Operations | Monitoring | ITSM | DevOps | Cloud

October was about making Scout’s data easier for AI tools to use and easier for your team to trust. Scout is now in Claude’s connector directory, the MCP server got leaner and more careful about what it returns, and Scout Trails opened its beta. Anomaly Detection also became easier to read and better at catching short spikes. Here’s what shipped in October.

TL;DR On October 21, 2026, PHP released emergency patches for two critical flaws known together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). An attacker with no credentials can use them to run code on a PHP web server, in some cases with a single HTTP request. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 now. Then go through your logs, because exploitation attempts were recorded before the patch shipped. In this post.

Earlier this year, I spent time with technology leaders across four major cities – San Diego, Boston, London and Dallas, as part of four Leadership Circles. Taken together, the conversations reinforced how far digital employee experience has matured for many organizations. The focus has shifted from understanding why DEX matters to exploring what it takes to operationalize its success. San Diego focused on the changing role of IT and the strategic case for DEXOps.

When a critical flaw surfaces in the language behind a large share of your web applications, how quickly can your organization name every server that runs it? PHP2Shell puts that question in front of every IT leader who runs PHP. The answer decides how long the business stays exposed. Here's the short version. PHP2Shell covers two flaws in the PHP engine, and either one lets an attacker run code on a web server with no login at all.

In December 2021 we wrote VMware Monitoring: Why Opslogix is the right choice for you. At the time, vSphere 7 was new, Kubernetes was coming to vSphere, and the Log4j vulnerability was in the news. A lot has changed since then. vSphere 9 and SCOM 2025 are here, ransomware gangs now target ESXi hosts directly, and many organizations are reconsidering how they monitor their VMware estate.

In the last few months we have focused more on improving the usefulness of our service status pages, added new sections for outages and reliability, and improved SEO (that's part of the business!). Product changes include new services and improvements in parsing and detection.

Since Sentry added Logs and Application Metrics, there are now two ways to record that something happened in your app, and they can look pretty similar: Sentry.logger.info("user.signup") versus Sentry.metrics.count("user.signup"). Both store attributes, both include shared context automatically, and both can be filtered, grouped, and counted. So when you’re instrumenting your code, which one do you reach for?

AI agent costs accumulate along more dimensions than a model-call count. Spend is a product of both which models you call and how the agent is architected: how many turns the loop runs, how many tools it invokes, how much retrieved context it carries, and how much of that context is re-sent on every turn. Provider bills tell you how much you spent, but they’re keyed to API keys and models instead of the applications and workflow steps that generated the calls.

Scope: this guide covers tools for tracing and evaluating the LLM apps and agents your team builds. If you also want the second meaning of AI observability, where AI agents investigate production incidents, read our guide to the best AI observability tools of 2026.