Field Notes — Week of October 5, 2026
A short, opinionated digest of what actually mattered this week across cloud, security, AI, and automation — and what it means if you run real systems.
Security & IAM: the mail gateway and the AI gateway
CVE-2026-104286, a path-traversal flaw in Fortinet FortiMail (CVSS 9.8), lets an unauthenticated attacker write arbitrary files to the appliance. It is being exploited in the wild and was added to CISA’s Known Exploited Vulnerabilities catalog on October 2. The same day, GitLab disclosed CVE-2026-90970 (CVSS 9.9) in its AI Gateway: a logged-in user with platform access can execute commands on self-hosted gateways. Fixed in 19.2.4, 19.3.2 and 19.4.1.
The take: Two different flavors of the same problem — trusted infrastructure with too much reach. A mail gateway sees every message and often holds credentials to your directory; an arbitrary file write there is a foothold, not a nuisance. The GitLab bug matters for a different reason: AI gateways are new, fast-moving components that most teams haven’t put on their patch-SLA list yet. Add them. Self-hosted means self-patched.
Cloud: EKS 1.37 and the quiet end of an upgrade excuse
Amazon EKS and EKS Distro added support for Kubernetes 1.37 on October 2. The headline changes are the Metrics API graduating to GA and Dynamic Resource Allocation device taints and tolerations reaching GA. Alongside it, Amazon ECS gained native blue/green, linear and canary deployments through VPC Lattice with automatic rollback, and AWS Health introduced a Version Catalog covering RDS, EKS and Lambda lifecycle dates.
The take: DRA taints going GA is the one for anyone running GPU or accelerator nodes — it’s what makes scheduling around unhealthy devices a supported behavior rather than a script. The Version Catalog is the unglamorous winner: most “we’re stuck on an unsupported version” incidents are really “nobody tracked the date” incidents. Pull it into whatever owns your upgrade calendar.
AI enablement: AWS shows its migration agent work
On October 1, AWS Professional Services published how it built a multi-agent framework on Amazon Bedrock AgentCore to run enterprise cloud migrations: discovery, IaC generation, portfolio governance and post-migration operations, with AWS claiming IaC development time drops “from weeks to minutes.” A companion post covered ambient agents — agents triggered by events such as S3 uploads, schedules or alerts, using SQS, Lambda and DynamoDB, with human-in-the-loop approval steps.
The take: The ambient, event-driven pattern is where agents start paying for themselves, because nobody has to remember to ask. Treat the “weeks to minutes” figure as a vendor claim about generation speed, not delivery speed — review, testing and the change process don’t compress the same way. The part worth copying is the human-in-the-loop design; that’s what separates a pilot from something your risk team will let near production.
Automation: Terraform 1.16 settles in
HashiCorp’s September 28 post on Terraform 1.16 covers completed Actions lifecycles and import blocks inside child modules. The release also added a store block for ephemeral and sensitive values and provider-specific state preservation across plan and apply; v1.16.1 (September 2) fixed import handling with for_each/count. terraform graph now emits Mermaid via -format=mermaid. On the fork, OpenTofu v1.13.0-beta1 adds a -lint flag and Symbol Libraries, and drops the WinRM provisioner.
The take: Imports in child modules removes one of the more annoying reasons teams kept brownfield adoption as a root-module-only exercise. If you’ve been hand-wiring adoption of existing resources, revisit it. And if you’re evaluating OpenTofu, note the two tools are diverging on features — pick on the capabilities you actually use, not on principle.
ZelMor LLC helps organizations and consultancies with cloud architecture, AI enablement, security & IAM, and automation. If any of the above is a live question for your team, start a conversation.