Operations | Monitoring | ITSM | DevOps | Cloud

AI is transforming how infrastructure and platform teams design, deploy, and operate systems. As organizations move from experimentation to production, a clear pattern is emerging. AI can decide what should change, but it cannot safely control how those changes are executed. This creates a gap in modern architectures. That gap is filled by a control plane. That control plane already exists in Puppet Enterprise Advanced.

On June 9, 2026, the OpenSSL project released patches covering 18 vulnerabilities across its supported releases. The headline flaw, CVE-2026-45447, is rated high severity and has the potential for remote code execution. Not too long ago, a security advisory with 18 vulnerabilities would have been routine. Microsoft’s Patch Tuesday provided a predictable cycle, and organizations operated with the expectation of a meaningful remediation window. That model is under pressure.

You’re scaling your IT infrastructure so you can do more — deploying across clouds and data center, adding servers, coding like crazy. Great! But how do you keep it all from falling apart? Policy as code is an approach to managing IT that strategically leverages infrastructure as code (IaC) and compliance as code to manage consistent policies across complex IT environments. Sounds perfect, right?

Most teams first adopt policy as code (PaC) in their delivery pipelines. If something breaks a rule, the system stops it before it goes live. That is useful as it helps catch problems early but in real world environments, the hardest issues to resolve do not come from changes that fail validation. They come from changes that happen later, elsewhere, or outside the pipeline entirely.

Claude Mythos may be wrapped in hype, but the core signal is real: AI is making vulnerability discovery much faster, which means defenders have less time than ever to patch and enforce secure configurations. The real risk isn’t just smarter models, it’s that security teams will face a flood of new findings while the window between disclosure and exploitation keeps shrinking.

In early 2026, two back-to-back Linux kernel exploits, Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284 & CVE-2026-43500), shattered assumptions about how quickly attackers can weaponize disclosed CVEs. Dirty Frag, a zero-day Linux vulnerability that affected most major distributions, had PoC exploits published within hours of its disclosure. It’s a stark reminder: the timeline between vulnerability disclosure and active exploitation has shrunk from weeks to hours.

I’ve been doing this for over thirty years. Sysadmin, ops lead, global teams, and more data centre migrations than I’d like to admit. Site to site, P2V, V2V, cloud, hybrid, all of it. Every migration gets sold as a clean, well-planned transition. None of them are. They go wrong in very predictable ways. Not because moving infrastructure is especially difficult, but because nobody ever has a clear, current view of what’s actually running, what’s changed, and what still matters.

Poland’s implementation of the EU’s NIS2 Directive marks a decisive shift in how organisations think about cybersecurity, resilience, and operational risk. With amendments to the Act on the National Cybersecurity System (KSC Act) entering into force on 3 April 2026, enforcement expectations are now real, national, and significantly stricter than many organisations anticipated – including obligations for security controls, incident response, and supply‑chain governance.