Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Parte trasera de un armario con servidores y latiguillos de red azules y verdes
9 min read

They broke into a fully patched appliance and went for the recovery keys

On 13 October, Volexity published its analysis of a fully patched remote access appliance on which someone gained unauthenticated root. The interesting part is not the bug: it is that no backdoor was left behind, that the vendor's integrity checker detects nothing because it all happens in memory, and that what they went looking for inside were LAPS passwords and BitLocker recovery keys. Your continuity plan is written against deletion, and here nobody deleted anything.

Cybersecurity VPN Continuity
Read more →
Puestos de trabajo con monitores y teclados en una oficina diáfana
8 min read

Mark of the Web: seven ways a file from outside stops looking like one

On Tuesday Microsoft patched a Windows Shell flaw already under exploitation, and its own entry says it let an attacker "evade Mark of the Web (MOTW) defenses". Before getting to that bug it is worth reading the Office documentation: the banner that blocks macros in an attachment depends on a tag which, by Microsoft's own account, has four ways of never being applied and three more of not deciding anything. And the policy that would make it mandatory is not available in every plan.

Windows Workplace Microsoft 365
Read more →
Unidad de cinta LTO-6 y ranuras de una biblioteca IBM TS3500
7 min read

GitLab's official recovery procedure starts with a DELETE

On 12 October GitLab shipped three versions over a CVSS 10.0 flaw that allows code execution on the server, and the release note itself warns that on a single-node instance the patch takes the instance down. If you also decide a rebuild is needed, the documented route when the secrets file is missing is to delete your CI/CD variables, null out runner tokens and disable two-factor authentication for everyone. Nine things stop being accessible; the code is not one of them.

Backup Cybersecurity GitLab
Read more →
Bahías de disco de una cabina montada en rack, con unidades etiquetadas y varios huecos vacíos
6 min read

The last Ceph Squid patch is not in your Proxmox repository

On 12 October 2026 Ceph shipped 19.2.7, the seventh backport in the Squid series, with the usual line: "we recommend that all deployments update to this release". Today we checked what the Proxmox repository actually serves, and the answer is 19.2.6-pve4, with an index dated 9 September. The branch dies on 31 October. Two different calendars, and the one that governs you is not the one on ceph.io.

Ceph Proxmox Storage
Read more →
Frontales de servidores montados en un chasis de rack, con latiguillos etiquetados a mano y pilotos verdes encendidos
9 min read

HyperArmor does not patch ESX: it buys you time

Broadcom introduced VMware HyperArmor today: a separately sold layer that mitigates ESX hypervisor flaws with "no host reboots or software upgrades". The most honest sentence of the launch came from one of its own engineers: "this basically buys you time". The free route to avoiding the reboot has existed since vSphere 8.0 Update 3, and it ships with a written exclusion list: TPMs, DPUs and virtual machines without Fast Suspend and Resume. Of the three pieces HyperArmor sells, one is already sitting on your host, switched off.

VMware Virtualization Patching
Read more →
Filas de puestos de trabajo idénticos en una sala: mismos monitores, mismos teclados, misma imagen instalada
8 min read

Windows 11 24H2 stops getting updates today, and your fleet is on the latest build

Today, 13 October 2026, Windows 11 version 24H2 stops receiving updates on Home and Pro. Microsoft's own table lists the same cumulative update, KB5124010, in four rows with four different end dates, and two of those rows carry the identical build number: 26100.9550. One expires today; the other, the IoT Enterprise LTSC line, has extended support until 2034. The date is not in the code: it is in the edition and the channel.

Windows Patching Maintenance
Read more →
Parte trasera de un armario de servidores con los latiguillos de red saliendo de cada nodo hacia los de al lado
10 min read

The switchless Ceph mesh has four variants. Two of them break on one cable

Three nodes wired directly to each other at 25 GbE, with no switch to buy, is one of the best decisions you can make on a small budget. Proxmox documents four ways to wire it and only two survive a single link going down: in the other two, its own wiki says, "the nodes now have a different view" and Ceph reports services as down that are perfectly alive. Since Proxmox VE 9 that mesh is configured from the web interface, with four fabric protocols. And the official documentation still labels that layer tech preview.

Proxmox Ceph Networking
Read more →
Escritorio con un portátil de pantalla apagada, una libreta abierta con anotaciones a mano y una taza de café
9 min read

The SDK behind your AI agents has six new advisories. Your scanner says zero

Between 28 September and 5 October 2026, the Model Context Protocol Python SDK published six security advisories, three of them scored 7.5. As of 12 October none of the six appears in OSV, nor in the global GitHub database that fires Dependabot, nor in the PyPI API that pip-audit queries by default; the only one carrying a CVE is not in the NVD either. We checked it with two public API calls you can repeat in a minute. And two of the six state in writing that upgrading, on its own, fixes nothing.

AI Automation Vulnerabilities
Read more →
Estantería de archivo con cajas de documentos numeradas y atadas con cinta de tela
9 min read

SharePoint breaks the "Specific people" link, not the "Anyone" link

During October 2026 Microsoft is retiring SharePoint Online one-time passcode authentication in commercial tenants. You cannot pick the date, you cannot opt out, and it cannot be scoped per site. What stops opening is the named link, the one that made you type the recipient's address; the "Anyone with the link" one carries on unchanged. And the report Microsoft points you to in order to find who you are about to lock out excludes, in writing, links that were emailed and never clicked. What to check, what the EnableAzureADB2BIntegration setting no longer means, and why the right fix is not resharing in bulk.

Microsoft 365 SharePoint Identity
Read more →
Cuarto de cableado de un edificio con un conmutador sobre una balda, bloques de conexión antiguos y latiguillos sueltos
9 min read

Only one of the eight exploited flaws is in a network appliance

Joint advisory AA26-281A, signed in Spain by the CNI, lists eight CVEs successfully exploited by Flax Typhoon. One is in a network appliance, a Pulse Connect Secure; the other seven are software on servers: Bash and BIND ship with the OS, Struts travels inside a Java application, and ProFTPD, GitLab, ONLYOFFICE Docs and Strapi were stood up by someone on a specific day. Three were already in CISA's catalogue, two since November 2021 with the ransomware flag set. The counts done on the catalogue JSON, with the commands, and the three questions that actually build that inventory.

Cybersecurity Vulnerabilities Inventory
Read more →
Repartidor de fibra óptica con conectores verdes y latiguillos amarillos, y la mano de un técnico alcanzando un puerto
9 min read

The circuit was fine and the video call dropped anyway

Your carrier closes the ticket as "within contracted parameters" and your SD-WAN has the graph of the drop. Both figures are correct: what differs is the measurement point, the window and the traffic class, and all three sit in the standards underneath the contract. ITU-T Recommendation Y.1541 asks that any minute observed should meet the objectives; an availability contract averages the whole month, and 129 twenty-second drops fit inside a monthly 99.9% without breaching it. The seven lines of annex to write before you sign.

Networking SD-WAN Monitoring
Read more →
Pasillo de una sala de servidores a oscuras, iluminado solo por los pilotos de los equipos, con un taburete vacío olvidado en medio
9 min read

The miner switches off when you open Task Manager

The AhsayCBS intrusion Huntress documented on 8 October 2026 included a PowerShell script that stops the miner service when you open Task Manager, restarts it when you close it, and kills Task Manager itself at six in the evening. What the attacker modelled was not the antivirus: it was the working hours of whoever looks. Why interactive checking is not detection, and a ten-minute test to find out whether yours is.

Cybersecurity EDR/MDR Backup
Read more →
Frontal de un rack de servidores con varias generaciones de equipos apiladas, iluminadas por sus propios pilotos
8 min read

Multi-hypervisor is not a phase: it is what you will maintain twice

Sixty percent of the VMware customers surveyed by Unisphere Research are considering a multi-hypervisor strategy, and the four barriers they cite most — operational complexity 40%, multi-vendor management 38%, and tied at 37% securing the increased attack surface and team skills — are precisely what running two platforms at once installs in your shop. The list of what you end up maintaining twice, what genuinely does get halved, and when the dual state is the right call.

Virtualization VMware Migration
Read more →
Pared de buzones metálicos numerados en el vestíbulo de un edificio, con una papelera al fondo
8 min read

Your Exchange Online backup hangs on a single text field

Microsoft flipped the switch today, 10 October, in its multi-tenant cloud: a tenant with EwsEnabled set to $true and an empty allowed-application list stops letting every app through and starts letting none through. On the 8th and 9th Microsoft wrote that list for you, from whatever it saw using EWS over the previous 60 days. If you back up Microsoft 365 mailboxes, your backup now depends on a list you probably did not write, stored in a parameter the documentation declares as a text field that supports no add and no remove: only a full rewrite.

Backup Microsoft 365 Exchange
Read more →
Hilera de volantes de válvula industriales en un nicho de hormigón, fotografía documental en blanco y negro
9 min read

FortiMail: patch out on the 2nd, advisory on the 7th, mitigation still on

On 1 October Fortinet published a 9.8 flaw in FortiMail, exploited and with no fixed release. The only mitigation available was to switch off IBE encryption: the channel your company uses to send confidential documents to people outside it. The fixed release notes are dated 2 October; the advisory did not say so until the 7th. If your trigger for removing the mitigation is the advisory, your clock runs five days behind. Inside: the branch table (including the branch that gets no patch), the indicators Fortinet did publish, what the public documentation does NOT answer, and a six-line record so a temporary mitigation does not last six months.

Cybersecurity Patching Vulnerabilities
Read more →
Pasillo en penumbra de una sala de servidores, con dos filas de armarios cerrados y sus pilotos encendidos
9 min read

Your VMware provider expires before your contract does

On 8 October 2026 IBM handed "hundreds" of its VMware cloud customers over to another company. None of them signed that deal. The date that governs a hosted VMware cloud is not in your contract: it is in the partner agreement your provider holds with Broadcom. Inside: the January FAQ sentence that describes what just happened nine months in advance, the seven dates with their owner in one table, the two days between 31 March and 2 April 2027, why "VCF 7" does not exist in Broadcom's documentation, and four questions that fit in one email.

Virtualization Licensing Cloud
Read more →
Bastidor de paneles de parcheo de fibra óptica con mazos de latiguillos naranjas
9 min read

43 CVEs in your array's fibre switch, and not one is critical

On 8 October 2026 the NVD published 43 Brocade Fabric OS vulnerabilities on the same day. None critical, the highest 8.7, and 38 of the 43 require credentials. Those three numbers are precisely why nobody will patch this. Inside: the attacker the batch imagines does not come from the internet —it is another switch in your own fabric—, why the 7.1 on CVE-2026-87659 misleads, the maintenance-window excuse dismantled with the vendor's own documentation, the two version branches that do not line up, and four ownership questions instead of a checklist.

Storage Cybersecurity Datacenter
Read more →
Sala con filas de puestos de trabajo idénticos, mamparas bajas y sillas vacías
12 min read

Microsoft retires Targeted Release: your test ring is now paid for by everyone else

On 7 October 2026 Microsoft published advisory MC1490899 and updated three documentation pages the same day: Targeted release retires in January 2027 and from November 2026 its list can no longer be touched. The coverage reads it as a rename to Standard and Deferred. It is not. Reading the three pages together yields something else: to keep a validation group that runs ahead, Microsoft's own recommendation is not to move the pilot forward but to hold everyone else back by thirty days. Inside: the official mapping table read backwards, the documented cap of 100 users where each member of a security group counts one by one, the two kinds of change Deferred does NOT delay, and the seven checks that fit in half an hour before 31 October.

Microsoft 365 Workplace Compliance
Read more →
Pasillo de un centro de datos con un rack abierto, un carro de consola con monitor y teclado, y una silla vacía
9 min read

A VM escape with no CVE and no patch: what root on a Proxmox node reaches

On Tuesday 6 October 2026 The Register reported that a researcher claims a guest-to-host escape in KVM, that Vercel's CEO confirmed it inside their bounty programme, and named Proxmox among those relying on KVM. There is no CVE, no patch and no technical detail. Since there is nothing to patch, what is measurable today is the radius: Proxmox VE's documentation says QEMU runs as a root process, so it is one hop and not two; and root on one node reads /etc/pve/priv, which pmxcfs replicates in real time to every node. Inside: the table of ten files with their official descriptions, why the backup password sits there "in plain text" next to the encryption key, and the rotation list, line by line, with what each one costs.

Virtualization Zero Trust Backup
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN