Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Pasillo entre armarios de servidores encendidos en una sala técnica real, con un taburete de madera olvidado en el pasillo
10 min read

SafePay's five doors: not one of them is from 2026

The joint advisory on SafePay published on 20 October 2026 — FBI, CISA, the Secret Service and three European police bodies, at least 600 victims since August 2024 — lists five exploited vulnerabilities. Not one is from 2026 or 2025: three sit in the firewall that lets people in and two in the backup server that was meant to save you. The detail almost nobody has covered is that NAS devices do not get their files deleted: they get reset to factory settings. We go through the five doors with their fixed versions, why patching does not close the session already taken, when NOT to patch first thing tomorrow, and the eight checks we run ourselves.

Ransomware Backup Patching
Read more →
Tablero de madera con decenas de llaves colgadas de clavos, cada una con su etiqueta
9 min read

Your Microsoft 365 backup signs in with a key you do not hold

On 17 October ConnectWise cut access to its Microsoft 365 backup service after detecting unauthorised access to application identities. Huntress counted 162 tenants with unauthorised sign-ins. Nobody stole a password and nobody failed an MFA prompt: the application authenticated with its own credential, which lives in the vendor's tenant and not in yours. The uncomfortable part is written in Microsoft's own documentation: Conditional Access for workload identities — the policy that would block sign-ins from outside your known IP ranges — does not cover third-party multitenant applications. We go through what happened with the timestamps attached, why the control you would reach for does not apply, and the four things you can actually do from your own tenant.

Backup Microsoft 365 Identity
Read more →
Unidad de cinta LTO-6 y ranuras de una biblioteca IBM TS3500
7 min read

GitLab's official recovery procedure starts with a DELETE

On 12 October GitLab shipped three versions over a CVSS 10.0 flaw that allows code execution on the server, and the release note itself warns that on a single-node instance the patch takes the instance down. If you also decide a rebuild is needed, the documented route when the secrets file is missing is to delete your CI/CD variables, null out runner tokens and disable two-factor authentication for everyone. Nine things stop being accessible; the code is not one of them.

Backup Cybersecurity GitLab
Read more →
Pasillo de una sala de servidores a oscuras, iluminado solo por los pilotos de los equipos, con un taburete vacío olvidado en medio
9 min read

The miner switches off when you open Task Manager

The AhsayCBS intrusion Huntress documented on 8 October 2026 included a PowerShell script that stops the miner service when you open Task Manager, restarts it when you close it, and kills Task Manager itself at six in the evening. What the attacker modelled was not the antivirus: it was the working hours of whoever looks. Why interactive checking is not detection, and a ten-minute test to find out whether yours is.

Cybersecurity EDR/MDR Backup
Read more →
Pared de buzones metálicos numerados en el vestíbulo de un edificio, con una papelera al fondo
8 min read

Your Exchange Online backup hangs on a single text field

Microsoft flipped the switch today, 10 October, in its multi-tenant cloud: a tenant with EwsEnabled set to $true and an empty allowed-application list stops letting every app through and starts letting none through. On the 8th and 9th Microsoft wrote that list for you, from whatever it saw using EWS over the previous 60 days. If you back up Microsoft 365 mailboxes, your backup now depends on a list you probably did not write, stored in a parameter the documentation declares as a text field that supports no add and no remove: only a full rewrite.

Backup Microsoft 365 Exchange
Read more →
Pasillo de un centro de datos con un rack abierto, un carro de consola con monitor y teclado, y una silla vacía
9 min read

A VM escape with no CVE and no patch: what root on a Proxmox node reaches

On Tuesday 6 October 2026 The Register reported that a researcher claims a guest-to-host escape in KVM, that Vercel's CEO confirmed it inside their bounty programme, and named Proxmox among those relying on KVM. There is no CVE, no patch and no technical detail. Since there is nothing to patch, what is measurable today is the radius: Proxmox VE's documentation says QEMU runs as a root process, so it is one hop and not two; and root on one node reads /etc/pve/priv, which pmxcfs replicates in real time to every node. Inside: the table of ten files with their official descriptions, why the backup password sits there "in plain text" next to the encryption key, and the rotation list, line by line, with what each one costs.

Virtualization Zero Trust Backup
Read more →
Técnico agachado con un portátil delante de un armario de servidores abierto en una sala técnica
7 min read

Read-only in the backup console was not read-only

On 6 October 2026 Veeam published advisory KB4934 with three Backup & Replication vulnerabilities. Two of the three are triggered by the same role: Backup Viewer, the one handed out without a second thought because it is there for looking. The worst reaches 9.4 and runs code on the backup server; the other, scored 6.1, allows deleting the Enterprise Manager master key, which is the documented mechanism for decrypting a backup when the password is lost. Inside: the table of all three CVEs with their vectors, why PR:L is the part that matters, and the role assignment list no recovery plan includes.

Backup Continuity Vulnerabilities
Read more →
Interior de una librería de cintas con el mecanismo del lector a la vista y una columna de ranuras vacías al fondo
9 min read

Microsoft deleted data before the window closed, and cannot say which

In late September 2026 it emerged that Microsoft, "due to an error", deleted data from expired subscriptions under its nonprofit programme before the retention and export window had closed. It could not be recovered. And there is a second half: it is currently unable to hand over a list of which data may have been deleted. Inside: the official Microsoft 365 countdown —30 days of Expired plus 90 of Disabled— and its asterisk; the 30 days that counter lost on 9 February 2026 for anyone buying direct under a Microsoft Customer Agreement; the four documented shortcuts that zero it, including the immediate deletion of SharePoint and OneDrive; and why article 33(5) of the GDPR asks you to document facts that, without an independent copy, you cannot enumerate.

Backup Microsoft 365 Compliance
Read more →
Escritorio doméstico de noche con un monitor, un teclado retroiluminado y un micrófono, iluminado solo por una lámpara
10 min read

$250 to get in, one million euros of damage

On 30 September, in Operation KillSwitch, authorities switched off KillSec: three arrests, eight premises searched, five servers and at least 110 TB of stolen data secured. The figure that was nobody's headline is the price list: joining that business as an affiliate cost $250 and the house kept 12 % of every ransom. Inside: Operation ROTOMA by the Guardia Civil and the Mossos, the two Alicante searches and the early-2025 cyberattack on a Catalan organisation with an estimated damage of close to one million euros; the January 2025 price change and the ESXi locker that deleted snapshots; why the suspect's age measures the barrier to entry rather than sophistication; the four doors they came in through, one of them without even touching your network; our two averages on the 110 TB with the assumptions declared; what a seizure does not delete; and the inventory of checks, run from the outside, that you can close this week.

Ransomware Cybersecurity Cloud
Read more →
Sala de servidores con racks cableados y un módulo de gestión de potencia
9 min read

Moving to Proxmox 9.2 wasn't your call: the repository made it

Ask whoever runs your cluster who decided to go from 9.1 to 9.2, and in which meeting it was approved. In most places nobody decided: Proxmox VE ships no repository per minor version —there is nothing like a pve-9.1-security— so a routine apt dist-upgrade, the same one applying the patches you do want, leaves you on the latest published minor. The software that takes your backups does have a supported-version matrix, and it runs behind: Proxmox VE 9.2 shipped on 21 May 2026 and the Veeam plug-in covering it arrived on 29 July, 69 days later. And one detail misleads: plug-in 3.3 for the 13.0 branch shipped on 25 August, twenty-seven days AFTER 4.0, so "I am up to date" can mean up to date on the branch that does not carry the new support. Nothing turns red; what you lose is the right to open a case. The three facts that must live on the same line before you open the window, why the right order is matrix first and apt second, the ARM architecture boundary, and where this crack does not exist.

Proxmox Backup Maintenance
Read more →
Interior de una librería de cintas con los cartuchos alineados en sus ranuras
9 min read

Your immutable backup has a permission that deletes it

"Our backups are immutable" is an incomplete sentence, and Amazon's documentation proves it. Object Lock has two modes: in compliance mode nobody can delete anything, not even the root user, and the only documented way out is closing the AWS account; in governance mode anyone holding the s3:BypassGovernanceRetention permission can delete. Both are called immutability. And AWS adds a note almost nobody has read: the web console includes the header needed to override the lock by default, so the friction exists in the API and vanishes in the interface. Also: why the intuitive test (trying to delete an object) returns 200 OK and misleads you in both directions, why Veeam adds 30 days to the immutability you configured on S3, and what that 93% / 16% study doing the rounds in September actually says —including a sample that looks nothing like your company—. And at the end, a sentence with four blanks that whoever runs your backups has to be able to finish.

Backup Ransomware Cybersecurity
Read more →
Sala con filas de puestos de trabajo y ordenadores bajo luz fluorescente
8 min read

CVE-2026-32996: the backup agent left the administrator ticket written in a log file

The exploit overflows no stack and corrupts no memory: it opens a text file any user on the machine can read, finds a session identifier inside, presents it over a named pipe and runs whatever you want as SYSTEM. With the vendor advisory in front of us, three things being reported wrong about CVE-2026-32996 in Veeam Agent for Windows: the version the headlines quote (13.0.1.2067) is the server build, not the agent one —the number to check is 13.0.3.1220—; the patch for two hundred laptops hangs off the change window of the backup server, the machine nobody wants to touch; and the phrase "active exploitation" was only ever in the headline of a bulletin whose body said something else, and which was then pulled. Why AT:P in the vector changes which machines you look at first, and the four things we would do this week.

Backup Vulnerabilities Patching
Read more →
Armario de servidores con cada máquina etiquetada a mano, una por una
8 min read

Your Proxmox backup skips disks and the job still turns green

The limitations page for the Veeam plug-in for Proxmox VE was updated on 15 September 2026, and two lines in it carry the word that really matters: skipped. There are two very different kinds of "not supported": the one that stops your job and the one that skips a disk and paints the job green. What falls outside the backup of a Proxmox platform, what does not come back when the machine comes back, why LXC containers are a separate inventory, and why the backup manual gets read before you choose your storage rather than on restore day.

Proxmox Backup Disaster Recovery
Read more →
Sala de reuniones vacía con mesa larga, sillas y una pizarra de cristal borrada al fondo
5 min read

Your Teams chats are not in your backup

Microsoft 365 Backup protects three workloads: OneDrive, SharePoint and Exchange Online. Teams chat is none of them. And on the limitations page of one of the most widely deployed third-party tools, individual and group chats appear in the list of what is not backed up. Where a Teams message actually lives according to Microsoft's own documentation, why a retention policy preserves but does not restore, the 21 days it takes a deleted message to reach the SubstrateHolds folder, and the six questions we ask of a company's Microsoft 365 backup before touching anything.

Backup Microsoft 365 Continuity
Read more →
Pasillo de un depósito de archivo con estanterías móviles cerradas y cajas de documentación
8 min read

Project Online shuts down on 30 September: no licence, no export

Microsoft switches Project Online off on 30 September and PWA sites stop being available. But what decides whether you make it in time is not in the announcement: it is in the service description, which requires a live Plan 3 or Plan 5 subscription in the tenant for ANY interaction. Which means the licence you were going to drop to save money during the migration is the one you need in order to export. There is also a second 120-day clock written somewhere else, the PWA is a SharePoint site and not a calendar, and the destination's published limits explicitly exclude your plan.

Microsoft 365 Data SaaS
Read more →
Vista aérea de un corredor de centros de datos: naves industriales bajas y anchas repartidas a lo largo de una autopista
13 min read

Your cloud can lose one zone. AWS just lost a Region

On 15 September AWS wrote on its health dashboard that it cannot restore resources and data hosted "exclusively" in the Bahrain Region or in the mec1-az2 zone in the UAE. That one word separates the customers who lost data from the ones who did not. The perimeter of that redundancy was published all along: S3 is designed to survive the loss of ONE zone, and zones sit within 100 km of each other. What the documentation says, what the contract says, and the four questions we write down before touching anything.

Cloud Disaster recovery Continuity
Read more →
Parte trasera de un chasis de servidor con módulos de ventilador y cables de alimentación
10 min read

Acronis Backup: "requires local access" — and that access is what you sell your customers

On 15 September Acronis published a one-sentence advisory: local privilege escalation through insecure file permissions in its backup plugin for cPanel and Plesk, CVSS 7.8, exploited in targeted attacks. A "local" 7.8 is exactly the CVE almost every patching queue pushes to next week. On a machine with a single administrator, that call is defensible. On a server where every customer gets their own system user, the requirement for "local access with low privileges" is not describing a barrier: it is describing your business model.

Cybersecurity Backup Patching
Read more →
Parte trasera de una librería de cintas con las unidades LTO y su cableado de fibra
5 min read

Broadcom pulls the VDDK: the first thing that breaks is not your migration, it is your backup

In late August the download pages for the Virtual Disk Development Kit started returning a 404, with no announcement and no deprecation notice. The coverage has read it as "leaving VMware just got harder", and that is half true: it depends where you are going, because Proxmox VE's ESXi importer does not even use it. What almost nobody has looked at is Broadcom's exact wording — "no longer available for use or download" — or the place where that library has been working for twenty years without anyone looking at it: inside your backup.

VMware Backup Virtualization
Read more →
Cajas de archivo numeradas en estanterías de un depósito documental
9 min read

One checkbox will protect a whole workload in Microsoft 365 Backup. What it bills is not what you see in the usage report

Full Workload Backup reaches general availability from mid-September: one policy per workload protecting every SharePoint site, or every OneDrive account, or every mailbox, including the ones created later. List price is $0.15 per GB per month, applied to a base that adds in the second-stage recycle bin and online archives. Microsoft warns that its own usage report includes neither, "and is thus incomplete", and offers a calculator that does ask for them. The problem is that the report is what everybody looks at.

Backup Microsoft 365 Costs
Read more →
Priority Cleanup de Microsoft Purview: borrar por encima de la retención en Microsoft 365
9 min read

Deleting above retention: three approvals in Exchange, one in SharePoint

Microsoft Purview Priority Cleanup deletes Microsoft 365 content by overriding retention policies, labels and eDiscovery holds, and the documentation says what it deletes cannot be restored by users, by admins, or by Microsoft. Mailboxes always demand three approvals; SharePoint and OneDrive, one — and none from the retention owner. What stops it, what to switch off beforehand, and what it asks of your backup.

Microsoft 365 Backup Compliance
Read more →
  • 1
  • 2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN