Field Notes — Week of June 22, 2026
A short, opinionated digest of what actually mattered this week across cloud, security, AI, and automation — and what it means if you run real systems.
Security: a PeopleSoft zero-day that hit before the advisory existed
The drop-everything item is CVE-2026-35273, an unauthenticated remote code execution flaw (CVSS 9.8) in Oracle PeopleSoft Enterprise PeopleTools. It needs no login and no user interaction — just network access over HTTP — and it lives in the Updates Environment Management component behind the Environment Management Hub (PSEMHUB). Oracle didn’t publish an out-of-band advisory until June 10, but Google’s Mandiant dates active exploitation to between May 27 and June 9, which means it was a true zero-day the entire time it was being used.
The crew behind it is the extortion group ShinyHunters (tracked by Mandiant as UNC6240), chaining old and zero-day bugs into a working gadget chain. Mandiant notified more than 100 organizations with vulnerable endpoints — 68% of them in higher education, mostly in the US. The University of Nottingham is among the first confirmed victims, with the group claiming it leaked tens of gigabytes including records on nearly half a million current and former students.
The take: Enterprise back-office apps are the perimeter nobody patches on a security clock. PeopleSoft runs payroll, HR, and student records — high-value data sitting behind internet-facing components that ops teams treat as appliances. Two moves: get PSEMHUB and any PeopleTools management surface off the public internet entirely, and stop assuming “we’ll get it in the next maintenance window” is fast enough. The window between exploitation and an Oracle advisory here was negative — attackers were in for two weeks before there was anything to patch against.
Cloud: AWS turns incident response into an agent you supervise
AWS DevOps Agent is now generally available, and it’s a real signal about where cloud operations is heading. It handles incident investigations, proactive reliability checks, and on-demand SRE tasks not just across AWS but Azure and on-prem too, with integrations spanning CloudWatch, Datadog, Splunk, New Relic, ServiceNow, PagerDuty, and Azure Monitor. AWS puts root-cause accuracy at 94% and early adopters report MTTR improvements up to 75%.
Critically, it investigates and recommends but does not execute code changes — for anything requiring code, it generates a spec for Kiro, AWS’s coding agent, and a human approves the mitigation plan before anything runs. GA shipped in six regions (us-east-1, us-west-2, eu-central-1, eu-west-1, ap-southeast-2, ap-northeast-1).
The take: The interesting design choice is the deliberate seam between “diagnose” and “act.” AWS could have built full closed-loop auto-remediation and chose not to — diagnosis is autonomous, action stays gated. That’s the right shape for production. The value is in collapsing the investigation phase, which is where most of your MTTR actually goes, while keeping a human on the change. If you adopt it, wire it to your existing observability first; the cross-cloud reach only pays off if the agent can see everything, not just your AWS estate.
Automation: Pulumi plants a flag on Terraform’s turf
Pulumi now positions Pulumi Cloud as a state backend and management plane for Terraform and OpenTofu directly — visibility, governance, policy, and its AI agent Neo layered over infrastructure you didn’t write in Pulumi’s SDK. Alongside it, the Pulumi CLI now treats HCL as a first-class language via a Terraform bridge, so you can run existing HCL through the Pulumi engine, and Neo ships Terraform-specific skills to migrate code and state.
This is a direct competitive move on HashiCorp Terraform Cloud, aimed squarely at teams unsettled by the BUSL relicensing and the IBM acquisition who want an exit ramp without a rewrite.
The take: The IaC market has stopped being “pick a tool” and become “pick a control plane.” Your .tf files are increasingly portable; the lock-in has migrated up to state, policy, and the management layer. That’s good for buyers — it means the stay-or-switch decision no longer requires abandoning your existing code. Evaluate the plane on governance and state handling, treat the agentic migration features as nice-to-have rather than the reason to move, and keep your state backend somewhere you’d be comfortable owning regardless of vendor.
AI: JPMorgan moves AI into the data-center budget line
JPMorgan set a 2026 technology budget of $19.8 billion, up roughly 10% year over year, and — more telling than the number — moved its ~$2 billion in annual AI spend out of the experimental innovation budget and into the same category as payment systems and data centers. AI is now classified as core infrastructure, not a bet.
The take: When the largest US bank reclassifies AI spend as non-negotiable infrastructure alongside cybersecurity, that’s a budgeting signal worth reading. It means the question inside serious organizations has shifted from “should we fund this” to “what’s the operating cost of running it forever.” Infrastructure budgets come with infrastructure expectations: SLAs, audits, identity and access controls, and lifecycle ownership. If your AI initiatives are still living on innovation-budget terms — best-effort, unmonitored, nobody on the hook — that’s the gap to close before the spend, not after.
ZelMor LLC helps organizations and consultancies with cloud architecture, AI enablement, security & IAM, and automation. If any of the above is a live question for your team, start a conversation.