Field Notes: the Cohash blog

Look for the Uncapped User Profile Data toggle in every tenant. If it's on, your migration period ends on 4 March 2027 and Auth0 applies the limit some time after.

Security · Oversized Auth0 profiles can break logins after 4 March 2027. Here's how to find yours

Both flaws are exploited, neither has a workaround, and either one can give an attacker root from a single email.

Security · You patched your Cisco email gateway. One email can still take it over.

RSAT's support runs out after May 15, 2027. Nobody at Microsoft is going to pick the replacement for you.

Engineering · Microsoft is dropping RSAT in May 2027. What tests Finance and Operations after that?

Auth0 retires Legacy Custom DB User Import on 20 January 2027. After that, someone who clicks a reset link or gets breach-blocked on a first login is imported right away, even if they never log in.

Security · Auth0's lazy migration changes on 20 January 2027, and half-imported users won't fix themselves

From January 2027, AI Functions in SQL return an error on any Databricks Runtime below 17.3 LTS. ai_similarity and the AI Functions REST API are exempt.

AI and data · Your Databricks AI Functions need Runtime 17.3 LTS by January 2027, even if 15.4 is still supported

If SSL VPN uses SAML on a Gen7 or Gen8 SonicWall, upgrade today: 7.3.4-7013 or later, NSv 7.3.4-7015, Gen8 8.2.3-8015.

Security · SonicWall's SSL VPN bug lets a valid password skip SAML and your MFA

Self-hosted Secret Server at 12.2.7 or earlier needs 12.3.000002. No hotfix or workaround is listed.

Security · Delinea Secret Server login bypass: why 12.2.7 won't save you from this 9.9

Over 100% after borrowing means no create, copy, restore or recover, from day 0, on production as well as sandboxes.

Engineering · Dynamics 365 storage limits start to bite on 9 November: what gets blocked, how to get out

Entra's documentation says SSPR only accepts registered methods from February 2027, but the archived notice still says November, so check your own tenant today.

Security · Entra password reset won't take directory phone numbers from February 2027. Who gets stuck?

Install your distribution's fixed kernel and reboot, or use a livepatch your vendor confirms for this CVE. Filters and MPTCP changes leave the bug in place.

Security · Linux kernel CVE-2026-98432: why switching off MPTCP won't save you, and what to patch

Patch Linux for CVE-2026-98432 and reboot. The new kernel doesn't protect you until it's the one running.

Security · Patch roundup, week of Nov 2: fix Linux and WS_FTP first, then work down the list

Export to Azure Data Lake stops on November 30, 2026, with no extensions. Files stay, new data doesn't arrive.

AI and data · Export to Azure Data Lake stops on November 30. Is your Finance and Operations close ready?

Decide on where your people work and how you want to pay first. Compare unit prices after that.

AI and data · Databricks vs Snowflake vs Microsoft Fabric: which one fits, and what it costs to change your mind

Mule 4.12 Edge leaves standard support in November 2026. CloudHub moves Edge apps still on it to the latest Edge minor version six weeks later.

Engineering · Mule 4.12 Edge leaves standard support this month. Upgrade to 4.13 before CloudHub does it for you

RSA's dates land at the end of the month: December for older Windows agents, January for 8.7 SP2, March for more authenticators.

Security · RSA SecurID primary support ends in stages from December. Here's how you get to 8.9

No vendor tool moves a vault between CyberArk and Delinea. Budget for a rebuild with a data load at the end.

Security · CyberArk to Delinea (and back): what a PAM migration really involves

Choose on entities, countries, operations and audit load first. Compare licence prices after that.

Engineering · Dynamics 365 Business Central vs Finance and Operations: which one you actually need

Zendesk accounts can no longer create Support API tokens, apart from exceptions granted by Zendesk Support. Treat the one in Entra as irreplaceable.

Security · Zendesk is killing API tokens, and your Entra ID provisioning still runs on one

Terraform Enterprise 2.1.0 came out on October 26, 2026 and 2.1.1 on November 3. Both carry changes someone has to own.

Cloud · Terraform Enterprise 2.1 moves VCS ingress into your agents. What to change before October 2027

Remote Support 24.3 and Privileged Remote Access 24.3 lose support on 30 November 2026. 24.2 already ran out in July.

Security · BeyondTrust Remote Support and PRA 24.3 lose support in November, and there's no one-step upgrade

From 1 December 2026, any user without Use Any API Auth gets turned away at SOAP API login(). Sandboxes are no exception.

Security · Your Entra-to-Salesforce provisioning breaks on December 1. One permission fixes it

4.19 maintenance ends December 17, 2026 with no extension. Update those clusters to 4.20 first.

Cloud · OpenShift 4.19 is running out of support. Do you park on 4.22 or keep going to 5.0?

New Databricks workspaces have had no Hive metastore since 8 October 2026. Existing ones still work, but new workspaces can't use the old catalog.

AI and data · Hive metastore to Unity Catalog: the Databricks migration plan, and what breaks on the way

On 1 December, 2.5 Pro calls start landing on 3.8 Flash and 2.5 Flash calls on 3.5 Flash-Lite. You pay their rates, and your code won't tell you it happened.

AI and data · Gemini 2.5 Pro and Flash calls change models on 1 December. What breaks, and what we'd do first

Plan for anything still sitting in Agent Builder, saved prompts or Evals on 30 November to be out of reach. ChatKit and the models keep working.

AI and data · Agent Builder, Evals and saved prompts shut on 30 November. Here's what to pull out first

Password Safe 24.3.x support ends on 31 December 2026. 24.2.x already ended in September.

Security · Password Safe 24.3 runs out of support in December, and 26.3 is still one upgrade away

Medicare Advantage and state fee-for-service programs need the four APIs on January 1, 2027. Medicaid managed care follows each contract's rating period, and exchange plans follow the plan year.

Engineering · CMS-0057-F on January 1, 2027: what health plans on Facets, QNXT and HealthRules need live

AX 2012 R3 has had no Microsoft fixes since January 2023, and R2 none since April 2022.

Engineering · Still running Dynamics AX 2012? When to upgrade to Finance and Operations and when to start over

Each sync server has to be on 2.6.84.0 or later and signing in with application-based authentication by 7 April 2027. Miss either and it stops syncing, and the first sign is usually a new starter who can't log in.

Security · Upgrade Entra Connect Sync before April 2027 and move users off Microsoft's SMS codes

Chrome 158 stops running XSLT on 17 November, and Edge 159 follows in the week of 10 December. Message Viewer and Visual Trace stop rendering XML properly on unfixed builds.

Engineering · Chrome drops XSLT on 17 November. What breaks in InterSystems, and the fix for your version

MemberOf groups, admin units and auto-assignment policies freeze on 3 November 2026. Find them, rewrite or convert them, and swap targets before then.

Security · What breaks in Entra ID this November: MemberOf, the PIM beta APIs and agent permissions

Someone with no login can run code on a self-managed GitLab server through CVE-2026-97229. CISA lists it as exploited, so don't wait for the next change window.

Security · Patched GitLab, still exposed: the CI regex bug CISA lists as exploited, and the Ruby step people miss

Builds 22.8R2.5 and 25.1.1.2 closed only the first bug. Go to 25.1.1.3 or 22.8R2.6 to close all three.

Security · Patched Ivanti Connect Secure in October? Two more exploited bugs, and the AD cleanup

Upgrade self-hosted Delinea Secret Server to 12.2.7 or 12.3.000002 today. The FIDO2-only hotfixes leave other critical flaws open.

Security · Patch roundup, week of Oct 26: upgrade Secret Server today, then work down the list

Orchestrator, Studio and Robot 2023.10 have no support left. Automation Suite users get until November 3, 2026, which isn't long enough to plan much.

Engineering · UiPath 2023.10 support has run out and 2024.10 is next. What we'd upgrade first

The November cut-off is gone. Hooks now stop at the end of April 2027 and Rules at the end of January 2028, so plan two cut-overs.

Security · Auth0 moved the Rules and Hooks deadline: Hooks stop on 30 April 2027, Rules on 31 January 2028

On March 5, 2027 Okta turns off self-service registration, Desktop SSO through IWA and Mobile Device Trust on Classic Engine orgs.

Security · Still on Okta Classic Engine? Three features stop working on March 5, 2027, and two of them block the upgrade

ECC 6.0 on EHP 6, 7 or 8 leaves mainstream maintenance on December 31, 2027. Anything older already left in 2025.

Engineering · SAP ECC mainstream maintenance ends in 2027: what you need to decide this quarter

Aim to finish before November 2026, as Microsoft asks. SAP deletes API basic auth on 12 November 2027 and switches it off by default sometime in the first half of 2027.

Security · SuccessFactors basic auth is going away: moving Entra HR provisioning to workload identity

The flaw is in Google's Brotli library, so it reaches well past Node.js. Check Python, .NET, proxies and firewalls too.

Security · Brotli CVE-2026-111497 is now on CISA's exploited list, and you probably run more copies than you think

Check which Entra tier you already own before comparing list prices. Microsoft 365 E3 includes P1 and E5 includes P2.

Security · Okta vs Microsoft Entra ID for enterprise security. Start with what you already pay for

ECC mainstream maintenance ends at the end of 2027 and extended maintenance at the end of 2030, so pick a decision date now.

Engineering · What an SAP S/4HANA migration actually costs: the drivers, the ranges and where budgets break

HCP Terraform bills managed resources per hour and Vault bills clients, so count both yourself before any renewal.

Cloud · Terraform and Vault under IBM: what the bill depends on, and when OpenTofu or OpenBao makes sense

Palo Alto says CyberArk customers can keep using the platform as they always have. Use the renewal to get support dates and roadmap answers in writing.

Security · CyberArk, Delinea or BeyondTrust? Choosing PAM now that CyberArk is Idira

On January 31, 2027, v1.3 to v1.7 leave the dbt platform. Whatever's still pinned to them gets cleaned up, so check now.

AI and data · dbt drops v1.3 to v1.7 from its platform on January 31, 2027: get pinned jobs onto a release track before they're deleted

Start from your app list. Where each app signs in, and how much is on-premises or SAP, decides most of this.

Security · SailPoint, Saviynt or Entra ID Governance? Start with where your apps live

Tokens come from Okta or Entra. Owners and reviews come from SailPoint, and Idira locks down risky access. Expect to run two of these.

Security · Okta, Entra Agent ID, SailPoint or CyberArk? Who actually does what for your AI agents

Move Verify Identity Access to 11.0.3.2 and Security Verify Access to 10.0.9.4. IBM lists no workaround.

Security · IBM Verify Access flaws let attackers run code without a login: patch to 11.0.3.2

Foundry stops supporting the workflow designer and in-portal runs on December 1, 2026. Export every workflow's YAML before then.

AI and data · Foundry Workflows retire on December 1. We'd start moving yours to Agent Framework now

The four older models stop answering on 1 April 2027. Anything still calling them breaks that day, so start with the inventory.

AI and data · Vertex AI is retiring text-embedding-005 and three other embedding models: how to re-embed before search breaks

Azure is rolling out a block on writes from user accounts that skipped MFA, whatever tool they use, and there's no opt-out.

Security · Azure mandatory MFA now blocks CLI, PowerShell and Terraform changes: moving service accounts to workload identities

New Teams environments stop on 15 November 2026. Existing ones go dark on 15 September 2027 unless somebody upgrades them, so start counting now.

Engineering · Dataverse for Teams is going away: what to keep, move or let go before September 2027

Self-hosted Secret Server needs 12.3.000002 or later. 12.2.7 fixes all four September CVEs, but newer flaws affect it.

Security · Delinea Secret Server auth bypass: why the FIDO2 hotfix isn't enough

Right now the limit is 200 days. It drops to 100 in March 2027 and 47 in March 2029, so start on the automation now.

Security · TLS certificates drop to 100 days in 2027 and 47 in 2029. Here's what breaks, and how to automate renewals first

OIG, OAM, OUD and OID 12.2.x leave Premier Support on December 31, 2026. After that, new quarterly patches go only to customers who pay for Extended Support.

Security · Oracle Identity Governance and OAM 12.2.1.4 lose Premier Support on December 31: upgrade to 14c or replace?

Update Oracle Java to the October 24 build for your line: 8u511-b33, 11.0.33.0.3, 17.0.21.0.3, 21.0.13.0.3, 25.0.5.0.3 or 27.0.1.0.3.

Security · Oracle's eMudhra alert now covers Database Server: patch, then test what breaks

SAP IdM leaves mainstream maintenance in 2027 and there's no IdM 9.0. Extended maintenance to 2030 costs extra and only buys time.

Security · SAP Identity Management ends in 2027: Entra ID, SailPoint or Saviynt?

VMware is subscription-only now, counted per core with a 16-core floor per CPU. Price the exit before you sign the renewal.

Cloud · Leaving VMware after Broadcom: OpenShift Virtualization, Nutanix or cloud, and what the move really takes

On January 12, 2027 the security fixes for Windows Server 2016 stop. Your servers keep running, they just don't get patched.

Cloud · Windows Server 2016 support ends January 12, 2027: what to upgrade, what to move, and when ESUs make sense

Every agent needs a named business sponsor before it gets a credential, and the leaver process has to move that sponsorship.

Security · Who owns your AI agents? How to find them, give each one a sponsor and stop their access creeping

Disabling an agent stops new tokens and nothing else. Anything it already holds works until expiry, unless the app checks back.

Security · Stopping a rogue AI agent: kill switches, token revocation and what OAuth can't do yet

Govern agents where they're built. A fix in the pipeline reaches every agent built after it.

Security · From AI development to AI governance with AIDLC

Self-hosted Remote Support up to 26.2.3 needs BT26-05-RS today. Older than 24.3.1, upgrade first and then patch.

Security · BeyondTrust Remote Support zero-day: patch it, then check who got in

Move PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch, and keep session upload progress off until PHP's next release. No setting fully covers these bugs, so the upgrade is the core fix.

Security · Patch PHP and Node.js this week: what broke and who's exposed

If you're on 4.14, check that you own Term 3. Term 2 ended October 31, 2026, so without Term 3 the cluster is already unsupported. With it, you've got until October 31, 2027.

Cloud · OpenShift support dates through 2027: which clusters run out first and how to plan the upgrades

Patch EBS Application Object Library first, since it's now reported exploited, then the Workflow mailer and Oracle Access Manager. None of them needs a login, and they usually face users.

Security · Oracle's October security patches: what to fix first in EBS, PeopleSoft and Access Manager

Vault 2.2.0 came out on October 15. A week later 2.2.1 followed with a root-policy alias fix, along with Enterprise 1.21.13 and 1.19.24. Treat those as the new minimums.

Security · HashiCorp Vault 2.2 explained: TPM login, post-quantum PKI and the October fixes

9.0 moves to Jakarta EE 10 and drops WebLogic and Solaris. For WebLogic and Solaris sites that means a server move before the upgrade.

Security · Upgrading to SailPoint IdentityIQ 9.0: what breaks and what to fix first

1.17.0 came out October 21, 2026, and the upgrade guide has no extra steps. Still test it on a lower environment before production.

Cloud · Terraform 1.17 explained: what's new, who it touches and how we'd upgrade

Give every agent its own identity and record who it's working for. Then cap it at what that person could actually do by hand.

Security · Is your AI agent running on someone else's login? Give it its own, and cap what it can do

Pay for named people over a logo, and lock the delivery staff and the substitution terms into the contract.

Security · How to choose an IAM implementation partner

Split the work: pay for experience on the one-shot foundations, and grow your own people for anything you'll be running for years.

Cloud · In-house or consultancy? How to split a cloud migration so your team ends up owning it

Connector work dominates and scales with difficulty, not count. Tier every application before comparing quotes.

Security · What a SailPoint implementation actually costs

Start with identity governance. Clean up who has access before you build detailed access policies, but don't wait on it to turn on multi-factor sign-in.

Security · Zero trust means proving every access. Here's how to start, and what to do if someone's already in.

Price every cross-cloud data path at twelve months of production volume before you commit to it.

Cloud · The multi-cloud tax, and how to stop paying it

Assume retrieval fails silently. Hybrid search, reranking, structure-aware chunking and an index freshness SLO are where you start, before any polish.

AI and data · RAG in production: what actually breaks

Translate entitlements into business language before asking anyone to certify them. Bad data makes every attestation worthless.

Security · The access review nobody dreads

Give each decision its own freshness SLO and show the data's age right on the dashboard that serves it.

AI and data · Your dashboard is lying by twelve hours

Keep conditional access policies in version control and peer-review the changes. Incident questions then turn into plain git queries.

Security · Conditional access is a policy, not a prayer

Measure voluntary adoption. Mandated coverage tells you nothing about whether a platform works, because teams had no choice.

Engineering · Golden paths beat golden cages

The limit is 50KB. The 10KB you may still see was the first target, and tenants were flagged against it, so a toggle that's on doesn't prove anyone is over 50KB.

Security · Oversized Auth0 profiles can break logins after 4 March 2027. Here's how to find yours

16.0.4-302 covers only the SQL injection. Update Content Scanner Tools now and plan the move to 16.5.

Security · You patched your Cisco email gateway. One email can still take it over.

The list says on-premises while other pages apply no limit. Plan as if it covers you and ask Microsoft to confirm.

Engineering · Microsoft is dropping RSAT in May 2027. What tests Finance and Operations after that?

Users already stuck in a partial import stay stuck. Find them and clear them with Delete a connection user, then let them migrate again.

Security · Auth0's lazy migration changes on 20 January 2027, and half-imported users won't fix themselves

15.4 LTS and 16.4 LTS are still supported after that date, so lifecycle reports won't flag them. Check runtime versions yourself.

AI and data · Your Databricks AI Functions need Runtime 17.3 LTS by January 2027, even if 15.4 is still supported

There's no workaround. If you can't upgrade yet, turn SSL VPN off or limit it to known addresses.

Security · SonicWall's SSL VPN bug lets a valid password skip SAML and your MFA

Check the live CVE record. Delinea moved this flaw from 8.7 to 9.9 six days after publishing it, so old tickets may be wrong.

Security · Delinea Secret Server login bypass: why 12.2.7 won't save you from this 9.9

Affected sandboxes go admin-only at day 30 and shut at day 90. Production stays open, but you lose your restore route.

Engineering · Dynamics 365 storage limits start to bite on 9 November: what gets blocked, how to get out

Register people on methods that survive April, usually an app or token plus email, and test that pair against your policy first. Microsoft's SMS and voice stop counting for SSPR too.

Security · Entra password reset won't take directory phone numbers from February 2027. Who gets stuck?

Turning off MPTCP blocks the setup Anthropic's exploit used. It doesn't fix the flaw, and RHEL is still affected with MPTCP off.

Security · Linux kernel CVE-2026-98432: why switching off MPTCP won't save you, and what to patch

Take WS_FTP Server to 2025.0.4 or 2024.0.7. Nothing lower closes all fifteen flaws.

Security · Patch roundup, week of Nov 2: fix Linux and WS_FTP first, then work down the list

Stale data won't always raise an error, so add a freshness check and don't rely on green refreshes.

AI and data · Export to Azure Data Lake stops on November 30. Is your Finance and Operations close ready?

Fabric only runs on Azure. If your data already lives on AWS or Google Cloud, look at Databricks and Snowflake first.

AI and data · Databricks vs Snowflake vs Microsoft Fabric: which one fits, and what it costs to change your mind

Use the six-week window to upgrade to 4.13 yourself, in sandbox first, on a date your team picks.

Engineering · Mule 4.12 Edge leaves standard support this month. Upgrade to 4.13 before CloudHub does it for you

Check the appliance model first. It can turn an upgrade into a rebuild.

Security · RSA SecurID primary support ends in stages from December. Here's how you get to 8.9

Map safes, platforms and dual control to folders, templates and approvals before anyone writes an import file.

Security · CyberArk to Delinea (and back): what a PAM migration really involves

Business Central Premium lists at $110 a user a month and Dynamics 365 Finance at $210, both paid yearly. Partner work comes on top.

Engineering · Dynamics 365 Business Central vs Finance and Operations: which one you actually need

Don't rotate or delete it. Check its Last used date and keep it in a vault with an owner.

Security · Zendesk is killing API tokens, and your Entra ID provisioning still runs on one

Public self-registration is off after the upgrade unless the instance uses SAML. Invitations, SAML just-in-time provisioning and SCIM still work.

Cloud · Terraform Enterprise 2.1 moves VCS ingress into your agents. What to change before October 2027

There's no direct path from 24.3 to 26.x. Go through 25.1 or 25.2, then 25.3.5, then on to 26.x as your /appliance update list allows.

Security · BeyondTrust Remote Support and PRA 24.3 lose support in November, and there's no one-step upgrade

That's how Entra's Salesforce connector gets in. Give the Admin Username account the permission and run Test Connection while there's time.

Security · Your Entra-to-Salesforce provisioning breaks on December 1. One permission fixes it

You can't jump from 4.19 or 4.20 straight to 5.0. Red Hat only offers 5.0 from 4.22.17 or later, and only in the fast and candidate channels for now.

Cloud · OpenShift 4.19 is running out of support. Do you park on 4.22 or keep going to 5.0?

SYNC only re-registers external tables. Managed tables in the DBFS root need DEEP CLONE or CTAS, and views have to be recreated.

AI and data · Hive metastore to Unity Catalog: the Databricks migration plan, and what breaks on the way

Prefilled model turns, thinking_level minimal on 3.8 Flash and dropped thought signatures fail with errors. Ignored temperature fails quietly.

AI and data · Gemini 2.5 Pro and Flash calls change models on 1 December. What breaks, and what we'd do first

A ChatKit chat on an Agent Builder workflow needs a new backend. Export the workflow as Agents SDK code this week.

AI and data · Agent Builder, Evals and saved prompts shut on 30 November. Here's what to pull out first

26.3 is the newest release that accepts 24.3.0 as a direct upgrade source. Target it rather than waiting for the next one.

Security · Password Safe 24.3 runs out of support in December, and 26.3 is still one upgrade away

Facets, QNXT and HealthRules hold the data, but none of them runs the APIs for you. Most of the work is mapping and feeds into a FHIR layer.

Engineering · CMS-0057-F on January 1, 2027: what health plans on Facets, QNXT and HealthRules need live

Only R2 and R3 can be upgraded to Finance and Operations. RTM and older versions mean a reimplementation.

Engineering · Still running Dynamics AX 2012? When to upgrade to Finance and Operations and when to start over

Auto-upgrade won't get you there. It stops at 2.6.3.0 and doesn't switch the sign-in, so upgrade by hand, run the wizard task on every server and confirm it says Application.

Security · Upgrade Entra Connect Sync before April 2027 and move users off Microsoft's SMS codes

If you run 2025.1 or 2026.1, you're in the easy group. Install the .6 build, which has been out since 28 October, after a test run.

Engineering · Chrome drops XSLT on 17 November. What breaks in InterSystems, and the fix for your version

PIM iteration 2 went dark on 28 October. Search your scripts for beta/privilegedAccess and move whatever turns up to iteration 3.

Security · What breaks in Entra ID this November: MemberOf, the PIM beta APIs and agent permissions

Upgrade straight to the October 29 build on your line, so all four regex bugs are closed in one window.

Security · Patched GitLab, still exposed: the CI regex bug CISA lists as exploited, and the Ruby step people miss

Take memory and disk images before you patch a box that ran an affected build online since October 3.

Security · Patched Ivanti Connect Secure in October? Two more exploited bugs, and the AD cleanup

PHP hosts need the kernel update too, and a reboot. CISA says the kernel bug can be chained with PHP2Shell to get root.

Security · Patch roundup, week of Oct 26: upgrade Secret Server today, then work down the list

2024.10 still gets critical security fixes until October 21, 2027, or November 11 on Automation Suite. After that it's on its own.

Engineering · UiPath 2023.10 support has run out and 2024.10 is next. What we'd upgrade first

Move Hooks first. They're fewer, but they sit on M2M tokens, sign-ups and SMS paths people forget.

Security · Auth0 moved the Rules and Hooks deadline: Hooks stop on 30 April 2027, Rules on 31 January 2028

Check the Admin Console footer. A version ending in C means you're on Classic and need to act.

Security · Still on Okta Classic Engine? Three features stop working on March 5, 2027, and two of them block the upgrade

Extended maintenance runs to the end of 2030 and costs two percentage points more on your maintenance basis. Check your add-ons, because it doesn't cover all of them.

Engineering · SAP ECC mainstream maintenance ends in 2027: what you need to decide this quarter

The switch is in place, with no need to recreate the configuration, but it needs SAP Cloud Identity Services in front of SuccessFactors.

Security · SuccessFactors basic auth is going away: moving Entra HR provisioning to workload identity

Fixed library lines are 1.0.10, 1.1.1 and 1.2.1. Products that bundle Brotli need their own update.

Security · Brotli CVE-2026-111497 is now on CISA's exploited list, and you probably run more copies than you think

Okta earns its cost when much of your estate isn't Microsoft, or when you want sign-in to survive a move away from Microsoft.

Security · Okta vs Microsoft Entra ID for enterprise security. Start with what you already pay for

Custom code, customer and vendor data, testing and the licence recount drive the bill. Measure each one before taking bids.

Engineering · What an SAP S/4HANA migration actually costs: the drivers, the ranges and where budgets break

Kubernetes objects in Terraform state and Vault namespaces are the two quiet multipliers. Move or merge them first.

Cloud · Terraform and Vault under IBM: what the bill depends on, and when OpenTofu or OpenBao makes sense

Start from your own counts of accounts, servers, vendors and connectors. They decide the shortlist and the price.

Security · CyberArk, Delinea or BeyondTrust? Choosing PAM now that CyberArk is Idira

Check each job's effective version. A job override beats the environment setting, so a supported environment can still hold a legacy job.

AI and data · dbt drops v1.3 to v1.7 from its platform on January 31, 2027: get pinned jobs onto a release track before they're deleted

Entra ID Governance fits Microsoft-first estates. It can't apply review results to groups still managed in AD, and deeper SoD needs a partner tool.

Security · SailPoint, Saviynt or Entra ID Governance? Start with where your apps live

Start with your biggest gap. For some teams it's agents still borrowing people's logins, for others it's agents nobody owns, or agents that can change production with nobody watching.

Security · Okta, Entra Agent ID, SailPoint or CyberArk? Who actually does what for your AI agents

Ignore trackers that call 11.0.3.1 or 10.0.9.3 fixed. IBM's bulletin and container page put the fix one step higher.

Security · IBM Verify Access flaws let attackers run code without a login: patch to 11.0.3.2

You don't lose the logic. Deploy the exported YAML as a hosted agent and Foundry runs it again, on a service that's out of preview.

AI and data · Foundry Workflows retire on December 1. We'd start moving yours to Agent Framework now

Changing the model means re-embedding everything you've stored. Old and new vectors can't be mixed in one index.

AI and data · Vertex AI is retiring text-embedding-005 and three other embedding models: how to re-embed before search breaks

Managed identities and service principals aren't affected, so that's where every script should end up.

Security · Azure mandatory MFA now blocks CLI, PowerShell and Terraform changes: moving service accounts to workload identities

The upgrade keeps everything. Users then need Power Platform licences, though, and the data counts against capacity you pay for.

Engineering · Dataverse for Teams is going away: what to keep, move or let go before September 2027

The FIDO2 hotfixes (12.1.3, 12.0.23, 11.9.48, 11.8.2, 11.7.62) leave the SAML and padding oracle bugs open.

Security · Delinea Secret Server auth bypass: why the FIDO2 hotfix isn't enough

From 2029 a domain check can only be reused for 10 days. Automate validation along with renewal, or someone ends up doing it by hand.

Security · TLS certificates drop to 100 days in 2027 and 47 in 2029. Here's what breaks, and how to automate renewals first

Extended Support runs to December 31, 2027 and costs extra on top of your Premier fees. It's a bridge for a project that's already started.

Security · Oracle Identity Governance and OAM 12.2.1.4 lose Premier Support on December 31: upgrade to 14c or replace?

Oracle added Database Server, OPatch, Autonomous Health Framework and Cruise SPMS on October 30. Client-only database installs don't get this patch.

Security · Oracle's eMudhra alert now covers Database Server: patch, then test what breaks

Microsoft says SAP recommended Entra ID, but SAP's own message is about connecting its cloud identity services and IAG to partner tools. SailPoint and Saviynt are real options too.

Security · SAP Identity Management ends in 2027: Entra ID, SailPoint or Saviynt?

On Azure VMware Solution pay-as-you-go? Bring your own VCF licence by October 31, 2026, the same rule Google and AWS now apply.

Cloud · Leaving VMware after Broadcom: OpenShift Virtualization, Nutanix or cloud, and what the move really takes

2016 ESUs last three years at most and aren't free on Azure Local. Microsoft hasn't promised them free on Azure VMs either.

Cloud · Windows Server 2016 support ends January 12, 2027: what to upgrade, what to move, and when ESUs make sense

Run agent discovery on a schedule across your agent platforms, identity logs, vaults and MCP gateways. One console never shows them all.

Security · Who owns your AI agents? How to find them, give each one a sponsor and stop their access creeping

Block the agent at the gateway first. Nothing else stops its tool calls as fast.

Security · Stopping a rogue AI agent: kill switches, token revocation and what OAuth can't do yet

No credential before an approved registration that names a sponsor, a purpose, the tools and a retirement trigger.

Security · From AI development to AI governance with AIDLC

Patching doesn't remove an attacker who's already in. Treat exposed appliances as possibly compromised until they've been reviewed.

Security · BeyondTrust Remote Support zero-day: patch it, then check who got in

Update Node.js to 26.12.1, 24.22.1 or 22.23.4, rebuild images and confirm what's running.

Security · Patch PHP and Node.js this week: what broke and who's exposed

4.19 maintenance ends December 17, 2026 and odd versions get no extension, so 4.19 clusters move to 4.20.

Cloud · OpenShift support dates through 2027: which clusters run out first and how to plan the upgrades

Treat HTTP in a risk matrix as HTTP and HTTPS. TLS doesn't take you off the list.

Security · Oracle's October security patches: what to fix first in EBS, PeopleSoft and Access Manager

Patch to 2.1.2 or later first. The October fixes change how deny rules, plugin paths and ACME behave.

Security · HashiCorp Vault 2.2 explained: TPM login, post-quantum PKI and the October fixes

Custom code that uses Jakarta EE javax.* packages is the code most likely to need work, so inventory it and run SailPoint's readiness scan early.

Security · Upgrading to SailPoint IdentityIQ 9.0: what breaks and what to fix first

Const variables and locals now work in required_providers when they're known before planning.

Cloud · Terraform 1.17 explained: what's new, who it touches and how we'd upgrade

Issue per-task credentials with short TTLs, behind a tool allow-list that denies by default. If an injection lands, the credential decides how far it gets, and a prompt filter won't save you.

Security · Is your AI agent running on someone else's login? Give it its own, and cap what it can do

Never accept an implementation quote before a fixed-scope discovery has sized connectors, data and roles.

Security · How to choose an IAM implementation partner

In-house needs a dedicated team with an end date, and partners need contractual exit criteria. Each model fails without its guardrail.

Cloud · In-house or consultancy? How to split a cloud migration so your team ends up owning it

During discovery, profile the authoritative-source data and see how mature the role model is. Low bids tend to hide their gaps right there.

Security · What a SailPoint implementation actually costs

Add signals one at a time. Run each in monitor mode before you enforce it, and keep a way back.

Security · Zero trust means proving every access. Here's how to start, and what to do if someone's already in.

Let data gravity set placement: one center of gravity, plus a short list of workloads that earn an exception, each with a written exit cost.

Cloud · The multi-cloud tax, and how to stop paying it

Build a golden-set eval harness before the second feature, score retrieval and generation separately, and gate merges on regression.

AI and data · RAG in production: what actually breaks

Let policy auto-certify low-risk access that hasn't changed, and send just the ranked exceptions to humans. Those are SoD conflicts, dormancy and peer outliers.

Security · The access review nobody dreads

Do the semantic work: watermarks and late-data policy, replay-safe idempotent sinks, CDC with schema evolution and backfill planned from day one.

AI and data · Your dashboard is lying by twelve hours

Leave it in report-only for a full business cycle. Don't enforce until the projected impact matches what you intended.

Security · Conditional access is a policy, not a prayer

Make the default path the fastest path. Teams should get CI/CD, observability and security already wired from one scaffold command.

Engineering · Golden paths beat golden cages

Once a profile is past the extended allowance, even a normal login may fail. Logging in updates the profile, so there's no quiet way around it.

Security · Oversized Auth0 profiles can break logins after 4 March 2027. Here's how to find yours

On 15.5.5-014, the version number isn't enough. Check that the Retro Remediation Engine is 4.0.2 or later.

Security · You patched your Cisco email gateway. One email can still take it over.

Use the 10.0.51 cycle in spring 2027 as a parallel run. 10.0.52 is the first to reach general availability with RSAT unsupported.

Engineering · Microsoft is dropping RSAT in May 2027. What tests Finance and Operations after that?

Whatever Get User returns becomes the stored profile, so make it match Login and use the same stable user_id.

Security · Auth0's lazy migration changes on 20 January 2027, and half-imported users won't fix themselves

Classic clusters are where it bites. Serverless and Lakeflow pipelines already run newer versions, and SQL warehouses look safe as we read the notice.

AI and data · Your Databricks AI Functions need Runtime 17.3 LTS by January 2027, even if 15.4 is still supported

8.2.2-8015 is affected even though one government feed suggests otherwise. Go by SonicWall's advisory.

Security · SonicWall's SSL VPN bug lets a valid password skip SAML and your MFA

Fence the login page today. It costs little and it doesn't depend on the change window.

Security · Delinea Secret Server login bypass: why 12.2.7 won't save you from this 9.9

Trust 90 days and 14 December. If you see 60 days and 4 December, someone's working from an old copy.

Engineering · Dynamics 365 storage limits start to bite on 9 November: what gets blocked, how to get out

Passkeys don't satisfy SSPR. Allow password change after secure sign-in helps those users, but only if they can still sign in.

Security · Entra password reset won't take directory phone numbers from February 2027. Who gets stuck?

Generic kernels on Ubuntu 22.04, 24.04 and 26.04 got the fix in the updates pocket, so security-only automatic updates can miss it. Ubuntu 20.04 and older still need the filter.

Security · Linux kernel CVE-2026-98432: why switching off MPTCP won't save you, and what to patch

After the Rails fix, rotate secrets if attachments sit on the Disk service. The patch can't recall anything already read.

Security · Patch roundup, week of Nov 2: fix Linux and WS_FTP first, then work down the list

Don't build new on Synapse Parquet. It closed to new customers in October and ends in December 2027.

AI and data · Export to Azure Data Lake stops on November 30. Is your Finance and Operations close ready?

Fabric lists $0.18 per capacity unit hour in East US. Databricks and Snowflake rates depend on tier or edition, cloud and region, so get quotes in writing.

AI and data · Databricks vs Snowflake vs Microsoft Fabric: which one fits, and what it costs to change your mind

You can't move a 4.12 Edge app back to 4.9 LTS. MuleSoft only supports Edge to a later LTS.

Engineering · Mule 4.12 Edge leaves standard support this month. Upgrade to 4.13 before CloudHub does it for you

8.7 SP2 goes to 8.8 and then 8.9. Major upgrades can't be reversed, so back up off the box.

Security · RSA SecurID primary support ends in stages from December. Here's how you get to 8.9

Import dependencies with the accounts, or the first rotation breaks a service on restart.

Security · CyberArk to Delinea (and back): what a PAM migration really involves

Business Central has two major updates a year; Finance and Operations has four and you must take two.

Engineering · Dynamics 365 Business Central vs Finance and Operations: which one you actually need

A token nobody uses for 30 days gets switched off. You've then got 60 days to bring it back before Zendesk deletes it.

Security · Zendesk is killing API tokens, and your Entra ID provisioning still runs on one

Ingress jobs now run on agents, so they need a network path to every VCS server you use. The slug-ingress fallback holds until October 2027.

Cloud · Terraform Enterprise 2.1 moves VCS ingress into your agents. What to change before October 2027

Allow at least 24 hours after each BeyondTrust package so clients catch up.

Security · BeyondTrust Remote Support and PRA 24.3 lose support in November, and there's no one-step upgrade

Don't rely on Salesforce Login History. Check the error on the Entra side.

Security · Your Entra-to-Salesforce provisioning breaks on December 1. One permission fixes it

5.0 gets 24 months of support and no extension. A 4.22 cluster with both EUS terms is covered until June 30, 2029.

Cloud · OpenShift 4.19 is running out of support. Do you park on 4.22 or keep going to 5.0?

Most breakage is in the code around the tables: /mnt paths, input_file_name(), RDD calls and two-part names.

AI and data · Hive metastore to Unity Catalog: the Databricks migration plan, and what breaks on the way

Flash-Lite starts at minimal thinking. Agents that call tools need it raised, or they may end tool use early, and that may not show up as an error.

AI and data · Gemini 2.5 Pro and Flash calls change models on 1 December. What breaks, and what we'd do first

Copy every saved prompt's live wording into your repo. After the shutdown the ID is all you'll have.

AI and data · Agent Builder, Evals and saved prompts shut on 30 November. Here's what to pull out first

Test the callers: stricter Public API, no client certificate sign-in, TLS 1.2 or later, and a password for exports.

Security · Password Safe 24.3 runs out of support in December, and 26.3 is still one upgrade away

Prior auth data has to reach the API within a business day and stay there at least a year after its last change. Check your UM tool's retention.

Engineering · CMS-0057-F on January 1, 2027: what health plans on Facets, QNXT and HealthRules need live

Virtual companies and data partitions block the upgrade. Run the analysis report before you plan or budget.

Engineering · Still running Dynamics AX 2012? When to upgrade to Finance and Operations and when to start over

Install 2.6.92.0, not the 2.6.84.0 minimum, and upgrade the staging server first.

Security · Upgrade Entra Connect Sync before April 2027 and move users off Microsoft's SMS codes

Everyone else gets a fix close to the Chrome date or after it. That's 2024.1, Caché, Ensemble and 2026.2. Push the XSLTEnabled policy to admin machines so nobody's left reading raw XML.

Engineering · Chrome drops XSLT on 17 November. What breaks in InterSystems, and the fix for your version

From 4 November agent blueprints need an admin to grant AgentIdentity.CreateAsManager. Learn's own page hasn't caught up, so test rather than trust it.

Security · What breaks in Entra ID this November: MemberOf, the PIM beta APIs and agent permissions

If you build GitLab yourself, upgrade Ruby to 3.3.13, 3.4.12 or 4.0.9 too. The GitLab upgrade alone won't fix it.

Security · Patched GitLab, still exposed: the CI regex bug CISA lists as exploited, and the Ruby step people miss

A clean Integrity Checker result proves nothing here. The chain ran in memory and edited its own logs.

Security · Patched Ivanti Connect Secure in October? Two more exploited bugs, and the AD cleanup

Move Okta Access Gateway straight to 2026.44.1, which has the security fixes and the DNS fix.

Security · Patch roundup, week of Oct 26: upgrade Secret Server today, then work down the list

Still on 2023.10? Skip 2024.10 and go straight to 2025.10. Automation Suite teams should check their exact build against UiPath's upgrade matrix first.

Engineering · UiPath 2023.10 support has run out and 2024.10 is next. What we'd upgrade first

Convert rules starting from the last one and compare token claims each time. If something breaks, switch the old rule back on.

Security · Auth0 moved the Rules and Hooks deadline: Hooks stop on 30 April 2027, Rules on 31 January 2028

The Identity Engine upgrade is free and takes minutes, but IWA routing rules and mobile Device Trust block it until you remove them.

Security · Still on Okta Classic Engine? Three features stop working on March 5, 2027, and two of them block the upgrade

If you run Oracle, Db2 or SQL Server underneath, plan around 2030. That's when SAP's database support ends, and the conversion route closes with it.

Engineering · SAP ECC mainstream maintenance ends in 2027: what you need to decide this quarter

Pause the job, switch, test and resume. Restart clears the watermarks and runs a full cycle.

Security · SuccessFactors basic auth is going away: moving Entra HR provisioning to workload identity

Restart processes and rebuild images after patching. An installed package doesn't fix a running service.

Security · Brotli CVE-2026-111497 is now on CISA's exploited list, and you probably run more copies than you think

Running Okta in front of Microsoft 365 still leaves Entra underneath, so MFA and device rules must agree in both.

Security · Okta vs Microsoft Entra ID for enterprise security. Start with what you already pay for

Start custom code usage collection this quarter. It's how you shrink one of the two hardest parts of the move.

Engineering · What an SAP S/4HANA migration actually costs: the drivers, the ranges and where budgets break

The free Terraform CLI and Vault Community still cost nothing for internal use, so the forks save money only where you pay IBM.

Cloud · Terraform and Vault under IBM: what the bill depends on, and when OpenTofu or OpenBao makes sense

Each vendor counts licences differently, so hand all three the same scope. Otherwise the quotes aren't for the same thing.

Security · CyberArk, Delinea or BeyondTrust? Choosing PAM now that CyberArk is Idira

A v1 release track is the minimum. v2 Stable is the recommended target if your adapter is GA on v2.

AI and data · dbt drops v1.3 to v1.7 from its platform on January 31, 2027: get pinned jobs onto a release track before they're deleted

SailPoint has a big connector catalogue and still sells an on-premises product. Practitioners describe moving IdentityIQ custom code to the cloud as a rebuild.

Security · SailPoint, Saviynt or Entra ID Governance? Start with where your apps live

Disabling an agent doesn't always kill the tokens it already holds. Keep token lifetimes short and test the switch-off.

Security · Okta, Entra Agent ID, SailPoint or CyberArk? Who actually does what for your AI agents

Patch internet-facing reverse proxies first, one node at a time, and read the version back afterwards.

Security · IBM Verify Access flaws let attackers run code without a login: patch to 11.0.3.2

Microsoft points most teams at Agent Framework. If your people need a visual designer, look at Logic Apps, and if one agent just hands off to another, A2A is enough.

AI and data · Foundry Workflows retire on December 1. We'd start moving yours to Agent Framework now

Google's retirement table names no replacement. We expect most text work to go to gemini-embedding-001, with gemini-embedding-2 for images and video and as a second text option.

AI and data · Vertex AI is retiring text-embedding-005 and three other embedding models: how to re-embed before search breaks

Find the accounts in the sign-in logs first; ropc in the protocol column means a sign-in that can never pass MFA.

Security · Azure mandatory MFA now blocks CLI, PowerShell and Terraform changes: moving service accounts to workload identities

Filter the admin center by Type Microsoft Teams and sort by Last activity to find what matters.

Engineering · Dataverse for Teams is going away: what to keep, move or let go before September 2027

Secret Server Cloud isn't listed as affected. Check that no old on-prem server is still running.

Security · Delinea Secret Server auth bypass: why the FIDO2 hotfix isn't enough

Find every certificate a person renews and automate it before the 100-day step. Start with the ones customers see.

Security · TLS certificates drop to 100 days in 2027 and 47 in 2029. Here's what breaks, and how to automate renewals first

12.2.1.4 is the only supported starting point for 14c. If you're on 12.2.1.3, that's two hops.

Security · Oracle Identity Governance and OAM 12.2.1.4 lose Premier Support on December 31: upgrade to 14c or replace?

The October 21 build isn't enough for CVE-2026-114820. It blocked the bad certificates but left the four roots in place.

Security · Oracle's eMudhra alert now covers Database Server: patch, then test what breaks

Entra fits Microsoft-heavy estates. SAP risk checks still run in IAG, Access Control or a partner tool.

Security · SAP Identity Management ends in 2027: Entra ID, SailPoint or Saviynt?

vSphere 7 is past general support and vSphere 8 follows in October 2027, so on perpetual licences you'll end up running versions without general support sooner or later.

Cloud · Leaving VMware after Broadcom: OpenShift Virtualization, Nutanix or cloud, and what the move really takes

You need Software Assurance, SPLA or a Server Subscription to buy them, and Essentials isn't covered.

Cloud · Windows Server 2016 support ends January 12, 2027: what to upgrade, what to move, and when ESUs make sense

Keep quarterly certifications for templates and standing grants, and add a daily diff for scopes, tools and policies that change at runtime.

Security · Who owns your AI agents? How to find them, give each one a sponsor and stop their access creeping

Drill the kill switch and record, system by system, when the last call got through.

Security · Stopping a rogue AI agent: kill switches, token revocation and what OAuth can't do yet

Keep the registration in the repo, so every change to tools or scopes becomes a pull request the pipeline checks.

Security · From AI development to AI governance with AIDLC

Snapshot before you patch or reboot, and rebuild from a clean image if you can't rule a compromise out.

Security · BeyondTrust Remote Support zero-day: patch it, then check who got in

Do the mod_php hosts first. PHP itself says they're the riskiest setup.

Security · Patch PHP and Node.js this week: what broke and who's exposed

Don't move 4.14 to 4.16 just to buy time. 4.16's last term ends June 27, 2027, which is sooner than Term 3 on 4.14.

Cloud · OpenShift support dates through 2027: which clusters run out first and how to plan the upgrades

Run two lanes: a fast one for exposed, no-login flaws and the quarterly one for the rest.

Security · Oracle's October security patches: what to fix first in EBS, PeopleSoft and Access Manager

Rewrite mixed-case deny rules in lowercase before upgrading, or they stop protecting anything.

Security · HashiCorp Vault 2.2 explained: TPM login, post-quantum PKI and the October fixes

The governance change to look for is time-based access with exact start and end times and time zones. 8.4 and 8.5 already do start and end dates.

Security · Upgrading to SailPoint IdentityIQ 9.0: what breaks and what to fix first

-minimal-refresh saves API calls but hides drift on untouched resources. Put a full plan in front of production applies.

Cloud · Terraform 1.17 explained: what's new, who it touches and how we'd upgrade

Gate anything you can't undo on an out-of-band human approval. Log every action too, with the agent, who delegated, the tool and the outcome.

Security · Is your AI agent running on someone else's login? Give it its own, and cap what it can do

Make the exit contractual. Get runbooks and paired delivery in writing, and a handover your team runs on day one.

Security · How to choose an IAM implementation partner

Pair on everything. Knowledge travels in commits and runbooks your team has run, and documentation handoffs don't carry it.

Cloud · In-house or consultancy? How to split a cloud migration so your team ends up owning it

Keep scope in check with risk-scored certifications and as few environments as you can live with, and settle the run model before signing.

Security · What a SailPoint implementation actually costs

Make every control emit its own evidence, and audits become report generation.

Security · Zero trust means proving every access. Here's how to start, and what to do if someone's already in.

Put cost in the engineering loop. Each team sees its own unit economics and hears about anomalies within a day, and commitment coverage gets modeled per cloud.

Cloud · The multi-cloud tax, and how to stop paying it

Ship the plumbing. Make retrieval ACL-aware and cite at chunk level. When confidence is low, refuse honestly. Feed failures back into the golden set with telemetry.

AI and data · RAG in production: what actually breaks

Run transfers through a small micro-certification the week they happen, instead of waiting for quarter-end.

Security · The access review nobody dreads

Tier the pipeline. Streaming is for places where seconds matter and micro-batch for where minutes do. Everything else can be honest batch.

AI and data · Your dashboard is lying by twelve hours

Engineer the blast radius before the bad deploy. That means ring rollouts and alarmed break-glass exclusions, plus a rehearsed rollback.

Security · Conditional access is a policy, not a prayer

Keep the road paved. Automated pull requests and a drift scorecard stop older services from falling behind the template.

Engineering · Golden paths beat golden cages

Logs only catch people who are active. Run a bulk export too, and stream logs if your plan keeps them for only a few days.

Security · Oversized Auth0 profiles can break logins after 4 March 2027. Here's how to find yours

Hunt before you upgrade, and trust the firewall logs over the gateway's own.

Security · You patched your Cisco email gateway. One email can still take it over.

Split the suite by test type first. RSAT was never meant for unit or integration tests.

Engineering · Microsoft is dropping RSAT in May 2027. What tests Finance and Operations after that?

Switch early with the Dashboard toggle in a dev tenant, then production, before your holiday freeze.

Security · Auth0's lazy migration changes on 20 January 2027, and half-imported users won't fix themselves

Query history doesn't cover classic clusters. Use system.compute.clusters for versions and search the code for ai_ calls.

AI and data · Your Databricks AI Functions need Runtime 17.3 LTS by January 2027, even if 15.4 is still supported

Match firewall VPN logins against identity provider sign-ins. A login with no matching sign-in is the warning sign.

Security · SonicWall's SSL VPN bug lets a valid password skip SAML and your MFA

Delinea's docs say email PIN sends have no audit event, so pull mail server logs alongside user audit history.

Security · Delinea Secret Server login bypass: why 12.2.7 won't save you from this 9.9

Start cleanup early. Deletes take up to 72 hours to show in reports, and retention policies can take a week in production, two in a sandbox.

Engineering · Dynamics 365 storage limits start to bite on 9 November: what gets blocked, how to get out

Two-method policies are getting tight, because Authenticator and OATH tokens count as one. Test your policy in a pilot.

Security · Entra password reset won't take directory phone numbers from February 2027. Who gets stuck?

Containers share the node's kernel. Patch nodes, because new images won't help, and a filter misses pod-to-pod traffic. OpenShift 4.19 through 4.22 clusters can take their fixed releases now.

Security · Linux kernel CVE-2026-98432: why switching off MPTCP won't save you, and what to patch

Give the November MuleSoft upgrade to a named person, because CloudHub won't do it this month.

Security · Patch roundup, week of Nov 2: fix Linux and WS_FTP first, then work down the list

Use Link to Fabric if you report in Power BI or Fabric, and Synapse Link incremental CSV if you feed your own warehouse.

AI and data · Export to Azure Data Lake stops on November 30. Is your Finance and Operations close ready?

Budgets on Databricks and Snowflake mostly alert. Tighter limits come from compute policies, resource monitors or pausing.

AI and data · Databricks vs Snowflake vs Microsoft Fabric: which one fits, and what it costs to change your mind

Test error handling, cache scopes and JSON schema validation first. Leaving minMuleVersion at 4.12 keeps some 4.13 behaviours off, but not the error-mapping change.

Engineering · Mule 4.12 Edge leaves standard support this month. Upgrade to 4.13 before CloudHub does it for you

Replace old agents before you touch the server, because 8.8 changes TLS defaults and Patch 3 turns off port 5550.

Security · RSA SecurID primary support ends in stages from December. Here's how you get to 8.9

Give every wave exactly one system that's allowed to rotate its passwords. Two tools rotating the same account will lock an app out.

Security · CyberArk to Delinea (and back): what a PAM migration really involves

Business Central throttles APIs per user, and service principals count. Spread integrations across several accounts.

Engineering · Dynamics 365 Business Central vs Finance and Operations: which one you actually need

Microsoft is working on OAuth for the Zendesk connector but no longer gives a date. Test it in a separate app when it appears.

Security · Zendesk is killing API tokens, and your Entra ID provisioning still runs on one

Built-in Fluent Bit log forwarding loses support in October 2027. Build platform-side forwarding first, especially for audit logs.

Cloud · Terraform Enterprise 2.1 moves VCS ingress into your agents. What to change before October 2027

Move RADIUS sign-ins to SAML, LDAP or another supported option before 27.1 removes them.

Security · BeyondTrust Remote Support and PRA 24.3 lose support in November, and there's no one-step upgrade

Set a quarantine notification email. Entra switches off a job that sits in quarantine for four weeks, and without the email nobody hears about it.

Security · Your Entra-to-Salesforce provisioning breaks on December 1. One permission fixes it

The first 5.x release with the Extended Life Cycle add-on is 5.2, so long-support estates may want to hold on 4.22.

Cloud · OpenShift 4.19 is running out of support. Do you park on 4.22 or keep going to 5.0?

Change the default catalog last, and treat the 30 days after disabling the Hive metastore as your only rollback window.

AI and data · Hive metastore to Unity Catalog: the Databricks migration plan, and what breaks on the way

3.8 Flash doubles in price on 1 January, and it can spend more tokens on hard tasks. Don't guess the new bill. Build it from your own test runs.

AI and data · Gemini 2.5 Pro and Flash calls change models on 1 December. What breaks, and what we'd do first

Evals is read-only now, and OpenAI's guide rebuilds tests by hand. Download definitions and results through the API, then rebuild in Promptfoo or your own harness.

AI and data · Agent Builder, Evals and saved prompts shut on 30 November. Here's what to pull out first

Fix the platform too. SQL Server 2014 is unsupported from 26.2, and Microsoft support for SQL Server 2016 and Windows Server 2016 has ended or is about to.

Security · Password Safe 24.3 runs out of support in December, and 26.3 is still one upgrade away

Provider Access is opt-out, Payer-to-Payer is opt-in. Store each choice with a date, and have every request check it before data goes out.

Engineering · CMS-0057-F on January 1, 2027: what health plans on Facets, QNXT and HealthRules need live

Overlayered code must become extensions, starting with tables, fields, EDTs and enums.

Engineering · Still running Dynamics AX 2012? When to upgrade to Finance and Operations and when to start over

Microsoft's own SMS and voice codes start retiring for most users from 1 February 2027, and it can't say when your tenant's turn comes. There's no opt-out from enforcement, so move people before that date.

Security · Upgrade Entra Connect Sync before April 2027 and move users off Microsoft's SMS codes

Don't hold browser updates to dodge this. The policy keeps XSLT working until version 176 without giving up security fixes.

Engineering · Chrome drops XSLT on 17 November. What breaks in InterSystems, and the fix for your version

Microsoft-managed Conditional Access policies switch on by themselves after report-only. Decide On or Off yourself, and exclude break-glass accounts.

Security · What breaks in Entra ID this November: MemberOf, the PIM beta APIs and agent permissions

An 18.11 server isn't safe just because this CVE starts at 19.2. CVE-2026-110264 reaches it.

Security · Patched GitLab, still exposed: the CI regex bug CISA lists as exploited, and the Ruby step people miss

Rotate the VPN's directory account and check whether it could read LAPS passwords or BitLocker keys.

Security · Patched Ivanti Connect Secure in October? Two more exploited bugs, and the AD cleanup

Roll Java to the eMudhra-fixed builds everywhere, including runtimes bundled inside vendor tools.

Security · Patch roundup, week of Oct 26: upgrade Secret Server today, then work down the list

Put the ASP.NET Core Hosting Bundle 10.0.x on the server before the Orchestrator upgrade. UiPath requires it from 2025.10.3 on.

Engineering · UiPath 2023.10 support has run out and 2024.10 is next. What we'd upgrade first

Plan around the gaps: no built-in Management API token, no connectionOptions, no upstream tokens, redirects rebuilt.

Security · Auth0 moved the Rules and Hooks deadline: Hooks stop on 30 April 2027, Rules on 31 January 2028

Record your IWA routing rules before deleting them. You'll need them if you roll back.

Security · Still on Okta Classic Engine? Three features stop working on March 5, 2027, and two of them block the upgrade

The transition option needs ECC on SAP ERP, private edition on HANA by the end of 2030. It won't run Java-dependent features.

Engineering · SAP ECC mainstream maintenance ends in 2027: what you need to decide this quarter

Do writeback first, then SuccessFactors to Entra ID, then SuccessFactors to AD, and prove each with provision on demand.

Security · SuccessFactors basic auth is going away: moving Entra HR provisioning to workload identity

Patch whatever unpacks outside data first. Responses your own code fetches count, and a WAF won't see those.

Security · Brotli CVE-2026-111497 is now on CISA's exploited list, and you probably run more copies than you think

Device sign-in is the hard part of any move. Hybrid join follows the federation until the domain is converted.

Security · Okta vs Microsoft Entra ID for enterprise security. Start with what you already pay for

On-premise, the right to use most compatibility scope items ran out in May 2026. If people still use one, someone needs to own its replacement now.

Engineering · What an SAP S/4HANA migration actually costs: the drivers, the ranges and where budgets break

OpenTofu promises state compatibility up to Terraform 1.5.x and OpenBao tested only Vault Community 1.14.1. Test on copies first.

Cloud · Terraform and Vault under IBM: what the bill depends on, and when OpenTofu or OpenBao makes sense

Look at how fast each vendor fixes and tells you about flaws, and patch any PAM component you host within days.

Security · CyberArk, Delinea or BeyondTrust? Choosing PAM now that CyberArk is Idira

Expect deprecation warnings when you move. dbt-autofix clears many of them, and v2 won't run until all are fixed.

AI and data · dbt drops v1.3 to v1.7 from its platform on January 31, 2027: get pinned jobs onto a release track before they're deleted

Saviynt puts IGA, ERP access rules and PAM in one SaaS platform. Test the PAM side on its own merits.

Security · SailPoint, Saviynt or Entra ID Governance? Start with where your apps live

In Entra, a policy on the agent doesn't cover the agent acting for a user, so the user's policies have to carry that load.

Security · Okta, Entra Agent ID, SailPoint or CyberArk? Who actually does what for your AI agents

Older 10.0 releases get no fix of their own. They have to climb to 10.0.9.4, prerequisites and all.

Security · IBM Verify Access flaws let attackers run code without a login: patch to 11.0.3.2

Power Fx formulas don't run on Python 3.14 or 3.15, and some portal system variables aren't in Agent Framework's list. Test every branch.

AI and data · Foundry Workflows retire on December 1. We'd start moving yours to Agent Framework now

Decide the vector size on purpose. The 768 to 3,072 jump breaks tables, indexes and pgvector limits.

AI and data · Vertex AI is retiring text-embedding-005 and three other embedding models: how to re-embed before search breaks

Rehearse with the built-in Azure Policy in Audit mode, then switch it to Deny yourself.

Security · Azure mandatory MFA now blocks CLI, PowerShell and Terraform changes: moving service accounts to workload identities

Check capacity before anything else. If the tenant can't hold the environment, the upgrade simply won't start.

Engineering · Dataverse for Teams is going away: what to keep, move or let go before September 2027

Delinea says customers have reported active exploitation of the FIDO2 bug. It isn't on CISA's KEV list, so don't wait for it to show up there, or for the monthly window.

Security · Delinea Secret Server auth bypass: why the FIDO2 hotfix isn't enough

Public certificates won't carry client authentication from March 2027. Move system-to-system logins to a private CA.

Security · TLS certificates drop to 100 days in 2027 and 47 in 2029. Here's what breaks, and how to automate renewals first

Fix SIMPLE-mode WebGates, old TLS, GTC connectors and OAACG checks on 12c, before the upgrade window.

Security · Oracle Identity Governance and OAM 12.2.1.4 lose Premier Support on December 31: upgrade to 14c or replace?

Test outside HTTPS connections first. Servers whose chains end at the emSign or AAA roots will fail after the update.

Security · Oracle's eMudhra alert now covers Database Server: patch, then test what breaks

Hundreds of roles and lots of non-SAP systems usually point to SailPoint or Saviynt. Test that against your own job list, not a demo.

Security · SAP Identity Management ends in 2027: Entra ID, SailPoint or Saviynt?

Check VDDK access, vSAN disks, NSX rules and backup support before choosing a target. Those stall migrations more than VM counts.

Cloud · Leaving VMware after Broadcom: OpenShift Virtualization, Nutanix or cloud, and what the move really takes

A standalone 2016 server can go straight to 2025 with the media. Clusters climb one version per pass.

Cloud · Windows Server 2016 support ends January 12, 2027: what to upgrade, what to move, and when ESUs make sense

Mint a new token for every agent-to-agent hop with an actor claim, and never forward a token you received.

Security · Who owns your AI agents? How to find them, give each one a sponsor and stop their access creeping

Bind tokens with DPoP or mutual TLS and rotate refresh tokens, so a copied token is worth less.

Security · Stopping a rogue AI agent: kill switches, token revocation and what OAuth can't do yet

Write release rules as policy as code with tests of their own. The agent can be probabilistic, the gates can't.

Security · From AI development to AI governance with AIDLC

Rotate stored and injected credentials after the patch or rebuild, never before.

Security · BeyondTrust Remote Support zero-day: patch it, then check who got in

Assume the next runtime bug lands as the worker account, and cut what that account can reach.

Security · Patch PHP and Node.js this week: what broke and who's exposed

No cluster on OpenShift SDN gets past 4.16. Migrate to OVN-Kubernetes first.

Cloud · OpenShift support dates through 2027: which clusters run out first and how to plan the upgrades

Keep an eye on the monthly CSPUs. They aren't cumulative, so a skipped one stays skipped until the next CPU.

Security · Oracle's October security patches: what to fix first in EBS, PeopleSoft and Access Manager

If you use SCIM, expect six breaking changes in 2.2. Everyone else should check AWS: WIF now wins over environment variables.

Security · HashiCorp Vault 2.2 explained: TPM login, post-quantum PKI and the October fixes

There's no confirmed GA date, only a tentative Q4 2026 target, and no release notes or platform list yet. Get your upgrade path and versions from SailPoint in writing.

Security · Upgrading to SailPoint IdentityIQ 9.0: what breaks and what to fix first

Terraform Policy is GA for -policies in the CLI, even though the policy docs still said beta on October 22.

Cloud · Terraform 1.17 explained: what's new, who it touches and how we'd upgrade

Ask who chases the app owners and who maintains custom connectors after go-live. A bid that's silent on either has moved the cost to you.

Security · What a SailPoint implementation actually costs

Being inside the network proves nothing. Each request should show who's asking and from which device.

Security · Zero trust means proving every access. Here's how to start, and what to do if someone's already in.

Exit waivers and the EU Data Act make leaving cheaper. They don't make running split across two clouds free.

Cloud · The multi-cloud tax, and how to stop paying it

Wire revocations to automatic deprovisioning with closure checks, so the campaign emits its own audit evidence.

Security · The access review nobody dreads

If someone acted on stale data, confirm the gap, warn readers, correct the data, then rerun the decision and reverse it if the answer changes.

AI and data · Your dashboard is lying by twelve hours

Treat every exclusion as temporary. Give it an owner and an end date, and alarm the break-glass accounts so any use gets looked at.

Security · Conditional access is a policy, not a prayer

Don't ban escape hatches; govern them. When a team documents a deviation and owns its operational cost, that's roadmap input.

Engineering · Golden paths beat golden cages

Fix whatever writes the data before you shrink the records, or the next login will fill them up again.

Security · Oversized Auth0 profiles can break logins after 4 March 2027. Here's how to find yours

One compromised cluster member means restoring every member and replacing every key and password the gateway held.

Security · You patched your Cisco email gateway. One email can still take it over.

Sort out test identities before you move sandboxes to the admin center, because that move is one-way.

Engineering · Microsoft is dropping RSAT in May 2027. What tests Finance and Operations after that?

Expect user counts to rise. As we read Auth0's pages, some abandoned-reset users will need a fresh reset too, so brief support and analytics first.

Security · Auth0's lazy migration changes on 20 January 2027, and half-imported users won't fix themselves

15.4 to 17.3 means Spark 4, Java 17 and Scala 2.13 at once. Split the AI step off if the full move can't happen before the freeze.

AI and data · Your Databricks AI Functions need Runtime 17.3 LTS by January 2027, even if 15.4 is still supported

Remove spare local accounts and trim the SSLVPN Services group, so the next bypass has no side door to use.

Security · SonicWall's SSL VPN bug lets a valid password skip SAML and your MFA

We found no public reports of attacks on this flaw yet, and a clean log review doesn't prove nothing happened.

Security · Delinea Secret Server login bypass: why 12.2.7 won't save you from this 9.9

Work out the bill before you link pay-as-you-go. With no capacity allocated, it charges for nearly the whole environment.

Engineering · Dynamics 365 storage limits start to bite on 9 November: what gets blocked, how to get out

Give students and frontline staff a named route with staff cover, and harden the helpdesk check before calls increase.

Security · Entra password reset won't take directory phone numbers from February 2027. Who gets stuck?

Check your scanner's severity. Vendors rate this anywhere from medium to critical, and your exposure should set the order.

Security · Linux kernel CVE-2026-98432: why switching off MPTCP won't save you, and what to patch

Warn Snowflake users before JDBC 4.4.1 or Go 2.4.0, since cached sign-ins stop working once.

Security · Patch roundup, week of Nov 2: fix Linux and WS_FTP first, then work down the list

Start change tracking in a sandbox today, because it's the step most likely to eat your remaining weeks.

AI and data · Export to Azure Data Lake stops on November 30. Is your Finance and Operations close ready?

Below F64, every Power BI viewer needs a Pro or PPU licence. Count viewers before sizing.

AI and data · Databricks vs Snowflake vs Microsoft Fabric: which one fits, and what it costs to change your mind

November's patches only reach apps you redeploy. Runtime Fabric and on-prem apps need a plan before February 2027.

Engineering · Mule 4.12 Edge leaves standard support this month. Upgrade to 4.13 before CloudHub does it for you

Pick your code matching method before March instead of accepting the automatic move to Selection.

Security · RSA SecurID primary support ends in stages from December. Here's how you get to 8.9

Treat export files as the most sensitive thing in the project, and keep the old vault readable for audit history.

Security · CyberArk to Delinea (and back): what a PAM migration really involves

Finance and Operations' roles, duties and segregation rules suit SOX-style audits better than permission sets.

Engineering · Dynamics 365 Business Central vs Finance and Operations: which one you actually need

Every token dies on 30 April 2027. Have the provisioning job on OAuth well before then.

Security · Zendesk is killing API tokens, and your Entra ID provisioning still runs on one

Check Redis and custom images before upgrading. The 2.0 notes flagged Redis 6.x removal in 2.1, and custom images must be rebuilt on UBI.

Cloud · Terraform Enterprise 2.1 moves VCS ingress into your agents. What to change before October 2027

Clear Mac user-mode Jump Clients before 26.1.1, and update SIEM parsers before Base 8.3.0.

Security · BeyondTrust Remote Support and PRA 24.3 lose support in November, and there's no one-step upgrade

With Summer '27, Salesforce removes SOAP login() from API 31.0 to 64.0. Ask Microsoft what the connector will use, well before then.

Security · Your Entra-to-Salesforce provisioning breaks on December 1. One permission fixes it

Plan RHCOS 10.2, HAProxy 3.2 and Helm v4 as separate changes. RHCOS 9 leaves in 5.3 and Helm v3 in 5.1.

Cloud · OpenShift 4.19 is running out of support. Do you park on 4.22 or keep going to 5.0?

Use the inventory to fix keys too: one auth key per app, held in Secret Manager, with an owner and a billing alert.

AI and data · Gemini 2.5 Pro and Flash calls change models on 1 December. What breaks, and what we'd do first

Recheck model-graded tests after rebuilding them. Scores won't match the old ones exactly.

AI and data · Agent Builder, Evals and saved prompts shut on 30 November. Here's what to pull out first

Plan the exits from SSRS reporting, PSRUN and Windows AD SSO now. AD SSO goes in 27.1 and SSRS in a future release. PSRUN has no removal date yet.

Security · Password Safe 24.3 runs out of support in December, and 26.3 is still one upgrade away

CMS has proposed drugs and 2.2 IG releases from October 2027. Expect one more IG upgrade, and keep mappings in code so it stays small.

Engineering · CMS-0057-F on January 1, 2027: what health plans on Facets, QNXT and HealthRules need live

Attachments only come across if they're inside the AX database before the upgrade.

Engineering · Still running Dynamics AX 2012? When to upgrade to Finance and Operations and when to start over

Move most people to passkeys and keep your own telephony provider for the few who need texts.

Security · Upgrade Entra Connect Sync before April 2027 and move users off Microsoft's SMS codes

Caché and Ensemble get no maintenance releases after 31 March 2027. Use the 2018.1.13 rollout to size the IRIS move.

Engineering · Chrome drops XSLT on 17 November. What breaks in InterSystems, and the fix for your version

Custom controls retire early in 2027. Plan the move to external MFA now, while the old policies still work.

Security · What breaks in Entra ID this November: MemberOf, the PIM beta APIs and agent permissions

If the server was exposed and unpatched, rotate CI secrets and runner tokens even when the detections come back clean.

Security · Patched GitLab, still exposed: the CI regex bug CISA lists as exploited, and the Ruby step people miss

22.7 and 22.8 reach end of life on January 31, 2027. Book the 25.1 move now.

Security · Patched Ivanti Connect Secure in October? Two more exploited bugs, and the AD cleanup

Test the Snowflake driver and Python connector updates first. OCSP defaults and the Python floor both changed.

Security · Patch roundup, week of Oct 26: upgrade Secret Server today, then work down the list

Upgrade the robots before Studio. A package built in Studio 2025.10 isn't supported on a 2024.10 robot, and that's where jobs fail.

Engineering · UiPath 2023.10 support has run out and 2024.10 is next. What we'd upgrade first

The code is frozen. Use the extra months to migrate, because there's nothing to fix in place.

Security · Auth0 moved the Rules and Hooks deadline: Hooks stop on 30 April 2027, Rules on 31 January 2028

On desktops, push the new certificates before Okta Verify, or users lose access to protected apps.

Security · Still on Okta Classic Engine? Three features stop working on March 5, 2027, and two of them block the upgrade

PI/PO 7.5 and SAP Identity Management 8.0 leave mainstream maintenance on the same day as ECC. Plan their replacements as separate moves.

Engineering · SAP ECC mainstream maintenance ends in 2027: what you need to decide this quarter

The OData audit log shows Basic or Bearer per call, so use it to find every other tool still sending a password.

Security · SuccessFactors basic auth is going away: moving Entra HR provisioning to workload identity

On PAN-OS, 11.2.10-h16 isn't enough. Hotfix or turn off Brotli inspection.

Security · Brotli CVE-2026-111497 is now on CISA's exploited list, and you probably run more copies than you think

Okta orgs on Classic Engine that use IWA desktop SSO, Device Trust or Self-Service Registration need Identity Engine before March 5, 2027, unless they leave Okta first.

Security · Okta vs Microsoft Entra ID for enterprise security. Start with what you already pay for

Before you sign anything, put five years of staying, buying time and moving side by side. Count your own users by FUE category too.

Engineering · What an SAP S/4HANA migration actually costs: the drivers, the ranges and where budgets break

Keep a small fork test running all year, so switching cost is a number you can bring to the negotiation.

Cloud · Terraform and Vault under IBM: what the bill depends on, and when OpenTofu or OpenBao makes sense

No tool moves a CyberArk vault to Delinea or BeyondTrust for you. Budget for rebuilding rotation and connectors, and run both side by side.

Security · CyberArk, Delinea or BeyondTrust? Choosing PAM now that CyberArk is Idira

Change Terraform and API scripts to track names, or the next apply puts the old version back.

AI and data · dbt drops v1.3 to v1.7 from its platform on January 31, 2027: get pinned jobs onto a release track before they're deleted

Get quotes for every identity in scope, guests and agents too. Then pilot on the apps that usually break things.

Security · SailPoint, Saviynt or Entra ID Governance? Start with where your apps live

Get GA status in writing. Several headline features are still only planned.

Security · Okta, Entra Agent ID, SailPoint or CyberArk? Who actually does what for your AI agents

Keep the admin console off the user network and the logs off the box, so the next bulletin costs a patch night.

Security · IBM Verify Access flaws let attackers run code without a login: patch to 11.0.3.2

Generated code is a starting point. Keep the original workflow until the last caller has moved to the tested replacement.

AI and data · Foundry Workflows retire on December 1. We'd start moving yours to Agent Framework now

RAG Engine corpora on default settings need a new corpus and a fresh import. Check its supported list first, since every Google model on it today is retiring.

AI and data · Vertex AI is retiring text-embedding-005 and three other embedding models: how to re-embed before search breaks

Give each job its own identity. Watch the subject match and the 20-credential limit, because both fail quietly.

Security · Azure mandatory MFA now blocks CLI, PowerShell and Terraform changes: moving service accounts to workload identities

Inactivity cleanup keeps running until then. Upgrade seasonal apps early and give each one an owner who'll notice.

Engineering · Dataverse for Teams is going away: what to keep, move or let go before September 2027

Review FIDO2 registrations on admin accounts. Reset two-factor on anything you can't explain, don't just disable it.

Security · Delinea Secret Server auth bypass: why the FIDO2 hotfix isn't enough

Remove leaf certificate pinning, and make installing and reloading part of every renewal.

Security · TLS certificates drop to 100 days in 2027 and 47 in 2029. Here's what breaks, and how to automate renewals first

An out-of-place upgrade that migrates data, instead of cloning, won't carry over user-defined fields, passwords or the connector directory. Plan for them.

Security · Oracle Identity Governance and OAM 12.2.1.4 lose Premier Support on December 31: upgrade to 14c or replace?

Rebuild container images and GraalVM native images. Updating the host doesn't change the JDK inside them.

Security · Oracle's eMudhra alert now covers Database Server: patch, then test what breaks

The work is mostly the logic in IdM scripts. Inventory it first and give every script an owner.

Security · SAP Identity Management ends in 2027: Entra ID, SailPoint or Saviynt?

A short renewal for only the cores you still need, plus an inventory and pilot running now, is the route we usually recommend.

Cloud · Leaving VMware after Broadcom: OpenShift Virtualization, Nutanix or cloud, and what the move really takes

Migrate SYSVOL from FRS to DFSR before adding new domain controllers, and don't upgrade 2016 domain controllers in place while FRS is still running.

Cloud · Windows Server 2016 support ends January 12, 2027: what to upgrade, what to move, and when ESUs make sense

Join owners, agents, NHIs, credentials, workloads and resources in one identity graph, so audit questions become queries.

Security · Who owns your AI agents? How to find them, give each one a sponsor and stop their access creeping

A clean sign-in only proves the credential was valid. Subscribe to CAEP or vendor risk events to learn what changed after.

Security · Stopping a rogue AI agent: kill switches, token revocation and what OAuth can't do yet

Sign the release and the model files. Keep provenance and an AI BOM for every build, because auditors will ask which model ran.

Security · From AI development to AI governance with AIDLC

If you're on the hosted service, you already have the patch. Someone still has to look over accounts, permissions and stored credentials.

Security · BeyondTrust Remote Support zero-day: patch it, then check who got in

PHP 8.2 loses security fixes at year end and Node 22 next April. Start those upgrades now.

Security · Patch PHP and Node.js this week: what broke and who's exposed

Clusters need cgroup v2 before 4.19 and an admin acknowledgement before 4.20.

Cloud · OpenShift support dates through 2027: which clusters run out first and how to plan the upgrades

Decide on OAM, OIG and WebLogic 12.2.x before December: pay for Extended Support or move to 14c.

Security · Oracle's October security patches: what to fix first in EBS, PeopleSoft and Access Manager

TPM auth, Azure access tokens and ML-DSA certificates are worth a pilot once the cluster is stable.

Security · HashiCorp Vault 2.2 explained: TPM login, post-quantum PKI and the October fixes

Before rollout, check whatever parses terraform version -json and any certificate chain through the eMudhra intermediates.

Cloud · Terraform 1.17 explained: what's new, who it touches and how we'd upgrade

Trust plans that prove a thin slice first and widen tier by tier. Be wary of a long silence followed by a big bang.

Security · What a SailPoint implementation actually costs

If an attacker is already inside, end their sessions and list what the account could reach before you rebuild anything.

Security · Zero trust means proving every access. Here's how to start, and what to do if someone's already in.

When RSAT goes, delete the MFA-exempt accounts and secrets that only it used.

Engineering · Microsoft is dropping RSAT in May 2027. What tests Finance and Operations after that?

Nothing reopens itself. An admin has to bring each sandbox back once you're under.

Engineering · Dynamics 365 storage limits start to bite on 9 November: what gets blocked, how to get out

Search for the two removed root CAs before you install Terraform Enterprise 2.1.0 or 2.1.1.

Security · Patch roundup, week of Nov 2: fix Linux and WS_FTP first, then work down the list

Keep core tables in Delta or Iceberg in a catalog you control, so a later change of platform touches less.

AI and data · Databricks vs Snowflake vs Microsoft Fabric: which one fits, and what it costs to change your mind

Moving from Business Central to Finance and Operations later is a reimplementation, so write down your revisit triggers.

Engineering · Dynamics 365 Business Central vs Finance and Operations: which one you actually need

Use the SAML certificate list, IdP-driven Site Auditor and token revocation to tighten access while you're in there.

Cloud · Terraform Enterprise 2.1 moves VCS ingress into your agents. What to change before October 2027

Check who can create ClusterExtension objects before 5.0, because OLM v1 now installs extensions as cluster admin.

Cloud · OpenShift 4.19 is running out of support. Do you park on 4.22 or keep going to 5.0?

On the Gemini API, gemini-2.5-flash-lite isn't deprecated yet. Vertex AI lists 20 October as the retirement date for all three 2.5 models, so check those workloads too.

AI and data · Gemini 2.5 Pro and Flash calls change models on 1 December. What breaks, and what we'd do first

Give each migrated agent its own key and review who can edit prompts and agents once they leave the dashboard.

AI and data · Agent Builder, Evals and saved prompts shut on 30 November. Here's what to pull out first

After go-live you take at least two of four service updates a year, so automate regression testing early.

Engineering · Still running Dynamics AX 2012? When to upgrade to Finance and Operations and when to start over

Password reset by text ends about 50 days after sign-in by text, with an act-by date of 22 March 2027. Passkeys don't count for reset, so give everyone something else too.

Security · Upgrade Entra Connect Sync before April 2027 and move users off Microsoft's SMS codes

Put Nov 10 (SAP), Nov 17 (XSLT) and the BeyondTrust auto-upgrade change on the change calendar now.

Security · Patch roundup, week of Oct 26: upgrade Secret Server today, then work down the list

Add pkgs.uipath.com to your allowlist now. The old package feed goes in April 2027.

Engineering · UiPath 2023.10 support has run out and 2024.10 is next. What we'd upgrade first

Upgrade Preview first and wait at least a week. Rollback is a best effort within seven days, so learn in Preview.

Security · Still on Okta Classic Engine? Three features stop working on March 5, 2027, and two of them block the upgrade

Start with four facts about your own system: EHP, database, custom code usage and how much leans on legal updates. They'll tell you which route fits.

Engineering · SAP ECC mainstream maintenance ends in 2027: what you need to decide this quarter

Keep a searchable SBOM, so the next shared-library CVE takes an afternoon to scope.

Security · Brotli CVE-2026-111497 is now on CISA's exploited list, and you probably run more copies than you think

Move while you can still drop back to v1.7. After January 31 that safety net is gone.

AI and data · dbt drops v1.3 to v1.7 from its platform on January 31, 2027: get pinned jobs onto a release track before they're deleted

If you suspect a break-in, rebuild first and rotate bind passwords and signing keys after.

Security · IBM Verify Access flaws let attackers run code without a login: patch to 11.0.3.2

Classic agents go next spring, on March 31. If you have both, plan the two moves as one project.

AI and data · Foundry Workflows retire on December 1. We'd start moving yours to Agent Framework now

Build a relevance test from real queries before you compare models, and keep the old index as rollback until cutover.

AI and data · Vertex AI is retiring text-embedding-005 and three other embedding models: how to re-embed before search breaks

Take the login page off the internet, so the next login bug is an upgrade night and not an incident.

Security · Delinea Secret Server auth bypass: why the FIDO2 hotfix isn't enough

Alert on failed renewals, not only on near expiry, and rehearse against short-lived test certificates.

Security · TLS certificates drop to 100 days in 2027 and 47 in 2029. Here's what breaks, and how to automate renewals first

Replacing OIG at a large firm can take a year or more. If that's your route, start now and budget for Extended Support over the overlap.

Security · Oracle Identity Governance and OAM 12.2.1.4 lose Premier Support on December 31: upgrade to 14c or replace?

Custom truststores don't change with the JDK. Find them and remove the four roots yourself.

Security · Oracle's eMudhra alert now covers Database Server: patch, then test what breaks

Move one SAP system at a time with one writer each, and export IdM's audit history before you switch it off.

Security · SAP Identity Management ends in 2027: Entra ID, SailPoint or Saviynt?

Choose 2025 if the vendor supports it. Moving to 2019 just puts you back here in January 2029, and 2022 has already left mainstream support.

Cloud · Windows Server 2016 support ends January 12, 2027: what to upgrade, what to move, and when ESUs make sense

Check preview and draft labels in your own tenant before you design around a vendor feature or an IETF draft.

Security · Who owns your AI agents? How to find them, give each one a sponsor and stop their access creeping

Carry the trace-id, the token's jti and the act chain on every hop, so one query rebuilds what an agent did.

Security · Stopping a rogue AI agent: kill switches, token revocation and what OAuth can't do yet

Give each agent its own identity from attestation at deploy, separate per environment and never pasted in.

Security · From AI development to AI governance with AIDLC

Fence the admin pages, keep credentials off the box and get logs off it too, so the next zero-day costs a patch night.

Security · BeyondTrust Remote Support zero-day: patch it, then check who got in

Check the runtime that serves requests, not the command line, and track it with an SBOM and a dashboard so the next patch week starts from a list.

Security · Patch PHP and Node.js this week: what broke and who's exposed

There is no rollback, so rehearse every hop on a matching cluster and take an etcd backup first.

Cloud · OpenShift support dates through 2027: which clusters run out first and how to plan the upgrades

Replace any eMudhra certificate on your own sites now. Google expected Chrome to drop the G3 root on October 27, and G1 certificates with an earliest SCT after November 16 lose Chrome 153 trust.

Security · Oracle's eMudhra alert now covers Database Server: patch, then test what breaks

Line up each OWASP and NIST risk against the control you run today. Static API keys, offline risk detections and on-behalf-of attribution are where the gaps tend to show.

Security · Who owns your AI agents? How to find them, give each one a sponsor and stop their access creeping

Make retiring an agent revoke its keys, refresh tokens and SaaS grants together.

Security · Stopping a rogue AI agent: kill switches, token revocation and what OAuth can't do yet

Treat model cards and design decks as claims. Signatures, test results and admission logs are what count as evidence.

Security · From AI development to AI governance with AIDLC

OpenShift 5.0 has no EUS. If you want long support on one version, 4.22 with EUS runs to June 30, 2029, and in the 5.x line that option starts with 5.2.

Cloud · OpenShift support dates through 2027: which clusters run out first and how to plan the upgrades

Pick tools by the program step they cover. Trust what the vendor's docs say, and check the status label before you plan around it.

Security · Who owns your AI agents? How to find them, give each one a sponsor and stop their access creeping

Move high-impact rules out of documents and into a policy engine the gateway asks on every call.

Security · Stopping a rogue AI agent: kill switches, token revocation and what OAuth can't do yet

Plan retirement at design time, so switching an agent off takes one workflow instead of a hunt.

Security · From AI development to AI governance with AIDLC

Track a handful of KPIs from logs you already have: sponsor coverage, unregistered agents found, time to revoke, short-lived credential share and unapproved drift.

Security · Who owns your AI agents? How to find them, give each one a sponsor and stop their access creeping

Notes from people who ship.

Each card shows the idea before you click

Oversized Auth0 profiles can break logins after 4 March 2027. Here's how to find yours

You patched your Cisco email gateway. One email can still take it over.

Microsoft is dropping RSAT in May 2027. What tests Finance and Operations after that?

Auth0's lazy migration changes on 20 January 2027, and half-imported users won't fix themselves

Your Databricks AI Functions need Runtime 17.3 LTS by January 2027, even if 15.4 is still supported

SonicWall's SSL VPN bug lets a valid password skip SAML and your MFA

Delinea Secret Server login bypass: why 12.2.7 won't save you from this 9.9

Dynamics 365 storage limits start to bite on 9 November: what gets blocked, how to get out

Entra password reset won't take directory phone numbers from February 2027. Who gets stuck?

Linux kernel CVE-2026-98432: why switching off MPTCP won't save you, and what to patch

Patch roundup, week of Nov 2: fix Linux and WS_FTP first, then work down the list

Export to Azure Data Lake stops on November 30. Is your Finance and Operations close ready?

Databricks vs Snowflake vs Microsoft Fabric: which one fits, and what it costs to change your mind

Mule 4.12 Edge leaves standard support this month. Upgrade to 4.13 before CloudHub does it for you

RSA SecurID primary support ends in stages from December. Here's how you get to 8.9

CyberArk to Delinea (and back): what a PAM migration really involves

Dynamics 365 Business Central vs Finance and Operations: which one you actually need

Zendesk is killing API tokens, and your Entra ID provisioning still runs on one

Terraform Enterprise 2.1 moves VCS ingress into your agents. What to change before October 2027

BeyondTrust Remote Support and PRA 24.3 lose support in November, and there's no one-step upgrade

Your Entra-to-Salesforce provisioning breaks on December 1. One permission fixes it

OpenShift 4.19 is running out of support. Do you park on 4.22 or keep going to 5.0?

Hive metastore to Unity Catalog: the Databricks migration plan, and what breaks on the way

Gemini 2.5 Pro and Flash calls change models on 1 December. What breaks, and what we'd do first

Agent Builder, Evals and saved prompts shut on 30 November. Here's what to pull out first

Password Safe 24.3 runs out of support in December, and 26.3 is still one upgrade away

CMS-0057-F on January 1, 2027: what health plans on Facets, QNXT and HealthRules need live

Still running Dynamics AX 2012? When to upgrade to Finance and Operations and when to start over

Upgrade Entra Connect Sync before April 2027 and move users off Microsoft's SMS codes

Chrome drops XSLT on 17 November. What breaks in InterSystems, and the fix for your version

What breaks in Entra ID this November: MemberOf, the PIM beta APIs and agent permissions

Patched GitLab, still exposed: the CI regex bug CISA lists as exploited, and the Ruby step people miss

Patched Ivanti Connect Secure in October? Two more exploited bugs, and the AD cleanup

Patch roundup, week of Oct 26: upgrade Secret Server today, then work down the list

UiPath 2023.10 support has run out and 2024.10 is next. What we'd upgrade first

Auth0 moved the Rules and Hooks deadline: Hooks stop on 30 April 2027, Rules on 31 January 2028

Still on Okta Classic Engine? Three features stop working on March 5, 2027, and two of them block the upgrade

SAP ECC mainstream maintenance ends in 2027: what you need to decide this quarter

SuccessFactors basic auth is going away: moving Entra HR provisioning to workload identity

Brotli CVE-2026-111497 is now on CISA's exploited list, and you probably run more copies than you think

Okta vs Microsoft Entra ID for enterprise security. Start with what you already pay for

What an SAP S/4HANA migration actually costs: the drivers, the ranges and where budgets break

Terraform and Vault under IBM: what the bill depends on, and when OpenTofu or OpenBao makes sense

CyberArk, Delinea or BeyondTrust? Choosing PAM now that CyberArk is Idira

dbt drops v1.3 to v1.7 from its platform on January 31, 2027: get pinned jobs onto a release track before they're deleted

SailPoint, Saviynt or Entra ID Governance? Start with where your apps live

Okta, Entra Agent ID, SailPoint or CyberArk? Who actually does what for your AI agents

IBM Verify Access flaws let attackers run code without a login: patch to 11.0.3.2

Foundry Workflows retire on December 1. We'd start moving yours to Agent Framework now

Vertex AI is retiring text-embedding-005 and three other embedding models: how to re-embed before search breaks

Azure mandatory MFA now blocks CLI, PowerShell and Terraform changes: moving service accounts to workload identities

Dataverse for Teams is going away: what to keep, move or let go before September 2027

Delinea Secret Server auth bypass: why the FIDO2 hotfix isn't enough

TLS certificates drop to 100 days in 2027 and 47 in 2029. Here's what breaks, and how to automate renewals first

Oracle Identity Governance and OAM 12.2.1.4 lose Premier Support on December 31: upgrade to 14c or replace?

Oracle's eMudhra alert now covers Database Server: patch, then test what breaks

SAP Identity Management ends in 2027: Entra ID, SailPoint or Saviynt?

Leaving VMware after Broadcom: OpenShift Virtualization, Nutanix or cloud, and what the move really takes

Windows Server 2016 support ends January 12, 2027: what to upgrade, what to move, and when ESUs make sense

Who owns your AI agents? How to find them, give each one a sponsor and stop their access creeping

Stopping a rogue AI agent: kill switches, token revocation and what OAuth can't do yet

From AI development to AI governance with AIDLC

BeyondTrust Remote Support zero-day: patch it, then check who got in

Patch PHP and Node.js this week: what broke and who's exposed

OpenShift support dates through 2027: which clusters run out first and how to plan the upgrades

Oracle's October security patches: what to fix first in EBS, PeopleSoft and Access Manager

HashiCorp Vault 2.2 explained: TPM login, post-quantum PKI and the October fixes

Upgrading to SailPoint IdentityIQ 9.0: what breaks and what to fix first

Terraform 1.17 explained: what's new, who it touches and how we'd upgrade

Is your AI agent running on someone else's login? Give it its own, and cap what it can do

How to choose an IAM implementation partner

In-house or consultancy? How to split a cloud migration so your team ends up owning it

What a SailPoint implementation actually costs

Zero trust means proving every access. Here's how to start, and what to do if someone's already in.

The multi-cloud tax, and how to stop paying it

RAG in production: what actually breaks

The access review nobody dreads

Your dashboard is lying by twelve hours