Field Notes — Week of August 16, 2026
A short, opinionated digest of what actually mattered this week across cloud, security, AI, and automation — and what it means if you run real systems.
Security: a Cisco VPN flaw goes from advisory to federal deadline in three days
Cisco disclosed CVE-2026-20349 (CVSS 8.6) on Tuesday and confirmed active exploitation. It’s insufficient error checking on HTTP request processing: an unauthenticated remote attacker sends a crafted request to the Remote Access SSL VPN service and the device reloads. CISA added it to the KEV catalog on August 11 with an FCEB remediation deadline of August 14 — a three-day clock. There are no workarounds.
You’re exposed if you run one of the vulnerable configs: webvpn enable, IKEv2 remote access VPN with client services, or Zero Trust Network Access on FTD. Fixes are point releases on ASA (9.20.4.235, 9.22.3.191, 9.23.1.211, 9.24.1.221) and hotfix tarballs across FTD 7.0 through 10.0. The same KEV batch also picked up a Metabase zero-day granting unauthenticated admin access and a Windows AFD use-after-free.
The take: This is “only” a DoS, which is exactly why it will get deprioritized — and exactly why it shouldn’t be. Your remote-access VPN concentrator is the front door for the workforce; an unauthenticated reload loop is an outage of everyone’s ability to work, triggerable by anyone who can reach the interface. No workaround means no clever ACL buys you time. Patch the concentrators, and while you’re in there, ask the harder question: how many of your remote-access paths still terminate on a single appliance with no failover to a second vendor or an identity-brokered alternative?
Cloud: AWS makes modernization a process, not a project
AWS Transform continuous modernization went generally available this week. The framing matters more than the feature list: instead of a one-time mainframe or legacy migration event, it analyzes and remediates technical debt across source repositories on an ongoing basis, with Kiro Power and agent plugins for developer-tool integration. AWS also shipped DynamoDB vector search (embeddings stored and queried alongside existing items, no separate vector database) and raised Lambda network bandwidth to scale with memory — from 625 Mbps at 2 GB up to 3,000 Mbps at 10 GB for functions outside a VPC.
The take: Every migration program we’ve seen decay did so the same way: the “modernization project” ended, the funding stopped, and the debt started re-accumulating the next sprint. Tooling that treats modernization as a standing background process is the right model — but only if you also fund it as one. Before adopting anything here, decide who owns the remediation backlog after the consultants leave. On the Lambda change: if you’ve been chunking S3 transfers or fanning out to work around throughput ceilings, re-measure. Some of that architecture may now be unnecessary complexity.
AI: governance moves from the prompt to the policy engine
AWS open-sourced Dogwood, a governance language purpose-built for AI agents. It extends Cedar policies with temporal conditions, and it’s backed by new temporal policies in Amazon Bedrock AgentCore — authorization decisions that depend on the history of an agent’s actions within a session, not just the current request. Separately, Runtime Instances on AgentCore went GA, giving agents dedicated compute with predictable performance and cost.
The take: Temporal policy is the piece most agent stacks are missing. Per-call authorization can’t express “this agent has already read 400 customer records this session” or “it refunded once, don’t let it refund again.” That’s where real agent incidents live — not in a single bad call, but in a legitimate-looking sequence. If you’re piloting agents against anything regulated, evaluate this class of control now. And note the direction: Cedar is the same policy language AWS uses for human authorization. Agents are being folded into the IAM stack rather than governed beside it, which is where they belong.
Automation: a vendor-neutral packaging spec for agent extensions
AWS announced support for Agent Plugins, an open, vendor-neutral specification giving agent extensions a common packaging format — build once, ship to Kiro, VS Code, Cursor, or anything implementing the spec.
The take: MCP standardized how agents reach tools; this targets the layer above — how extensions get packaged and distributed. If your platform team is already maintaining three near-identical internal agent extensions for three IDEs, that’s the pain being addressed. It’s early, and vendor-neutral specs only matter once a second major vendor implements them, so don’t rewrite anything yet. Do structure new internal extensions so the packaging layer is thin and swappable.
ZelMor LLC helps organizations and consultancies with cloud architecture, AI enablement, security & IAM, and automation. If any of the above is a live question for your team, start a conversation.