Digital Plumber

At LogicMonitor's Elevate event in Chicago on October 15, 2026, the vendor outlined five strategic pillars for enterprise observability: unified context, AI-governed action, and trust. The keynote emphasized how AI-driven observability is moving beyond static dashboards and alert storms toward autonomous IT operations. Edwin AI—LogicMonitor's agentic AIOps engine—was positioned as enabling IT teams to detect, diagnose, prioritize, and act on operational issues with governance controls. The event highlighted how observability must now support agentic workflows where autonomous systems propose and execute changes, requiring deterministic validation and explainability. This shift reflects industry movement toward "autonomous IT" where AI handles routine operations while human operators maintain oversight. For network and infrastructure practitioners, the emphasis on governed automation addresses a real operational tension: how to safely delegate operational decisions to AI agents while preserving auditability and compliance. LogicMonitor's framing positions observability not just as visibility, but as the foundation for trustworthy autonomous operations.

Pradeep Vincent, VP of Compute and AI Infrastructure at Oracle Cloud Infrastructure, addressed keynotes at the 2026 Open Compute Project Global Summit in San Jose, where executives from Microsoft, Oracle, HPE, Intel, Google, and the electrical infrastructure industry described an emerging need to coordinate computing, networking, power, cooling, security, and operations as parts of a unified architecture. The presentation reflected a maturation from isolated cluster engineering toward systems-level infrastructure design. Oracle's call for standardized interfaces between AI data centers and power grids addresses how hyperscale loads create new challenges for utilities and operators, indicating that networking and infrastructure work now requires coordination at the grid level, not just within data center facilities. For NetDevOps practitioners, this signals emerging protocols and measurement frameworks for grid integration will become requirements in procurement specifications alongside traditional fabric metrics.

IEEE 802.3dj targeted for completion in 2026, with 1.6T-capable NICs shipping and hyperscaler deployments of 1.6T spine switches beginning; CPO enters production at lead customers, and by 2027 volume ramps with LPO and CPO taking meaningful share. The architectural breakthrough is the 200 Gbps serial lane—instead of bonding sixteen 100G lanes, 1.6T runs 8 lanes of 200G each (8 x 200G), built on 224G SerDes and PAM4 signaling. IEEE P802.3dj introduces inter-sublayer link training (ILT)—a standardized, negotiated equalization and tuning handshake between sublayers during bring-up, mandatory for 200G-per-lane PHYs and attachment unit interfaces. For practitioners, the 2026 completion of IEEE 802.3dj represents the moment pluggable optical qualification becomes urgent; vendor interoperability testing should begin now against early-access 1.6T modules to de-risk 2026-2027 deployments.

Cloudflare analyzed HTTP traffic patterns across two Yandex autonomous systems (AS13238 for search, AS200350 for cloud hosting) following reported physical damage to data centers. Yandex Search ASN lost 99% of crawler traffic, almost entirely legitimate YandexBot indexing; 93.6% of its traffic was verified search crawlers (page indexing, image rendering, news crawling). By contrast, Yandex.Cloud saw 40% decline in malicious bot traffic and 90% drop in WordPress vulnerability scanning, but Cloudflare observed the same automated clients—identifiable by matching JA4 TLS fingerprints, custom User-Agent strings, and HTTP request paths—reappear on competing Russian hosting ASNs like Radist and Selectel within hours. Total attack volumes targeting gambling and other verticals remained essentially flat week-over-week, indicating seamless workload migration. This illustrates how BGP routing and peering changes cascade through infrastructure, forcing operators to reroute traffic but not disrupting the underlying threat operations—a key operational lesson for network teams managing resilience.

Inngest operates a distributed queue processor across multiple data center providers. On October 9 at 21:05 UTC, one provider's data center (unidentified) lost network connectivity in both directions: inter-DC links and outbound internet access went down simultaneously. The provider's preliminary explanation cited an error made during a configuration change to its DDoS protection system—likely a BGP prefix filter, route withdrawal, or traffic policy rule that inadvertently blocked their own traffic. Inngest's impact was immediate: accounts processed in that facility could not reach the primary database lookup service (in a different facility), so queue processing halted. Run state could not be persisted either. The outage lasted 44 minutes (21:05–21:49 UTC). Upon reconnection, queue processing resumed and backlogs drained automatically. A few internal services did not recover autonomously and required manual restart between 22:26–22:38 UTC. This is a textbook case of how upstream DDoS mitigation changes—often deployed via BGP route manipulation or egress filtering—can create hard stops in customer traffic if not validated before deployment.

CVE-2026-0322 is a high-severity RCE in PAN-OS management interface (CVSS 8.6) allowing authenticated attackers with network access to execute arbitrary code with root privileges on targeted firewalls. Very limited exploitation has been observed in the wild. No special configuration is needed to exploit the vulnerability. It affects PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series appliances); Cloud NGFW and Prisma Access are not affected. No complete workaround exists—Palo Alto advises restricting management interface access to trusted internal IP addresses through a hardened jump box. Fixed versions include PAN-OS 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, and 10.2.18-h12. The early addition to CISA KEV reflects active exploitation and signals federal agencies must remediate by October 17. Organizations should prioritize patching internet-facing and edge-deployed appliances first.

The combined Junos OS and Junos OS Evolved bulletin (JSA112187) addresses over 60 routing and management bugs spanning PA-Series and VM-Series firewalls, MX-Series, PTX-Series, and SRX-Series platforms. CVE-2026-101983 (CVSS 9.8) is a stack-based buffer overflow in httpd allowing unauthenticated network attackers to cause RCE and DoS via J-Web virtual domains. CVE-2026-101954 (CVSS 9.8) allows unauthenticated network access to trigger full device takeover when J-Web is enabled. CVE-2026-101990, CVE-2026-101982, CVE-2026-102178, and CVE-2026-33789 allow malformed BGP or EVPN traffic to crash the routing protocol daemon or compromise the Routing Engine. Attackers can exploit these flaws via network protocols, management interfaces, and local services. The combination of management-plane (J-Web) and routing-plane (BGP/EVPN) flaws creates both direct takeover risk and protocol-level denial-of-service vectors. Given Juniper's role in ISP, telco, and hyperscale cloud fabric deployments, these patches should be prioritized immediately for production routers and edge devices.

Incident response automation in 2026 combines agentic AI with mandatory human validation: AI collects context across systems in seconds, concierge analysts validate decisions, but pure SOAR cannot reason and pure AI without humans takes wrong action 70% of the time. Recommended first automation plays include identity-anomaly investigation (impossible travel, token-binding mismatches, MFA fatigue patterns), saving 15-30 minutes per case; network device configuration drift detection; and automated session isolation for compromised VPN users. SOAR platforms tie together alert triage, threat enrichment, and containment into single automated workflows. Human-in-the-loop approval gates maintain control over high-risk actions like production system shutdown or credential revocation on executive accounts. For network security operations, agentic AI now handles firewall rule enforcement, VPN session isolation, and identity-based threat containment with minimal analyst overhead—critical as CVE-2026-0322 (PAN-OS) and Juniper vulnerabilities create active perimeter threats requiring rapid isolation and remediation at machine speed.

Pluto raised $34M in Series A led by Jump Capital, plus an earlier seed round from TLV Partners, bringing total funding to $42M. Founded in 2025 by security veterans from Microsoft, Palo Alto Networks, and Israel's Unit 8200, the startup has already achieved multimillion-dollar ARR, secured 1M+ endpoints globally, and attracted 40+ enterprise customers including Fortune 500 firms across healthcare, retail, and financial services. The company addresses a critical operational gap: employees at customer organizations already use hundreds of AI-related software components while building thousands of applications, creating blind spots in traditional security models. Pluto's model shifts from 'stopping things' to enabling and observing AI tool usage in real-time, enforcing governance without blocking velocity. The founding team's depth (Bahat, Ofer Regev, Maman) and investor roster (Jump Capital, Skinos, AlphaDrive Ventures, Ansa Capital, MTF) signal recognition that AI workspace security represents a distinct infrastructure layer separate from application, endpoint, and network security—directly relevant to SREs and NetDevOps teams managing heterogeneous environments where autonomous agents and AI services run across on-prem and cloud infrastructure.

Xurrent's October 15 guide defines AI SRE as autonomous LLM-based software agents that detect, triage, investigate, and remediate production incidents alongside—not replacing—human SREs, reducing alert noise and speeding resolution. Xurrent's Sera agent integrates into their IMR platform, Slack, incident calls, and Claude through MCP, showing how agents bridge observability, incident management, and LLM tools in unified workflows. The timing reflects maturation: PagerDuty SRE Agent reached GA in October 2025, while Azure and AWS launched SRE agents in early 2026. The guide's emphasis on staged autonomy (read-only → low-risk operations → high-risk actions) aligns with enterprise deployment practices, with governance frameworks from NIST and cloud providers establishing controls for agentic systems.

The paper addresses AI inference for resource-constrained edge devices by using analog RF computing, where a base station multicasts a waveform encoding neural network weights, and each client multiplies the received weight-encoded waveform with its locally generated input-encoded waveform through a passive mixer in the RF frontend. The authors study a multi-user MIMO downlink scenario where a multicast AI flow must share spectrum, power, and spatial resources with unicast data flows, formulating a joint beamforming problem to maximize aggregate data rate subject to computing accuracy, client energy, and power constraints. This approach shifts the computational burden to the physical layer and network infrastructure rather than device processors, with implications for how telecom operators manage spectrum and power allocation. The work challenges traditional device-centric inference architecture and suggests infrastructure-centric alternatives that can be more energy-efficient, particularly for IoT deployments. Networks would need to support specialized physical-layer computations, not just data transmission.

This YANG data model describes Ethernet networks when used either as a client-layer network of an underlay transport network (e.g., Optical Transport Network) or as a transport network itself. CCAMP WG milestone targets November 2027 for submitting this data model to IESG for publication. The model standardizes how Ethernet topology information—links, nodes, ports, capabilities—is represented in a vendor-neutral way. This is fundamental for network automation tools to discover and configure carrier-grade Ethernet infrastructure. Practitioners using YANG-based network controllers (OpenDaylight, ONAP, etc.) require standardized Ethernet topology models; this draft fills that gap and should eventually replace vendor-specific topology models. The ongoing progression through IETF indicates active operator and vendor alignment on standardizing Ethernet service topology.

Keynotes include Paul Brodsky discussing global infrastructure and Layer 3 interconnection in context of geopolitical vulnerabilities and subsea cable investment, and John Evans on why autonomous networks lag behind self-driving cars. The agenda covers network troubleshooting agents with architecture and guardrails, BGP role model tracking RFC 9234 adoption, flat datacenter networks at scale (RNG), silent failure detection in production systems, network emulation platforms and digital twins, IPv6 routing loops and router configuration issues, and BGP graceful restart problems. Three technical workshops run on different days: Multi-Path Traffic Engineering (Oct 19, HPE/Juniper), Kea DHCP Server (Oct 20, ISC), and Routing Security Deep Dive on RPKI (Oct 21, ARIN), each capped at 50 seats. Registered attendees can attend multiple workshops at no additional charge. The conference runs October 19–21 at InterContinental Miami. NANOG presentations are peer-reviewed and archived, providing a living record of how operators solve real problems at scale. Sessions on BGP, traffic engineering, IPv6, and autonomous systems directly inform network engineering and operational decisions.

The Claude Platform's OpenTelemetry integration is now in public beta and sends run traces from the Messages API, Claude Managed Agents, and the Claude SDK to users' existing monitoring systems. Traces cover model calls, tool use and agent sessions, with metrics such as latency and token usage, for troubleshooting failures and building evaluations from real traffic. Data can go to any tool that supports a standard OTLP endpoint. This is significant for infrastructure and AIOps teams because it reduces vendor lock-in and integrates Claude observability directly into existing enterprise monitoring stacks. For teams building Claude-powered agents at scale, this enables granular latency tracking, token usage optimization, and failure analysis without requiring separate Claude-only dashboards. On the business side, Anthropic reported Q3 revenue of $16.8 billion, acquired security company OPAQUE, and opened a Singapore office, signaling expansion into new markets and security infrastructure capabilities.

Ramp's $1.85 billion Series C, co-led by Dragoneer, Thrive Capital, Founders Fund, Sands Capital, and Avenir Growth, values the expense management platform at $60 billion—a $16 billion jump from a $44 billion valuation just four months prior in June 2026. The company's annualized revenue has crossed $2 billion (up from $1.5 billion in June) with 85,000 customers and annualized purchase volume exceeding $275 billion. Revenue growth is accelerating at 25% faster than year-over-year rates. This trajectory signals that AI-driven expense automation has moved decisively from early adoption to mainstream deployment across large enterprises. For practitioners managing infrastructure and compliance, Ramp's scale and valuation jump underscores market validation for autonomous financial workflow agents—systems that require new governance frameworks, audit trails, and integration patterns at enterprise scale. The company's stated push "deeper into AI" implies expansion of agentic capabilities, which will drive demand for observability, compliance, and autonomous agent governance platforms that network and SRE teams must support.

The case involved Saudi national Abdulrahman Alfozan allegedly placing a recording device in an OpenAI executive conference room, with DNI Clayton stating the incident shows the lengths people will go to supplant U.S. leadership in AI technology. This concrete espionage incident crystallizes broader U.S.-China geopolitical framing around AI dominance. For enterprise security and risk teams, the case underscores physical and counterintelligence threats targeting AI labs and R&D facilities—not just cybersecurity perimeter attacks. Clayton's framing of espionage as a threat for both private sector and government signals that AI security posture now includes counter-intelligence operations alongside traditional cybersecurity and code security practices. Organizations developing or hosting frontier AI capabilities face heightened supply-chain, facility, and personnel security scrutiny as competing nation-states pursue asymmetric intelligence collection.