Digital Plumber

Comprehensive deployment guide for ASPA, an RPKI mechanism to prevent BGP route leaks by encoding upstream provider relationships. ASPA objects are RPKI-signed and delivered via RTR version 2, catching route leaks and forged AS paths that ROV alone cannot detect—directly addressing the August 2026 Virtualizor BGP hijack where more-specific prefixes bypassed path validation. Two RIRs already support ASPA publication and open-source validators and daemons can consume them, though IETF standardization shows both ASPA documents and RTR v2 still in draft. The post clarifies that ASPA protects downstream networks from neighbors' mistakes, while RFC 9234's BGP role and OTC (Only to Customer) mechanism protects your own AS from leaking. Operators should deploy both complementary mechanisms.

Technical post addressing a common CDN challenge: naive byte-range caching wastes origin bandwidth when clients make small range requests (e.g., video thumbnails, PDF metadata). Cloudflare's solution rebuilds cache coordination in Pingora—their Rust proxy—to automatically batch many small origin requests into fewer, larger ones. Result is 50% p99 latency reduction on R2 object storage. Applicable to any reverse proxy or origin shield: coordinate dependency resolution upfront rather than serving every partial request independently. Particularly relevant for streaming, media delivery, and large-file use cases where clients generate fragmented range requests.

The incident affects six TLS intermediates and two code-signing intermediates. An independent researcher credited as 'Wayne' found that eight eMudhra P-384 keys were broken after running a test against the CCADB corpus of publicly trusted intermediate certificates on October 17, 2026. The weak keys sat undetected through two independent audit cycles for approximately 18 months until reported. The practical impact is severe: containers built before October 20 with bundled CA trust stores are still trusting eMudhra certs, and since containers do not automatically inherit host trust store updates, any containerized workload making outbound TLS connections to external services is potentially still within the attack surface. Chrome is removing the emSign ECC Root CA – G3 root on October 27, 2026, and that will break some legitimate certificates too. Network operations teams must audit all TLS inspection appliances, proxy configurations, and container image pipelines for bundled eMudhra roots and rebuild all images created before October 20.

The coordinated release addresses critical and high-severity vulnerabilities, including flaws found through AI-assisted security testing. Fortinet advised customers to address internet-facing devices first. Affected versions cover 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11, and 7.2.0–7.2.12, with availability for all updates on October 22. Additionally, FortiBleed is an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL virtual private network gateways, with more than 86,644 compromised devices verified across 194 countries. Network operations must schedule emergency maintenance immediately for October 22–23; teams should review logs for unusual administrator access and unauthorized configuration changes before and after patching.

Grafana Labs announced significant updates at ObservabilityCON 2026 on October 23 focused on agentic operations. The company released Agent Observability in general availability with native OpenTelemetry support, allowing teams to see what their AI agents do, what they cost, and whether their behavior holds up over time without requiring separate tooling. Assistant Watchers were also made generally available to automate operational response. Grafana also previewed Grafana Pages and Grafana Managed Sandboxes. The company released its 2026 State of Observability Report showing 68% of 300 IT/engineering leaders have moved AI for observability past investigation into pilots or production; however, confidence varies by task—85% comfortable with read-only investigation, only 52% for autonomous remediation. For infrastructure teams, this announcement is significant because it standardizes agent observability on OpenTelemetry, the CNCF standard already familiar to most SREs. It eliminates the need to bolt on separate AI-specific monitoring when agents become production workloads.

Dynatrace completed its acquisition of Arize AI in October 2026, expanding its application observability platform to cover AI model behavior and performance. Arize AI develops model evaluation, tracing, and observability technology that identifies AI application failures and monitors model behavior in production. This acquisition is strategically significant for network and infrastructure practitioners because it bridges a gap: traditional APM tools see network and application metrics, but lack visibility into the actual ML model performance that drives increasingly autonomous and AI-powered systems. By combining Dynatrace's infrastructure-layer observability with Arize's model-level tracing and evaluation capabilities, the integrated platform enables operators to correlate network/infrastructure issues with AI model degradation—critical when troubleshooting agentic workloads where failures may stem from either networking, application code, or model inference problems. For SREs and infrastructure engineers managing production AI systems, this represents a consolidation move toward unified observability stacks that span infrastructure through model performance.

Thompson previously led Socure as president and co-founded ID.me, with additional identity leadership roles at Capital One and IDEMIA. Co-founder Mickey Boodaei transitions to product development focus. The appointment aligns with Transmit Security's launch of Agentic Trust, extending its customer identity and access management capabilities to detect, investigate and control AI agents performing transactions on behalf of customers. This reflects an emerging operational challenge: as autonomous AI agents increasingly open accounts, transfer funds and complete purchases, identity platforms must distinguish legitimate agent activity from compromised credentials or fraud. The shift from human-only identity orchestration to agentic identity infrastructure represents a fundamental change in how financial institutions and merchants must architect trust controls.

Nokia's new capabilities improve radio performance, enable real-time intelligence at the edge, and extend governed AI agents across network operations. Nokia AI-native anyRAN software and NVIDIA accelerated computing turn the radio access network into a distributed platform for sensing, intelligence and real-time action. BT, Deutsche Telekom, Elisa and Orange provide growing evidence of AI-RAN progress among European operators. The platform integrates NVIDIA's inference optimization stack with Nokia's orchestration layer to run governed agents that can make autonomous decisions across RAN, core, and cloud domains while maintaining audit trails and human override capabilities. This moves beyond isolated RAN optimization into coordinated multi-domain automation, addressing the interoperability gap regarding cross-vendor agentic AI systems.

OpenTelemetry's governance committee formalized an exception to semantic versioning for security-critical changes. Previously, behavioral modifications required major version bumps; now stable SDKs and instrumentation libraries can ship security mitigations in minor or patch releases while maintaining public API stability. This addresses a real operational constraint: security fixes that modify behavior (e.g., connection validation, sanitization) previously forced teams into difficult choices between accepting risk on existing releases or undertaking major version migrations. The policy explicitly requires understanding security implications if temporary overrides are used, and mandates removal of such overrides. This matters for infrastructure practitioners running production observability stacks because it decouples security velocity from compatibility cycles, letting teams patch vulnerabilities quickly without the 12-18 month disruption typically associated with major version upgrades. The change applies across all OTel language SDKs and components reaching stable maturity.

Organizations are struggling to maintain control over AI agents as adoption spreads across disconnected tools and workflows. The monday.com 2026 AI report, published October 21, documents a fragmentation problem: although 96% of respondents use AI at work, only 29% said AI was fully integrated into a centralized operating system, while 57% reported using more software tools after adopting AI. The security and governance implications are concrete. 46% worried about losing control over AI agents' actions, while 52% were concerned about agents accessing data without sufficient restrictions. CDOs and their counterparts in security, IT and risk management need a shared view of how agents interact with enterprise data and systems as agentic AI deployments accelerate. This reflects the broader enterprise governance maturity gap: adoption is outpacing control infrastructure.

Asia's startup funding surge this week totaled $16.07 billion, with China dominating the biggest deals. DeepSeek's reported $15 billion funding round, backed by Tencent Holdings and Contemporary Amperex Technology Co. Ltd., represents a major capital injection for the Chinese AI company as competition intensifies in the global AI market. The funding is expected to support investment in AI data centers and development of open-source AI models as the company prepares for a potential initial public offering. This follows intensified U.S.-China geopolitical tensions and regulatory scrutiny around AI technology transfer. The scale of Chinese AI investment underscores the strategic competition over foundation models and inference infrastructure, with implications for Western enterprises' technology choices and supply chain dependencies.