Operations | Monitoring | ITSM | DevOps | Cloud

CSC's CISO Outlook 2026 report surveyed 300 senior technology and cybersecurity executives in the first quarter of 2026, split evenly across North America, Europe and the UK, and Asia-Pacific. When asked which cyber threats they had actually experienced in 2025, not which ones worried them but which ones happened, the answer at the top of the list was domain and DNS hijacking, and subdomain takeover. Ahead of ransomware. Ahead of malware.

On 20 August, Google Threat Intelligence published an analysis of a phishing cluster it tracks as UNC7005. Google assesses with moderate confidence that the cluster is connected to ICE RELIC, the Russian actor formerly tracked as APT29 and also known as Midnight Blizzard.

Deciding to buy open source support for Apache ActiveMQ is the easy part. Working out which vendor can actually keep a broker alive at three in the morning is considerably harder, because nearly every vendor in this market is vague in exactly the same places.

Major US banks have found AI agents operating inside customer accounts, signed in with credentials customers handed over themselves. Nothing was breached. The agents authenticated correctly, and some of them still did things nobody asked for. That gap between having access and having authority is the agentic AI security problem every enterprise running agents now owns.

Improving an AI agent means knowing which behaviors to change and where those changes will have the greatest impact. Insights in Datadog Agent Observability improves AI agents by analyzing agent traces to identify recurring cost and reliability problems. It then explains the causes of those problems, assesses their impact, and recommends fixes backed by evidence. At Datadog, we use Insights to improve the agent behind Insights.

A critical security vulnerability can put an entire business at risk before IT teams have even established where the problem lies. For CIOs, that means needing immediate answers about which systems are exposed, how essential business services could be affected and how quickly their teams can get ahead of the threat. That was the challenge facing organizations on October 21, when two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, emerged.

A tricky Google Cloud support ticket that spanned GKE, Private Service Connect (PSC), Networking, Hostnet, Kernel, and the Linux kernel itself.

Coroot's node-agent has had an eBPF CPU profiler for a long time. When something burns CPU, you open the flame graph and see which function. When something waits for the disk, you have nothing: the CPU profile is flat, because waiting does not consume CPU. The metrics for disk problems are always the same. Latency on a volume goes up, utilization hits 100%, queries slow down. Every chart agrees the disk is the bottleneck, none of them says what the database was doing while it waited. Flushing pages?

Making an SRE agent available in Slack sounds straightforward until you start thinking about what that agent can access. If it's connected to Kubernetes, you need to consider how Slack communicates with the agent, what infrastructure the agent can inspect, and who can ask it to do something. Making operational tools easier to use shouldn't mean exposing another service or giving everyone unrestricted access to production.