Protect OT, Contracts, and Cloud Supply Chains from New Threats

What happened

US federal agencies reported attackers using AI‑generated exploit scripts with open‑source industrial automation libraries to access Siemens S7 PLCs. The alert names internet‑exposed S7 devices and recommends immediate inventory, patching, and network isolation checks as mitigation steps. Treat this as operationally real and watch for supplier responses on emergency support availability and contract terms

Why the category manager should care

This is an active operational threat that creates immediate procurement and contractual obligations to ensure suppliers can patch, detect, and support OT devices

Key facts

• Joint alert issued by multiple US federal agencies
• Targets internet‑exposed Siemens S7 Series PLCs
• Detection hints include unapproved Snap7 library usage and port 102 scanning

What happened

GitHub attributed a near 8‑hour outage to a misconfigured autoscaling policy and a retry storm that amplified traffic to internal token services. The incident shows that latent monitoring blind spots and optimistic retry logic in client tools can overwhelm internal services and delay recovery. Procurement should treat key developer platforms and token services as high‑impact dependencies when negotiating SLAs and incident duties

Why the category manager should care

Developer toolchain outages can stall security fixes and CI/CD; include tooling continuity in supplier risk assessments and contract terms

Key facts

• Outage lasted nearly eight hours according to GitHub's post‑mortem
• Root causes included autoscaling misconfiguration and retry amplification
• Impact extended to Issues, Pull Requests, Actions, and Copilot token services

What happened

Microsoft will retire the license‑included version of Azure VMware Solution and require customers to bring VCF licenses or move to a different arrangement. The change forces AVS users to decide whether to acquire Broadcom's VCF licenses or replatform, creating procurement and licensing work for affected deployments. Watch how hyperscalers and channel partners adjust offers and whether resale routes disappear further

Why the category manager should care

This is a commercial change that directly affects virtualization procurement and could increase TCO or force replatforming decisions

Key facts

• Microsoft to stop selling license‑included AVS (announcement made publicly)
• Customers told to acquire VCF licenses or transition to a new Azure arrangement
• Transition planning recommended to avoid service disruption

What happened

DataVita secured a large financing package to expand datacenter capacity in Scotland's AI Growth Zone and pre‑leased capacity to an AI tenant. The expansions are being delivered and capacity is contracted, which tightens regional capacity availability for buyers seeking colocated or power‑dense racks. Procurement teams looking for AI colo capacity should expect reduced short‑term flexibility and negotiate contingency terms

Why the category manager should care

This is a market capacity signal: committed capacity reduces availability and can push buyers into longer or higher‑commitment deals

Key facts

• Financing secured to expand DV1 and build DV3 datacenter facilities
• Each expanded/ new facility is specified to deliver high power capacity per rack
• CoreWeave has leased capacity of the new facilities under long‑term deals