Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Pasillo de estanterías compactas de archivo, cerradas, con sus manivelas de accionamiento
9 min read

The advisory came 47 days late and your logs last 30

On 15 October BeyondTrust published CVE-2026-102764, a critical flaw in its remote support product that an espionage group had been exploiting since 29 August: 47 days of head start. CISA added it to the known exploited vulnerabilities catalogue on the 16th and gave federal agencies a deadline of today, 19 October. Patching is the easy half; the other half is the day-48 question — were we in it? — and the patch does not answer it, what answers it is what you decided months ago about log retention. With Entra ID defaults (7 days on Free, 30 on P1 and P2) and Defender XDR's 30 days of raw data, 29 August no longer exists in your identity log or your EDR. And Microsoft's own documentation says it plainly: retention is not retroactive.

Cybersecurity Compliance Monitoring
Read more →
Tablero de madera con decenas de llaves colgadas de clavos, cada una con su etiqueta
9 min read

Your Microsoft 365 backup signs in with a key you do not hold

On 17 October ConnectWise cut access to its Microsoft 365 backup service after detecting unauthorised access to application identities. Huntress counted 162 tenants with unauthorised sign-ins. Nobody stole a password and nobody failed an MFA prompt: the application authenticated with its own credential, which lives in the vendor's tenant and not in yours. The uncomfortable part is written in Microsoft's own documentation: Conditional Access for workload identities — the policy that would block sign-ins from outside your known IP ranges — does not cover third-party multitenant applications. We go through what happened with the timestamps attached, why the control you would reach for does not apply, and the four things you can actually do from your own tenant.

Backup Microsoft 365 Identity
Read more →
Estanterías metálicas de una sala de archivo con cajas y legajos de documentos
7 min read

Nextcloud and CVE-2026-110447: the hole opens when something goes down

On 14 October Collabora published the advisory for CVE-2026-110447: 9.2 out of 10, unauthenticated command injection in an optional Nextcloud app plenty of people installed one afternoon. And one sentence in the advisory that changes the whole job: "the attack only works while the built-in CODE server is not running". The exploitation window is your maintenance window: the restart, the upgrade, the process that died at three in the morning and nobody saw because monitoring stayed green. Why the 9.2 carries a letter almost nobody reads, why disabling the app is not enough, what to look for if it already happened, and when this is not your problem.

Cybersecurity Vulnerabilities Monitoring
Read more →
Armario de red de pared con equipamiento y cableado a la vista
6 min read

PAN-OS CVE-2026-0322: there is no single patch, there are twenty

Palo Alto published the advisory on 14 October 2026 with exploitation already observed, and CISA added it to the KEV the same day with a 17 October federal deadline and the forensic triage flag set. When you open the advisory looking for the patch, you do not find one: you find twenty fixed versions across five branches, six in 11.1 alone, because the vendor fixes on the maintenance train you are already on. What the advisory actually says, what pushes the 8.6 up and down at once, why Panorama is the piece that hurts most, and the five things we would do this week.

Cybersecurity Vulnerabilities Networking
Read more →
Armario de distribución de fibra abierto, con bandejas, latiguillos y módulos a la vista
9 min read

Two 10.0s in Arista EOS and no hotfix: your config decides, not your version

Two 10.0-out-of-10 flaws in data centre switches, both without a hotfix, published in September and with remarkably little noise around them. The reason for that silence is also the interesting part: nobody knows how many devices are affected, because exposure is not decided by the installed version but by two configuration lines almost nobody inventories. What the Arista advisories actually say, why they are 10.0 and not 9.8, the twenty-second check per device, and the three fields missing from any network inventory.

Networking Vulnerabilities Inventory
Read more →
Interior de un armario de comunicaciones con regletas de conexión, latiguillos y un equipo montado en la pared
9 min read

The fix needs no window and no restart, which is why it may not be in place

On 14 October Cisco published a 9.8 flaw in its email gateway, exploited before the advisory went out. The striking part is not the score: it is that the fix ships as a scanning-engine package that "does not require a software upgrade or a product restart". That sounds like good news, and it is precisely what keeps it out of your patching process, which is built from tickets, windows and restarts. What to look at before that engine changes version, and why for an arbitrary file write "patched" does not mean "clean".

Cybersecurity Patching Vulnerabilities
Read more →
Parte trasera de un armario con servidores y latiguillos de red azules y verdes
9 min read

They broke into a fully patched appliance and went for the recovery keys

On 13 October, Volexity published its analysis of a fully patched remote access appliance on which someone gained unauthenticated root. The interesting part is not the bug: it is that no backdoor was left behind, that the vendor's integrity checker detects nothing because it all happens in memory, and that what they went looking for inside were LAPS passwords and BitLocker recovery keys. Your continuity plan is written against deletion, and here nobody deleted anything.

Cybersecurity VPN Continuity
Read more →
Puestos de trabajo con monitores y teclados en una oficina diáfana
8 min read

Mark of the Web: seven ways a file from outside stops looking like one

On Tuesday Microsoft patched a Windows Shell flaw already under exploitation, and its own entry says it let an attacker "evade Mark of the Web (MOTW) defenses". Before getting to that bug it is worth reading the Office documentation: the banner that blocks macros in an attachment depends on a tag which, by Microsoft's own account, has four ways of never being applied and three more of not deciding anything. And the policy that would make it mandatory is not available in every plan.

Windows Workplace Microsoft 365
Read more →
Unidad de cinta LTO-6 y ranuras de una biblioteca IBM TS3500
7 min read

GitLab's official recovery procedure starts with a DELETE

On 12 October GitLab shipped three versions over a CVSS 10.0 flaw that allows code execution on the server, and the release note itself warns that on a single-node instance the patch takes the instance down. If you also decide a rebuild is needed, the documented route when the secrets file is missing is to delete your CI/CD variables, null out runner tokens and disable two-factor authentication for everyone. Nine things stop being accessible; the code is not one of them.

Backup Cybersecurity GitLab
Read more →
Frontales de servidores montados en un chasis de rack, con latiguillos etiquetados a mano y pilotos verdes encendidos
9 min read

HyperArmor does not patch ESX: it buys you time

Broadcom introduced VMware HyperArmor today: a separately sold layer that mitigates ESX hypervisor flaws with "no host reboots or software upgrades". The most honest sentence of the launch came from one of its own engineers: "this basically buys you time". The free route to avoiding the reboot has existed since vSphere 8.0 Update 3, and it ships with a written exclusion list: TPMs, DPUs and virtual machines without Fast Suspend and Resume. Of the three pieces HyperArmor sells, one is already sitting on your host, switched off.

VMware Virtualization Patching
Read more →
Escritorio con un portátil de pantalla apagada, una libreta abierta con anotaciones a mano y una taza de café
9 min read

The SDK behind your AI agents has six new advisories. Your scanner says zero

Between 28 September and 5 October 2026, the Model Context Protocol Python SDK published six security advisories, three of them scored 7.5. As of 12 October none of the six appears in OSV, nor in the global GitHub database that fires Dependabot, nor in the PyPI API that pip-audit queries by default; the only one carrying a CVE is not in the NVD either. We checked it with two public API calls you can repeat in a minute. And two of the six state in writing that upgrading, on its own, fixes nothing.

AI Automation Vulnerabilities
Read more →
Cuarto de cableado de un edificio con un conmutador sobre una balda, bloques de conexión antiguos y latiguillos sueltos
9 min read

Only one of the eight exploited flaws is in a network appliance

Joint advisory AA26-281A, signed in Spain by the CNI, lists eight CVEs successfully exploited by Flax Typhoon. One is in a network appliance, a Pulse Connect Secure; the other seven are software on servers: Bash and BIND ship with the OS, Struts travels inside a Java application, and ProFTPD, GitLab, ONLYOFFICE Docs and Strapi were stood up by someone on a specific day. Three were already in CISA's catalogue, two since November 2021 with the ransomware flag set. The counts done on the catalogue JSON, with the commands, and the three questions that actually build that inventory.

Cybersecurity Vulnerabilities Inventory
Read more →
Pasillo de una sala de servidores a oscuras, iluminado solo por los pilotos de los equipos, con un taburete vacío olvidado en medio
9 min read

The miner switches off when you open Task Manager

The AhsayCBS intrusion Huntress documented on 8 October 2026 included a PowerShell script that stops the miner service when you open Task Manager, restarts it when you close it, and kills Task Manager itself at six in the evening. What the attacker modelled was not the antivirus: it was the working hours of whoever looks. Why interactive checking is not detection, and a ten-minute test to find out whether yours is.

Cybersecurity EDR/MDR Backup
Read more →
Hilera de volantes de válvula industriales en un nicho de hormigón, fotografía documental en blanco y negro
9 min read

FortiMail: patch out on the 2nd, advisory on the 7th, mitigation still on

On 1 October Fortinet published a 9.8 flaw in FortiMail, exploited and with no fixed release. The only mitigation available was to switch off IBE encryption: the channel your company uses to send confidential documents to people outside it. The fixed release notes are dated 2 October; the advisory did not say so until the 7th. If your trigger for removing the mitigation is the advisory, your clock runs five days behind. Inside: the branch table (including the branch that gets no patch), the indicators Fortinet did publish, what the public documentation does NOT answer, and a six-line record so a temporary mitigation does not last six months.

Cybersecurity Patching Vulnerabilities
Read more →
Bastidor de paneles de parcheo de fibra óptica con mazos de latiguillos naranjas
9 min read

43 CVEs in your array's fibre switch, and not one is critical

On 8 October 2026 the NVD published 43 Brocade Fabric OS vulnerabilities on the same day. None critical, the highest 8.7, and 38 of the 43 require credentials. Those three numbers are precisely why nobody will patch this. Inside: the attacker the batch imagines does not come from the internet —it is another switch in your own fabric—, why the 7.1 on CVE-2026-87659 misleads, the maintenance-window excuse dismantled with the vendor's own documentation, the two version branches that do not line up, and four ownership questions instead of a checklist.

Storage Cybersecurity Datacenter
Read more →
Armario de comunicaciones real con switch, regletas de conexión y latiguillos de fibra sobre pared de contrachapado
8 min read

Thirteen of ClearPass's twenty-eight flaws are in the agent, not the server

On 6 October 2026 HPE published advisory HPESBNW05158 with 28 ClearPass Policy Manager vulnerabilities: 10 critical, 11 high and 7 medium. The interim mitigation the advisory itself recommends names the CLI and the web-based management interface, both of them on the server. We classified all 28 by the component HPE names in each title: thirteen live in the OnGuard agent or the client software, which is to say on the laptops. Two of those thirteen are 9.8 criticals needing no prior authentication. Inside: the table of the thirteen, the end-of-maintenance note that decides whether yours is a patch or a branch jump, and the question worth answering before the change window.

Networks Zero Trust Vulnerabilities
Read more →
Técnico agachado con un portátil delante de un armario de servidores abierto en una sala técnica
7 min read

Read-only in the backup console was not read-only

On 6 October 2026 Veeam published advisory KB4934 with three Backup & Replication vulnerabilities. Two of the three are triggered by the same role: Backup Viewer, the one handed out without a second thought because it is there for looking. The worst reaches 9.4 and runs code on the backup server; the other, scored 6.1, allows deleting the Enterprise Manager master key, which is the documented mechanism for decrypting a backup when the password is lost. Inside: the table of all three CVEs with their vectors, why PR:L is the part that matters, and the role assignment list no recovery plan includes.

Backup Continuity Vulnerabilities
Read more →
Armario de red de oficina abierto, con un conmutador y una maraña de latiguillos acumulados dentro
7 min read

Eight products, nineteen versions: Atlassian's advisory tells you what to do, not what you have

The CVE-2026-21589 advisory, dated 5 October 2026, affects eight self-hosted Atlassian products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. It is one of the thorough ones: nineteen fixed versions, temporary mitigations if you cannot patch —including taking the instance off the internet— and a method for hunting traces in your access logs. All three instructions start from a question the vendor cannot answer for you. Inside: the version table, why "we are on 10.2" points at three different products, and Atlassian's thirteen entries in CISA's KEV catalogue.

Vulnerabilities Patching DevOps
Read more →
Panel de servicio de una librería de cintas con el testigo de aviso encendido y las llaves puestas
6 min read

Dell published the advisory on 1 October. The CVE records landed five days later

Dell advisory DSA-2026-448, carrying two CVSS 10.0 flaws in Container Storage Modules, is dated 1 October 2026. On 6 October we queried its thirteen own CVE identifiers against the public CVE Services API and watched them being published live, one every four or five minutes and in descending order of severity. When they reached NVD, they reached it without a CPE. Inside: the table of timestamps to the second, and why your scanner still cannot tell you whether you are affected.

Vulnerabilities Kubernetes Patching
Read more →
Pasillo entre armarios de servidores con las puertas cerradas en un centro de datos
9 min read

VCF hardening: the P0 shuts the door and the P2 leaves you the key

On 5 October 2026 VMware published its security configuration guidance for VMware Cloud Foundation. We downloaded the 9.1 spreadsheet and counted: 260 controls, 160 of them without the secure value set out of the box. Inside: why the control that shuts off host access is a P0 while the one that leaves you a recovery path is a P2, which virtual switch setting ships open on only one kind of switch, and the lines where the guide itself says what it does not do.

VMware Cybersecurity Virtualization
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN