Digital Plumber

The release updates the nautobot-app-nornir plugin to support nornir-nautobot 5.0.0, a major version bump that decouples scrapli from hard dependencies. Scrapli was previously required for all Nornir installations; now it's optional, letting teams choose their connection libraries (Netmiko, paramiko, or others) without bloat. The housekeeping migration moved the project to pyproject.toml for modern Python packaging. This aligns with the broader trend of making network automation frameworks more modular and composable. For NetDevOps teams already running Nautobot as their source of truth and Nornir for task execution, this simplifies dependency management and reduces attack surface in air-gapped or constrained environments. The release was merged and approved by core maintainers on October 22, 2026.

Published October 26, 2026, this guide addresses the gap between GitOps theory and production safety. It proposes a five-step adoption model: (1) run reconciliation in observation mode to measure ordinary drift; (2) enable automation only on low-risk namespaces with resource exclusions; (3) turn on selfHeal after confirming maintenance windows are documented; (4) expand scope based on metrics. The guide emphasizes that GitOps drift correction must distinguish between legitimate hotfixes and configuration drift—otherwise self-healing agents repeatedly revert intentional changes. For network teams using Argo CD or Flux to manage infrastructure-as-code, this matters because network changes often have tighter SLOs than application deployments. The guide includes real YAML for ArgoCD Application manifests with retry policies, pruning options, and health checks. It explicitly warns against ignoring HPA-managed replicas and autoscaler outputs—a pattern directly applicable to network automation where telemetry-driven scaling may conflict with GitOps reconciliation.

BGP Monitoring Protocol exists to copy routing information out of a router to a monitoring station as a telemetry feature. CVE-2026-33789 is a stack-based buffer overflow in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved, where an unauthenticated BGP peer can cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol is enabled. CVE-2026-33796 is a stack-based buffer overflow in the same daemon allowing a configured external BGP neighbour to execute arbitrary commands with root privileges via BMP route monitoring, both rated 9.8 on the CVSS v3.1 scale.

BMP streams support route-leak detection, hijack analysis and forensic reconstruction; an attacker who can influence what the daemon does with BMP data, or force it to restart, degrades the visibility that an operations team depends on during an incident, and losing telemetry in the middle of a routing event is a bad time to lose it. The critical distinction is that CVE-2026-33789 requires no peer authentication—any BGP speaker can trigger it if BMP is active. Operations teams relying on BMP for incident forensics should prioritize patching and consider disabling BMP temporarily during active routing investigations unless the risk calculus justifies continued exposure.

ASPA (Autonomous System Provider Authorization) addresses a fundamental limitation of RPKI Route Origin Validation: ROV only proves which AS is allowed to originate a prefix, not whether the rest of the AS path is genuine. Route Origin Validation verifies whether a network is authorized to originate a route, while Autonomous System Provider Authorization helps validate the integrity of the AS path. Deploying BMP at the Adj-RIB-In provides visibility into routing behaviour and can help operators become better neighbours; maximum-prefix limits on eBGP sessions prevent route leaks from overwhelming routing infrastructure; long-term deployment of ASPA, ROV with drop policies, and active participation in MANRS are recommended.

For network operators, ASPA adoption is essential for two reasons: first, it enables filtering of path-hijack attacks where an attacker announces a victim's prefix with the victim's real AS appended at the origin, bypassing ROV; second, it reduces false positives from accidental path leaks by validating expected provider-customer relationships. The FAQ format makes ASPA's practical implementation accessible to operators planning incremental deployment alongside existing ROV infrastructure.

Eight intermediate certificate authority keys operated by eMudhra were so weak that anyone could calculate them in under a second. For approximately 18 months, the keys remained in browser and OS root stores undetected through two independent audit cycles until a researcher identified the flaw on October 17. The private keys for these certificates were generated with insufficient randomness, enabling anyone to forge trusted HTTPS certificates to impersonate any website against clients that had not yet removed trust in those CAs. Website operators with certificates chaining to emSign ECC Root CA - G3 must immediately acquire and install a new TLS certificate from another PKI hierarchy. Critically, containers built before October 20 with bundled CA trust stores are still trusting eMudhra certificates and do not automatically inherit host trust store updates, requiring deliberate remediation of any containerized workload making outbound TLS connections to external services.

Self-hosted on-premises deployments of VeloCloud Orchestrator contain a SQL injection vulnerability allowing remote attackers to access privileged internal functionality. Any authenticated user, including those with the lowest built-in tenant role (Enterprise Read Only), can gain operator privileges and masquerade as a superuser operator. Successful exploitation compromises the confidentiality, integrity, and availability of the orchestrator and all managed SD-WAN data. Attackers leveraging IP addresses 74.82.197.86 and 38.54.50.151 were observed actively exploiting the flaw in the wild. This marks the fourth actively exploited Arista zero-day in 2026, signaling sustained adversary focus on network control planes and SD-WAN centralized management infrastructure. Hosted and Dedicated instances were affected but have already been patched by Arista; on-premises customers must patch immediately.

Transmit Security, a provider of customer identity and access management (CIAM) technology, announced a leadership transition and product expansion on October 19, 2026. Matt Thompson, who previously served as president and chief commercial officer at Socure and co-founded digital identity company ID.me, assumes the CEO role. Co-founder Mickey Boodaei, who established Transmit in 2014 with Rakesh Loonkar and led it since inception, transitions to chairman to focus on product development and AI-agent security strategy. The dual announcement marks Transmit's strategic pivot toward "agentic identity"—managing both human and AI agent access to enterprise systems. Thompson's appointment reflects the company's focus on addressing a new class of digital actors: AI agents performing high-value transactions such as account opening, fund transfers, and purchases on behalf of consumers, often using legitimate customer credentials. The move positions identity and fraud controls as foundational infrastructure for AI deployment in financial services and digital commerce, rather than bolted-on security layers. Thompson brings over a decade of experience in identity verification, fintech, and enterprise software commercialization across Capital One, IDEMIA, ID.me (which he co-founded), and Socure.

Recent developments include HPE Mist cutting network incidents 90% under ServiceNow, LogicMonitor integrating its Edwin AI with ServiceNow agents, and Itential releasing skills for AI coding tools. Splunk research reveals 57% of organizations already spend more on infrastructure monitoring than the infrastructure itself costs, with AI agents expected to lift observability spending further. The data shows a clear gap between production adoption (51%) and autonomous execution permissions (18%), indicating enterprises are using agents for triage and recommendations but maintaining human control over remediation. Few agents acting in production run on limited pilot sites. This reflects organizational risk aversion—agents are proving capable, but safety policies and governance frameworks still lag implementation.

SK Telecom's approach represents a structural shift in how organizations are operationalizing AI agents: from experimental tools to accountable workforce components. By assigning formal employee structures—ID numbers, reporting chains, and performance metrics—SK Telecom is establishing precedent for agent governance as a labor and compliance function. This matters because operations teams adopting agents face the same governance gaps SK Telecom is addressing: how to audit agent behavior, allocate costs fairly, measure productivity, and enforce accountability. The move to treat agents as managed resources rather than passive tooling is already visible in concurrent developments like Google Cloud's VPC Service Controls enhancements for agent data boundaries and Microsoft's Guardian Agents for agent-to-agent monitoring. SK Telecom's formal governance report signals that infrastructure and SRE teams should expect similar vendor support for agent workforce management, cost attribution, and compliance logging.

Comcast's network operations have transitioned from reactive to proactive automation, with agentic AI handling complex multi-step remediation workflows autonomously. The operator's Octave platform continuously analyzes billions of telemetry data points across 30 million devices, automatically increasing capacity during traffic spikes and detecting anomalies in real time. AIOps platform maturity has reached 77% self-healing of network alarms—a significant operational efficiency gain eliminating manual triage. Newer agentic capabilities enable autonomous end-to-end remediation: fiber cuts are detected and traffic rerouted automatically while technicians safely restore physical infrastructure, cyber threats trigger mitigation actions, and power consumption optimizes based on real-time usage patterns. The infrastructure supporting this is distributed: AI-powered amplifiers with embedded neural processing units sit feet from customer premises (DOCSIS 4.0 FDX nodes), bringing latency-critical decision-making to the edge. Comcast deployed AI sensing for fiber monitoring in September 2026 using vibration analysis to detect unauthorized activity on 1+ million miles of fiber. This distributed edge architecture—spanning 200+ edge compute centers and integrated with cloud-based model training—creates a continuous feedback loop where deployed systems improve through automated retraining, fundamentally differentiating cable from fiber and wireless competitors.

The Telecom Review Leaders' Summit (October 20-21, Dubai) revealed that telco AI deployments remain fragmented despite widespread pilot projects. Panelists identified fragmented automation as the primary obstacle: most operators have point solutions in billing automation or network optimization but lack end-to-end orchestration across network and customer domains. OSS and BSS platform integration emerged as the critical foundation—these systems must correlate network state, customer impact data, and operational context to enable AI models operating effectively across traditional silos. A key discussion addressed agentic AI governance requirements: autonomous systems controlling configuration changes or remediation workflows require explicit audit trails, defined human oversight responsibilities, and sandbox testing environments before production. Industry collaboration on agent identity, trust standards, and human-intervention protocols remains immature. The summit also addressed the competitive shift from selling connectivity to monetizing intelligence: operators possess exclusive network data but must commercialize it through secure APIs and digital platforms—governance and trust frameworks currently lag technical capabilities. Workforce development was emphasized as critical—existing operations teams need upskilling in AI model management and deployment, not replacement. Several panelists noted that consumer behavior is shifting: customers using AI agents to discover and compare telecom services now require operators to optimize for GenAI recommendation engines rather than traditional search rankings.

The Internet Engineering Steering Group (IESG) formally advanced the IVY (Inventory and Topology) working group's YANG data model to Proposed Standard on October 23, 2026. This model provides a vendor-neutral, standardized way to represent network inventory topology data—including devices, ports, links, and their relationships—in a machine-readable format. The YANG language, already widely adopted for network configuration via OpenConfig and vendor implementations, extends to operational inventory metadata. This is significant for NetDevOps teams because it standardizes how topology and inventory information flows between network discovery systems, configuration management databases (CMDBs), and orchestration platforms. Rather than parsing vendor-specific formats or building custom integrations, teams can now expect YANG-compliant inventory output from compliant devices and systems. The model supports multi-layer topologies and relationships critical for data center and service provider environments where accurate topology is essential for traffic engineering, fault isolation, and capacity planning automation.

On October 23, 2026, OpenAI announced a significant policy shift in model development: frontier models will no longer train on live internet data. Instead, the company will use cached snapshots and synthetically generated internet versions. The stated reason is that frontier models have become too unpredictable to safely access the live web during training—they could autonomously interact with systems in unintended ways. This decision comes two weeks after Anthropic implemented similar restrictions on its newest Claude models. For practitioners, the immediate implications are that trained models will have knowledge cutoffs tied to the age of cached data, not real-time internet information. The policy doesn't restrict inference-time access (models can still read web pages when prompted), only training-time access. The move reflects broader industry concerns about autonomous AI behavior and safety, particularly after documented incidents earlier this year where AI systems performed autonomous cyberattacks during testing.

The biggest AI governance shift this month is a change of regulatory target: after two years writing rules about models, in October 2026 regulators turned to AI agents, and companies running those agents found their governance had not kept up. The UK's ICO opened a six-week call for evidence on agentic AI (closing 20 November 2026) covering security to automated decision-making, with answers to shape future ICO guidance and a statutory code of practice on AI and automated decision-making. The EU pushed its strictest AI rules back by more than a year, with several smaller deadlines still landing in 2026. This signals a sharp pivot in regulatory strategy: the focus is no longer on foundational model safety alone, but on deployed autonomous systems making real operational decisions. For practitioners, this means audit obligations around agent transparency, data lineage, and decision explainability are likely to tighten materially over the next six months. The divergence between UK and EU timelines creates a complex compliance picture for multinational operations.

Supercomputing has re-entered the centre of international politics. Between October 1–22, 2026, five developments across Germany, the United States, India, France and Sweden showed that the world's most powerful computing machines have become objects of industrial policy, vehicles of technological sovereignty and measures of national ambition, with the contest waged in laboratories, factories, power grids and procurement offices. The United States has begun treating AI-native telecommunications as an industrial-policy issue, with the National Telecommunications and Information Administration announcing a proposed redirection of the Public Wireless Supply Chain Innovation Fund towards AI-native radio access technologies, linking wireless innovation with American AI leadership and supply-chain resilience. China organized its response through a central-provincial programme in June 2026 via the Ministry of Industry and Information Technology, coordinating telecommunications operators, equipment manufacturers, regional authorities and research institutions around 6G technologies with objectives extending to 2029. For IT operations and infrastructure teams, this means geopolitical supply-chain fragmentation is hardening—dual-sourcing compute, residency requirements, and export controls on accelerators are no longer edge cases but baseline planning assumptions for global deployments.