [comments]

I have 2 Standalone HPE Server where just Windows Server 2022 is running and unfortunately a bios update corrupted bios and made HPE Server unable to boot. This has unfortunately been caused by a power outage during planned maintenance bios update. So I ordered a CH341a programmer and flashed the stock bios from hpe to this mainboard. Both systems booted fine again however users couldn't connect to file shares of one of them anymore due to duplicated uuids and only one of the system can be in the ad domain at the same time. Also mac addresses are the same on both systems so I had to set a static one for one of them in device managers nic driver. Is there any way to fixx the broken bios update? submitted by /u/luky90 to r/sysadmin [link] [comments]