Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Armario de comunicaciones montado en la pared de una pequeña empresa, con un router, un módem y un switch, y los cables recogidos sin orden dentro
11 min read

The flaw is WordPress's; your php.ini decides the exposure

CVE-2026-87902 entered CISA's Known Exploited Vulnerabilities catalogue on 25 September, three days after the advisory and a proof of concept went public. It is a 9.2 and it is WordPress core, patched across 25 branches down to 4.7.37 (December 2016). But 9.2 measures the damage, not your exposure: the CVSS 4.0 vector itself carries AT:P — "conditions are required" — and none of the deciding conditions belong to WordPress. A PHP directive, a PEAR file and a directory inside your active theme. What each one checks, why the obvious command for looking at it from a shell returns a false answer — we measured it on a box running PHP 8.3.6 — and what NOT to do if you suspect it already happened.

Cybersecurity WordPress PHP
Read more →
Vista aérea de un enlace de autopista en trébol, con varias rutas posibles entre los mismos dos puntos
8 min read

Your SD-WAN orchestrator is the key to every one of your sites

On 22 September CISA added CVE-2026-93952 to the known exploited vulnerabilities catalogue: a 10.0 out of 10 in VeloCloud Orchestrator, the system that configures every site in an SD-WAN network. The second exploited 10.0 in that same orchestrator in eight weeks. And the exploitation condition the vendor itself publishes is an uncomfortable line: it requires access to the PUBLIC portion of the certificate the branch device authenticates with. Why that points at the trust model and not just at an input validation bug, what to do if your version train has no patch yet, the three traces to look for in the filesystem today, and the question we ask before centralising a control plane.

SD-WAN Networking Cybersecurity
Read more →
Pasillo frío de un centro de datos con una silla vacía y un carro de consola aparcado junto a un armario abierto
7 min read

The Proxmox CVE your scanner cannot evaluate

CVE-2023-54391 is a 9.8: you get in as root@pam with no password. We queried its record through the NVD API and the GitHub Advisories API, and here is what comes back: NVD publishes no CPE configuration at all and flags the record as Deferred; GitHub returns an empty list of affected packages; and the only range that exists stops at "7.4" while your nodes call themselves 7.4-17. A scanner that decides by version matching has nothing to decide with. Meanwhile a provider published its post mortem: twelve hypervisors mining from 31 August to 17 September, logs wiped and the sentence "we cannot prove it".

Proxmox Vulnerabilities Virtualization
Read more →
Armario de comunicaciones con paneles de parcheo y una maraña de cables de red azules
5 min read

The patch for your switch had been out for 97 days

On 21 September CISA added a single CVE to its catalogue of exploited vulnerabilities: a stack-based buffer overflow in the CGI program of Zyxel GS1900 switch firmware, unauthenticated and with command execution. Zyxel published the advisory and the ten fixed firmware builds on 16 June: 97 days earlier. We counted the 30 entries the catalogue has taken in so far this month and the median is 5 days, so the list mixes two different populations. Why "LAN-based" is not a mitigating factor but the attack's requirement, what the small print does not say about models out of support, and why the entry asks for forensic triage before you reflash.

Networking Patching Maintenance
Read more →
Interior de un servidor de dos zócalos abierto, con los procesadores y dos bancos de módulos de memoria a la vista
11 min read

Patching the kernel means rebooting, and the reboot erases the evidence

CISA added two Linux kernel flaws to its exploited catalogue today, due by Monday. One has sat in your scanner for eleven months rated 3.3 out of 10; the kernel project scores it 7.8 on the very same record. Both entries carry the forensic-triage flag CISA now attaches to two out of every three new additions, and its guidance says not to remediate before collecting evidence. In the kernel, remediating means rebooting. And rebooting erases a good part of what you are asked to keep.

Cybersecurity Linux Patching
Read more →
Cerro con torres de comunicaciones, antenas parabólicas y radioenlaces contra el cielo
9 min read

MikroTik shipped that port closed: the flaw is theirs, the exception is yours

On 5 September CERT Polska published six RouterOS vulnerabilities; two of them chained give full control of a MikroTik with no authentication, and Shadowserver counted 122,500 devices with SSH reachable from the internet. The vendor's own advisory says its default configuration blocks that port. So the thing to look at is not the CVE: it is who opened the exception, when, and why nobody gave it an expiry date.

Networking Cybersecurity Vulnerabilities
Read more →
Interior de un armario de comunicaciones de planta con switch, panel de conexiones y cableado de cobre y fibra
12 min read

Cisco ISE, a perfect 10 with no workaround: your network already decided what to do without it

On 16 September Cisco published a CVSS 10.0 in Identity Services Engine: an authentication bypass in an API, no workaround available, active exploitation and command execution as root. Before arguing about the maintenance window there are two things to look at: ISE's own access.log, because the advisory ships indicators and the recommendation to re-image the node if anything shows up, and the show run on a floor switch, because that is where what your network will do when the policy engine stops answering is already written. The default value of radius-server deadtime is 0.

Cybersecurity Networking Zero Trust
Read more →
Parte trasera de un chasis de servidor con módulos de ventilador y cables de alimentación
10 min read

Acronis Backup: "requires local access" — and that access is what you sell your customers

On 15 September Acronis published a one-sentence advisory: local privilege escalation through insecure file permissions in its backup plugin for cPanel and Plesk, CVSS 7.8, exploited in targeted attacks. A "local" 7.8 is exactly the CVE almost every patching queue pushes to next week. On a machine with a single administrator, that call is defensible. On a server where every customer gets their own system user, the requirement for "local access with low privileges" is not describing a barrier: it is describing your business model.

Cybersecurity Backup Patching
Read more →
Varios servidores de 1U apilados en un rack, con cableado de red blanco recogido y pantallas LCD de estado en el frontal
10 min read

Ceph changes cipher: rebooting the virtual machine does not refresh the key

On 9 September Proxmox published the procedure to migrate cephx keys from aes to aes256k. The hard part is not cryptographic: it is knowing what counts as "refreshing a client". The documentation says it in six words — "A guest reboot is not enough" — and the failure does not show up when you run the command, but minutes or days later, when a ticket expires. What has changed since August, the kernel 7.0 gate, and the order we follow.

Ceph Proxmox Storage
Read more →
Estanterías de un depósito de archivo con legajos y cajas de documentos etiquetados
9 min read

"Read-only" does not exist: GitLab scores 10.0 on a flaw that can only read

CVE-2026-85706 lets a stranger read files off a self-hosted GitLab server. It writes nothing, and it still carries the maximum score. The explanation is not in the headline: it is in the vector the vendor itself signed off, with a changed scope and high integrity impact. We go through what the vector says, why CISA gave it three days and a forensic triage flag, and how to answer the one question the patch does not: were we read?

Cybersecurity GitLab Vulnerabilities
Read more →
Sala llena de puestos de trabajo vacíos con los monitores apagados
9 min read

The RDS failure is listed as "mitigated". The mitigation is turning the machine off and on

On 11 September Microsoft opened an issue for Remote Desktop Services hanging after the September update. Eight hours later it marked it as "Mitigated". We went and read the mitigation: stop the virtual machine and start it again. The affected-platform list on that same page is not the three Windows Server versions in the headlines either: it runs to six. And the package you want to uninstall is the one closing a 9.8 unauthenticated hole in the very same service.

Workplace Windows Patching
Read more →
Ordenador abierto sobre el banco de trabajo de un servicio de reparación informática
10 min read

Remote support: the file runs on the technician's machine

On 11 September, CISA added a ConnectWise ScreenConnect advisory to its catalogue of exploited vulnerabilities. The detail almost nobody highlights comes from the vendor itself: "ScreenConnect servers are not impacted". The machine that ends up running the file is the one support is given from. Three days earlier, N-able N-central had entered the same list with a 10.0. We counted the whole catalogue: fifteen entries in 2026 for software whose job is governing other people's computers. Windows, thirteen.

Maintenance RMM Cybersecurity
Read more →
Panel de parcheo a oscuras con cuatro conectores RJ45 desconectados
10 min read

Cisco FMC: patching closes the door, but nobody gives you back your network blueprint

On 9 September, Cisco Talos confirmed active exploitation of two flaws in Secure Firewall Management Center, and counted three separate attacker clusters inside the same box. One of them dropped two scripts to harvest the configurations of the managed firewalls. That is the part almost nobody is discussing: credentials rotate, a domain gets restored, and your perimeter configuration does not rotate. It is a description of your network, and it stays valid after the patch.

Cybersecurity Vulnerabilities Networking
Read more →
Armario de comunicaciones de pared con switch y cables de red
10 min read

Windows DNS, an unauthenticated 9.8: what turns a bug into a worm is not the bug, it's your network

On 8 September Microsoft shipped the largest batch of patches in its history. Dustin Childs, of the Zero Day Initiative, counts twenty that could be classified as wormable, spread across thirteen components. Those thirteen are not one list: they are two. Seven of those CVEs sit in services your domain requires every machine to reach — DNS, Netlogon, Active Directory, DHCP — and eleven sit in roles Windows does not install on its own. The first half is managed with patching order; the second, by uninstalling. And hardly anyone knows which of the two they have switched on.

Cybersecurity Networking Windows
Read more →
Sala de control con un muro de pantallas de monitorización y varias personas mirándolo de pie
10 min read

AI now finds zero-days on its own. Your problem is the 43 days that come after

On 4 September OpenAI launched GPT-6 Astra and declared it the first model it deploys reaching the "Critical" cybersecurity capability level of its preparedness framework. Almost all the coverage went after that half. The two numbers that decide what happens to you predate Astra and neither is about finding flaws: mean time to exploit is minus seven days according to M-Trends 2026, and the median to fully remediate a KEV-listed vulnerability is 43 days according to Verizon's DBIR. The bottleneck was never finding.

Patching AI Cybersecurity
Read more →
Técnico agachado con un portátil trabajando en la parte trasera de un rack de servidores
5 min read

REPLICATION was never a read-only privilege: PostgreSQL closed a twelve-year dlopen()

On 13 August PostgreSQL shipped 18.6, 17.11, 16.15, 15.19 and 14.24. Among the CVEs they close there is one that is not about buffer overflows: any account holding the REPLICATION attribute could name as its logical decoding plugin any file visible to the system, and the server would load it and run its code as the operating system user. The patch adds a whitelist with two entries by default: if your change data capture uses decoderbufs or wal2json, it stops your replication until somebody edits postgresql.conf.

PostgreSQL Zero Trust Data
Read more →
Servidor de dos alturas con la tapa quitada sobre una estantería metálica, en el trastero de una oficina, con cartones apoyados en la pared
5 min read

Artifactory's "medium" CVE hit the catalog before the critical one

CISA confirmed exploitation of a 5.3 JFrog Artifactory flaw on 27 August; of the 9.8 that lets anyone forge admin tokens, on 2 September. Six days apart, and in the opposite order to the scores. Look at the full vector of the "medium" one and you see why: two of the three impact dimensions are zero and the one left at maximum is integrity. In an artifact repository, integrity is exactly what you are buying.

Cybersecurity Containers Vulnerabilities
Read more →
Armario rack de pared en un cuarto de instalaciones de oficina, con un servidor encendido, polvo en la bandeja, una escalera plegada y un cubo de fregona al lado
7 min read

The Exchange you left running: 21,899 unpatched servers, and yours could be one

On 31 August 2026, Shadowserver scans counted 21,899 IP addresses running an Exchange Server without the CVE-2026-62911 patch released on 11 August. Many of those servers do not belong to companies that never migrated: they are the one left running after the move to Microsoft 365, published on the internet and owned by nobody. What Microsoft's advisory says and does not say next to Germany's BSI, why since April 2022 that server can be switched off, which route Microsoft recommends in 2026 to remove it for good, and the three cases where you should not touch it.

Exchange Microsoft 365 Cybersecurity
Read more →
Proxmox VE 7 y CVE-2023-54391: dos servidores viejos todavía encendidos en la estantería de un cuarto trastero
7 min read

Proxmox VE 7: the patch had been out for three years and nobody knew it was a patch

On 1 September 2026 Proxmox published advisory PSA-2026-00043-1: on Proxmox VE 7, sending any tfa-challenge value is enough to log in as root@pam with no password. The code that fixed it shipped on 20 July 2023 inside a refactor nobody classified as security, which is why it was never backported. What the flaw does, why a second factor saved you, what to check on your node today, and what all of this says about your inventory.

Proxmox Cybersecurity Virtualization
Read more →
Diez CVE en el proceso iked de un cortafuegos: leer el campo de impacto antes que el titular
5 min read

Ten CVEs in one process: the headline is not enough to decide

On 27 August, ten security advisories landed in iked, the process that negotiates a firewall's IPsec tunnels. We read them one by one, and in several of them the headline and the body do not say the same thing: one titled "unauthenticated" needs a VPN user with valid credentials; another the vendor could not reproduce; and one of the lowest-scoring is the only one that mentions reading key material. How to read a bulletin like that in forty minutes.

Networking Cybersecurity VPN
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN