Emergency Patching of Nginx VM Scale Sets and Kubernetes Nodes for a Critical CVE

Thu, 14 May 2026 09:00:00 +0000

Critical CVE in Linux copy_file_range hit both Nginx VMs and AKS Linux nodes. Multiple scale sets, multiple clusters, spanning production, RC, test, and lab. Need to patch everything in the blast radius.

Production gets the formal process - change request, off-hours patching to minimize maintenance window impact. Lab and test can move faster. Scope was big, but having a clear map of what’s affected and what process each environment needs let us move fast where we could and be deliberate where it mattered.

Upgrading Nginx Across the Environment

Thu, 20 Mar 2025 09:00:00 +0000

Nginx upgrade across the board - one of those quiet maintenance projects that keeps you off end-of-life versions and away from CVEs. Nothing flashy, but necessary.

The interesting part was that Nginx licensing has shifted around over the years for different distributions and modules, so before pushing the upgrade out I had to sort out which license terms applied to what we were running. It’s a good reminder that even straightforward upgrade projects sometimes have compliance homework hiding inside them.

Nginx on GeekyRyan

Emergency Patching of Nginx VM Scale Sets and Kubernetes Nodes for a Critical CVE

Upgrading Nginx Across the Environment