Digital Plumber

NANOG 98 runs October 19-21, 2026 at the InterContinental Miami, drawing up to 1,500 professionals from network engineering, operations, and architecture roles. The program combines peer-reviewed technical presentations with peering coordination forums and specialized workshops. Three workshops are scheduled: Multi-Path Traffic Engineering (Oct 19, HPE/Juniper), installing and configuring the open source Kea DHCP server (Oct 20, ISC), and Routing Security Deep Dive on RPKI (Oct 21, ARIN). The conference is live-streamed and archived for remote participation. Sessions cover automation strategies, infrastructure challenges, and operational tooling relevant to NetDevOps practitioners building production automation pipelines.

INE announced on October 23, 2026 an expanded Infrastructure as Code (IaC) for Cisco Engineers learning path led by instructor Rohit Pardasani (20+ years large-scale infrastructure experience). The curriculum helps network professionals transition from CLI-based device administration to infrastructure-as-code and GitOps workflows. Topics include Python, REST APIs, Ansible, GitOps, Terraform, and Network-as-Code practices—core to modern NetDevOps operating models. The expansion reflects enterprise adoption pressure: organizations increasingly mandate IaC proficiency, Git-based change workflows, and automation-first mindsets for network engineering positions. Practitioners building or standardizing network automation practices should benchmark their curriculum against industry expectations.

KDDI and Broadcom's partnership represents a shift from CPO lab demonstrations to production-scale validation. The collaboration establishes a test environment at a KDDI data center deploying a CPO switch incorporating Broadcom's latest-generation Tomahawk 6 Ethernet switching chip paired with Davisson optical engines. This marks CPO's transition from perpetual promise to production deployment, driven by NVIDIA's GTC 2026 announcements and subsequent vendor adoption. The technology eliminates traditional front-panel pluggable optics by co-packaging optical engines with the switch ASIC, reducing power consumption, latency, and improving bandwidth density for AI clusters. Broadcom's Tomahawk 6 CPO variant (Davisson) represents the industry's pivot toward optical-electronic convergence as the primary architecture for next-generation AI data centers, with field-replaceable external laser modules enabling serviceability and cost management.

1.6T Ethernet delivers 1,600 Gb/s per port (double 800G), standardized by IEEE 802.3dj with electrical interfaces aligned to OCI CEI-224G, using 200 Gb/s per lane with PAM4 modulation over 8 lanes. Expected milestones include 102.4T switch ASICs announced and sampling in 2025 with first 1.6T DSP pluggable and LPO modules, first CPO switch systems unveiled, and 800G in volume for AI fabrics; in 2026, IEEE 802.3dj targeted for completion, 1.6T-capable NICs shipping with next-gen accelerators, and hyperscaler and neocloud 1.6T spine deployments beginning. Ultra Ethernet (UEC) runs as a transport-layer specification on top of 800G and 1.6T physical layers and is a major reason hyperscalers are confident standardizing AI fabrics on Ethernet. The analysis covers form factors (OSFP-XD leading for 1.6T), cabling strategies (single-mode OS2 fiber for longer-reach links), and deployment timeline showing 800G as the current workhorse with 1.6T early sampling transitioning to broader adoption as the 802.3dj standard finalizes.

The ASPA-based AS_PATH verification Internet-Draft (version 29, published October 16, 2026) describes how operators can use Autonomous System Provider Authorization (ASPA) objects alongside ROAs to verify the full AS path in BGP announcements. While ROAs validate only whether an origin AS is authorized to announce a prefix, ASPA adds cryptographic verification that traffic follows authorized AS paths, closing a major gap in routing security. The draft defines validation procedures to detect route leaks (where legitimate routes propagate beyond policy) and AS_PATH manipulations. This document is advancing through the IETF SIDROPS working group; at press time, the profile, verification algorithm, and RPKI-to-Router (RTR) protocol v2 remain Internet-Drafts rather than finalized RFCs, meaning operators can publish ASPA objects now (already available in RIPE NCC, ARIN, and APNIC portals) but should monitor validation states before enforcing drop policies on routers. The specification update is part of a phased industry push toward mandatory provider-list publication across all five RIRs by end of 2026.

A security researcher identified the compromise on October 17 and demonstrated possession of private keys by submitting valid signed attestations to browser root programs and eMudhra. Six impacted certificates were for TLS trusted by Apple, Chrome, Microsoft and Mozilla; two were code-signing certificates trusted by Microsoft. Browsers blocked the affected intermediates using revocation lists, but most non-browser software lacks intermediate CA revocation filtering, forcing many projects to remove the emSign ECC Root CA - G3 from their roots of trust. Chrome and Firefox blocked on October 17, Apple on October 19, Microsoft on October 20. Apps, servers and devices without revocation updates may still trust the compromised certificates, exposing traffic to interception. Network teams must audit certificate chains in load balancers, API gateways, mutual TLS configurations, and embedded trust stores.

All PAN-OS and Panorama versions are vulnerable with highest risk when management interfaces are exposed to the internet; rated high severity (CVSS-B 8.7) for potential service disruption. Palo Alto recommends restricting management access to trusted IPs and using Threat ID 543004 (Frontier Virtual Patching) and IPS signatures (97622–97625) for temporary protection. Fortinet is checking 12 products, Cisco 31 products; neither has confirmed vulnerable products yet and Cisco states no workarounds exist. Palo Alto Networks counted 22.6 million exposed instances potentially vulnerable to PHP2Shell. Network teams should assume compromise of any internet-facing PAN-OS or Panorama instance until patches release.

The release fixes 10 CVEs across core engine and bundled dependencies including c-ares, OpenSSL, SQLite, and Undici, plus ships an updated CA certificate store to address the eMudhra intermediate CA compromise. CVE-2026-111497 is an out-of-bounds write in Brotli decompression—critical because Brotli is ubiquitous in HTTP compression. TLS fixes address hostname validation bypass and DNS fixes cover NUL truncation edge cases that could allow protocol bypasses in edge cases. The eMudhra CA store update is essential to prevent reliance on compromised intermediates. All versions (26.x, 24.x, 22.x) receive c-ares and Undici updates; 24.x and 22.x receive OpenSSL updates; 22.x receives SQLite updates. Teams must test and deploy across all Node.js infrastructure.

Investors in the seed round included Ludlow Ventures, Hidden Capital, Entrée Capital, Detroit Venture Partners, firedrop, and FDVC, along with angels from security and SaaS sectors. Founder Chase Lee previously founded Trustpage (acquired by Vanta in 2024) and was CEO of that compliance platform. Ultra's platform provides four core capabilities: guardrails that enforce policy in real time (blocking credential access, redacting personal data, protecting health information, limiting data movement), observability with every agent-to-tool interaction logged and queryable, connectivity via a universal bridge for every agent and connector type, and governance with AI-native anomaly detection. The company holds SOC 2 Type II, ISO 27001, and ISO 42001 certifications and is AARM Extended conformant. It emphasizes purpose-built design for autonomy rather than a legacy vendor adding a security checkbox, and operates vendor- and model-agnostic by design.

Announced October 22, 2026 at Nvidia's GTC Berlin event, Minerva uses machine learning to establish baselines of normal behavior and predict failures across heterogeneous infrastructure. It groups related alerts into single incidents with root-cause analysis, reducing alert noise for operators managing massive clusters. A built-in AI assistant answers questions about cluster health in natural language and suggests remediation, which can be applied manually or integrated with automation platforms via APIs. Dell Technologies, Lenovo, and Supermicro will offer Minerva as part of their AI factory operations portfolios. The platform is purpose-built to trace slow jobs back to their root cause even when spanning hundreds of thousands of GPUs, addressing a key operational challenge in large-scale AI infrastructure. It represents a departure from generic AIOps toward domain-specific observability optimized for GPU utilization and training job completion metrics.

Maximilian Bartel, CTO of Roofline, has been named Chair of the Technical Steering Committee (TSC) for IREE, an LF AI & Data project. The appointment reflects Roofline's growing commitment to advancing open source AI deployment infrastructure and fostering broader community collaboration across hardware and software ecosystems. Roofline contributes to IREE alongside other organizations and individual developers; Maximilian's role as TSC Chair operates within the project's existing governance structure, with technical decisions made through the TSC's established processes. IREE is a sandbox-stage project of the LF AI & Data Foundation and as of September 2026 its CONTRIBUTING.md lists eight voting TSC members: six from RooflineAI, including chairperson Maximilian Bartel, and two from AMD. Roofline, founded in 2024 as a spin-off from RWTH Aachen University, provides an edge AI deployment SDK built on IREE and MLIR. Bartel's appointment reflects broader industry adoption of IREE as shared infrastructure for compiling ML models across diverse edge hardware platforms.

The article exposes a critical gap between agent capability and operational readiness in production SRE deployments. Early 2026 incidents showed that while agents accelerate diagnosis and remediation, giving them keystroke access without mature governance layers created new attack surfaces. Key finding: most losses came through operations (key compromise, credential exposure, permission misuse) rather than agent reasoning errors. The analysis argues infrastructure teams must implement timelocks, length-prefixed encodings, and consumed references—defensive primitives from formal verification and blockchain—before agents hold infrastructure keys. This represents a governance reset: agent frameworks handle orchestration, but operational safety requires controls external to the agent itself. Essential reading for operations and SRE leads considering autonomous remediation and moving agents from advisory to autonomous change mode.

Lumen frames its service assurance model around three principles: "Don't let it break," "Fix it fast," and "Communicate effectively." The operational substance lies in measurable automation gains: Lumen uses automation to monitor network conditions and external threats including severe weather or construction, with 380+ workflows running ~5 million times yearly, and machine-to-machine intelligence anticipating and resolving 80% of issues. Lumen's GenAI Service Diagnostics system deflects 35% of tickets and resolves some issues directly. AskGreg, a multi-agent assistant for engineers, gives staff fast access to service history and network data and recommends next actions. For network ops teams, this means fewer manual escalations and faster restoration during outages. The dual-path offering specifically addresses hidden failure points where different providers still route traffic through the same fiber, a common enterprise risk that single-provider diversity doesn't solve.

Nokia and NVIDIA announced new AI-RAN capabilities that apply AI within radio processing, support intelligence close to where data is generated, and extend governed AI agents for cross-domain network operations. Building on the industry's first commercial AI-RAN platform announced in July, AI-RAN is being integrated into live networks and moving closer to deployment. The real-time network foundation supports physical-AI applications while improving today's 5G and 5G Advanced networks. Elisa is deploying Dell PowerEdge servers equipped with NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs at multiple Finnish network locations to support distributed AI inference and future AI-RAN deployments. A trial on Optus' live 5G network measured a gain of more than 20% in cell-level downlink throughput in medium-to-poor radio conditions. Deutsche Telekom's RAN Guardian live system uses three agents to identify events, assess network impact and autonomously implement remediation. The MINDR multi-agent platform correlates network signals, diagnoses incidents, and executes remediation within predefined guardrails, targeting Level 4 autonomous networks while retaining human approval for critical changes. This represents the first substantial production deployment of agentic AI in RAN operations at scale.

Deutsche Telekom has described MINDR as an evolution of RAN Guardian, extending agentic AI from domain-level optimization toward service-level intelligence across complex, multi-domain network environments. RAN Guardian scales by using three agents to identify events, assess network impact and autonomously implement selected remediation actions. The architectural significance is that MINDR's multi-agent platform correlates network signals, diagnoses incidents, and executes remediation within predefined guardrails—guardrails being critical for production networks where autonomous agents must remain trustworthy and auditable. Deutsche Telekom wants to move from individual automation use cases toward increasingly autonomous networks, while retaining human approval for critical changes. This maturation model mirrors the evolution in SRE and AIOps: automation starts domain-specific (RAN optimization), then expands to cross-domain orchestration (MINDR), with human gates remaining for high-impact decisions. For operators, this means shifting from reactive alerts and manual runbooks to proactive intent-based service assurance—a fundamental architectural change in how NOCs operate. The live deployment on Deutsche Telekom's network provides a production reference for Level 4 autonomy that retains governance.

This longitudinal study evaluates consistency between RIPE Atlas latency measurements and location estimates from DB-IP, IP2Location, IPinfo, and MaxMind as a proxy for geolocation quality. The study analyzed six months of data (January-June 2026) covering 2.6+ billion measurements across 5+ million unique IPs. Key finding: consistency is stable over time but varies greatly by provider and IP type. For IPv4 routers, MaxMind is 10.7 percentage points worse than general case while IPinfo is only 1.6 percentage points worse; for IPv6, routers are geolocated more consistently than non-routers by all providers. This matters for operators using geolocation for traffic steering, compliance checks, or fraud detection; relying on a single provider without understanding these patterns risks misclassifying traffic or missing legitimate regional users.

Artificial intelligence governance has become central to geopolitics, with three competing approaches: the UN pursuing shared rules; Washington prioritizing technological dominance and national security; and Beijing focusing on international cooperation and capacity-building in the Global South. The US approach primarily aims to win the competition and unleash capital for AI centres, anchored in the December 2025 Pax Silica initiative, an economic security coalition to build an ecosystem of 'trustworthy systems' and push back on China's tech dominance. Most of the 24 signatories are US allies, and only two of the core Global South Hedgers—India and the UAE—are members. Trump and Xi agreed in September 2026 to launch a new bilateral AI dialogue, albeit without strong indication of commitment yet. None of these approaches provide effective safeguards against the loss of human control or an escalating AI arms race; US-China dialogue, middle-power leadership, and new avenues for international cooperation are essential to establish common red lines before a crisis exposes the cost of inaction.

Southeast Asia's digital applications sector has stabilised at approximately $8 billion in annual private funding, with AI applications capturing 80% of the $3.2 billion invested in H1 2026. Over the past 12 months, private capital deal value in AI compute and digital infrastructure reached $20 billion, led by the $11 billion acquisition of ST Telemedia Global Data Centres. Singapore is managing rising computing demand while addressing environmental impact by allocating an additional 200 megawatts of green energy to support its 1.4-gigawatt computing base. Government initiatives include a framework to govern agentic AI and a programme to train 100,000 people by 2029, positioning Singapore's deliberate, sustained investments across infrastructure, talent, and governance as a model for safe and responsible deployment of AI agents across Southeast Asia.