Field Notes — Week of June 28, 2026
A short, opinionated digest of what actually mattered this week across cloud, security, AI, and automation — and what it means if you run real systems.
Security: a Check Point VPN zero-day that ransomware was already riding
The drop-everything item is CVE-2026-50751, a critical authentication bypass (CVSS 9.3) in Check Point Remote Access VPN, Mobile Access, and the Spark firewall line. It needs no credentials — an unauthenticated attacker reaching the gateway can bypass auth outright. The ugly part is the timeline: observed exploitation traces back to May 7, 2026, with a sharp uptick in early June, and at least one intrusion has already been tied to a Qilin ransomware affiliate. The fix landed weeks into active abuse.
This wasn’t alone. The same window saw confirmed exploitation of CVE-2025-67038 in Lantronix EDS5000 serial devices (CVSS 9.8 command injection), an authentication-bypass flaw in Splunk Enterprise’s PostgreSQL sidecar, and CVE-2026-20245 in Cisco Catalyst SD-WAN Manager — all the way down to Ubiquiti UniFi OS.
The take: The edge device is the breach now. VPN concentrators, firewalls, SD-WAN managers — the boxes that are the perimeter — are where the unauthenticated RCEs keep landing, and ransomware crews have industrialized the gap between disclosure and patch. Two moves: treat any internet-facing network appliance as a tier-zero asset with an emergency patch SLA measured in hours, not maintenance windows, and assume compromise on anything that was reachable before you patched. Rotate VPN credentials and certificates after you remediate Check Point — auth bypass means session and key material may already be in someone else’s hands.
Cloud: Google makes cross-cloud location data a first-class API
Google Cloud Location Finder is now generally available, and it’s a quietly useful primitive: a single API that returns current data on regions, zones, and Google Distributed Cloud Connected sites across Google Cloud, AWS, Azure, and OCI — queryable by provider, proximity, territory, and carbon footprint. It turns “where can we run this, and where’s the nearest comparable region on the other cloud” into a programmatic lookup instead of a spreadsheet someone maintains by hand.
It arrives alongside a broader multicloud-plumbing push — private high-speed interconnects between the major clouds are now a shipping product, not a promise — signaling that the hyperscalers have stopped pretending workloads live on one cloud.
The take: This is small but it’s the right kind of small. Region selection drives latency, data-residency compliance, and increasingly carbon reporting, and most teams still encode it as hardcoded constants. An authoritative, multi-provider source of truth lets you make placement a policy decision your IaC can read at plan time. Wire it into your landing-zone tooling rather than treating it as a console toy — the value is automation reading it, not a human browsing it.
AI: the agentic buying cycle hits its governance wall
Gartner’s latest puts the gap in stark numbers: it forecasts 40% of enterprise applications will embed task-specific AI agents by the end of 2026, up from under 5% a year ago — yet only about 21% of organizations have a mature governance model for autonomous agents, and Gartner projects over 40% of agentic AI projects will be cancelled by 2027. More than half of teams cite data quality as the top blocker.
The take: The technology is outrunning the operating model, and the cancellation forecast is the tell. The projects that die in 2027 won’t fail because the agents couldn’t act — they’ll fail because nobody could answer who approved the action, what data it touched, or how to roll it back. If you’re standing up agents this year, the unglamorous work is the work: identity for non-human actors, scoped and auditable permissions, data lineage, and a kill switch with an owner. Treat “the agent did something we can’t explain” as a Sev-1 design constraint, not an edge case to handle later.
Automation: Terraform and OpenTofu both ship in the same week
The fork keeps both forks busy. Terraform v1.15.7 shipped June 24, fixing submodule variable validation during init and tightening concurrency safety, days after v1.15.6 corrected how resources removed via removed blocks appeared in JSON plan output. On the other side, OpenTofu v1.12.2 landed June 12, with the 1.12 line carrying OCI registry support, native S3 state locking without a DynamoDB table, and experimental OpenTelemetry tracing.
The take: Two years past the relicensing, this is the healthiest possible outcome for buyers: two actively maintained engines shipping real fixes on independent cadences, with HCL portable between them. OpenTofu dropping the DynamoDB lock-table requirement is the kind of friction removal that quietly matters — one fewer piece of stateful AWS plumbing to provision and pay for. Pin your versions, watch both changelogs, and keep your modules engine-agnostic; the optionality is the asset, and it costs almost nothing to preserve.
ZelMor LLC helps organizations and consultancies with cloud architecture, AI enablement, security & IAM, and automation. If any of the above is a live question for your team, start a conversation.