Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Primer plano de un teclado de portátil oscuro y gastado, con polvo entre las teclas, iluminado de lado
9 min read

The same IP got into 29 companies and bounced off four

From 14 July to 22 September 2026, Huntress counted 497 valid Microsoft 365 sign-ins across 79 organisations without the attacker ever needing a password. The number that interests us is smaller: over four days one address, 193.26.115.72, logged 1,052 blocked sign-ins that all came from four organisations and got into 29 others where "nothing stood in the way". Same attacker, same stolen tokens, same week. With the mechanics of the theft, the two figures the report contradicts itself on, the Microsoft control that does address this and why its browser version is still in preview, and this afternoon's check on your tenant.

Identity Microsoft 365 Zero Trust
Read more →
Torniquetes de control de acceso con lectores de tarjeta en el vestíbulo de un edificio de oficinas
9 min read

The 49 properties Entra is retiring from your login page are not about design

On 26 October 2026 Microsoft Entra ID starts ignoring 49 CSS properties on your organisation's sign-in page, and before the month is out it blocks any script that is not its own with a content security policy. Read end to end, that list — position, z-index, opacity, visibility, clip-path, pointer-events — is not a layout catalogue: it is the toolbox for making a page show one thing and do another. What changes on each date, why the role that can touch it is not listed as privileged in Microsoft's own documentation, and the six checks you can answer this afternoon.

Identity Zero Trust Microsoft 365
Read more →
Puesto de trabajo de oficina con un portátil, dos monitores, teclado y una libreta sobre una mesa de madera clara
9 min read

The signature was valid; the DLL next to it was not

On 19 October 2026 Siemens confirmed in-the-wild exploitation of CVE-2026-110936 in its Software Center. What ran on the victims' machines was a genuine, correctly signed copy of the program: the attacker only had to drop an archive.dll in the same folder. If your application control authorises "anything signed by a known publisher", this campaign passes the filter by design, not by failure. We explain what a digital signature answers and what it does not, why the CVSS vector says "local" while your patch queue reads that as "no rush", the three behavioural signals that do leave a trail, and the three questions you can answer this afternoon.

Cybersecurity Vulnerabilities Workplace
Read more →
Una silla vacía retirada de una mesa de madera con un portátil entreabierto y un ratón encima
9 min read

You can now change a meeting organizer; in a shared mailbox, you cannot

Microsoft is rolling out right now the thing every Microsoft 365 admin has been asking for: handing a meeting over to someone else without cancelling it. It arrives enabled by default, with no tenant configuration, and it does not work in classic Outlook for Windows. The real problem is elsewhere: the case that made you want this feature — the weekly meeting of the person who left — is exactly the one Microsoft's own offboarding procedure rules out, because its step 4 converts the mailbox to shared, and meetings in a shared mailbox are not eligible. And that same step 4 still tells you to cancel them all.

Microsoft 365 Workplace Exchange
Read more →
Puestos de trabajo con monitores y teclados en una oficina diáfana
8 min read

Mark of the Web: seven ways a file from outside stops looking like one

On Tuesday Microsoft patched a Windows Shell flaw already under exploitation, and its own entry says it let an attacker "evade Mark of the Web (MOTW) defenses". Before getting to that bug it is worth reading the Office documentation: the banner that blocks macros in an attachment depends on a tag which, by Microsoft's own account, has four ways of never being applied and three more of not deciding anything. And the policy that would make it mandatory is not available in every plan.

Windows Workplace Microsoft 365
Read more →
Filas de puestos de trabajo idénticos en una sala: mismos monitores, mismos teclados, misma imagen instalada
8 min read

Windows 11 24H2 stops getting updates today, and your fleet is on the latest build

Today, 13 October 2026, Windows 11 version 24H2 stops receiving updates on Home and Pro. Microsoft's own table lists the same cumulative update, KB5124010, in four rows with four different end dates, and two of those rows carry the identical build number: 26100.9550. One expires today; the other, the IoT Enterprise LTSC line, has extended support until 2034. The date is not in the code: it is in the edition and the channel.

Windows Patching Maintenance
Read more →
Sala con filas de puestos de trabajo idénticos, mamparas bajas y sillas vacías
12 min read

Microsoft retires Targeted Release: your test ring is now paid for by everyone else

On 7 October 2026 Microsoft published advisory MC1490899 and updated three documentation pages the same day: Targeted release retires in January 2027 and from November 2026 its list can no longer be touched. The coverage reads it as a rename to Standard and Deferred. It is not. Reading the three pages together yields something else: to keep a validation group that runs ahead, Microsoft's own recommendation is not to move the pilot forward but to hold everyone else back by thirty days. Inside: the official mapping table read backwards, the documented cap of 100 users where each member of a security group counts one by one, the two kinds of change Deferred does NOT delay, and the seven checks that fit in half an hour before 31 October.

Microsoft 365 Workplace Compliance
Read more →
Interior de un portátil abierto: placa base, módulo de memoria, ventilador y disipador
7 min read

Windows' blocked driver list is 1,702 hashes

We downloaded Microsoft's official vulnerable driver blocklist on 6 October 2026 and counted the rules: 1,713 blocks, of which 1,702 identify the file by hash and 11 by name. Inside: what Microsoft's own documentation admits its list does not cover, why only 50 of the 218 certificate blocks burn a whole publisher, how many samples in the public catalogue of abusable drivers load anyway with memory integrity on, and the two possible readings of the contrast between 45% and 18%.

Windows EDR/MDR Cybersecurity
Read more →
Armario rack de pared con un switch de 16 puertos y cables de red
8 min read

Your unattend.xml carries the domain password in clear text

The file you install machines with over the network contains the account that joins them to the domain, written as-is. That is not sloppiness: it is the example in Microsoft's own documentation. Inside: why PlainText false does not mean encrypted, what CVE-2026-0386 says about the channel that file travelled over, why the January 2026 update mitigated nothing until somebody touched the registry, and why switching the feature off does not rotate the credential already handed out.

Windows Maintenance Cybersecurity
Read more →
Aula de informática con filas de equipos de sobremesa idénticos y pantallas apagadas
8 min read

Memory integrity turns itself on in October, and only where nobody decided anything

Microsoft announced on 1 September that the October 2026 quality updates will start enabling memory integrity on more eligible Windows devices. The press read the sentence «existing administrator and user choices and policies will remain in effect» as reassurance. Read it as a census: if the existing decision is respected, the change lands precisely where no decision was ever written down, and there the administrator becomes Windows Update. Inside: what actually gets switched on (HVCI on top of VBS) and why «eligible» is not a list you can query; the three Win32_DeviceGuard fields that answer where you stand today and why «configured» is not the same as «running» —the manual documents a case where they diverge—; why the symptom will not arrive as «a security failure» but as «the accounts scanner has stopped appearing», one at a time over a period Microsoft does not specify; the UEFI lock trap that turns undoing the policy into a physical trip to the machine; the counter-intuitive detail that the stricter value of RequirePlatformSecurityFeatures protects FEWER machines; the seven-day plan with a dated census, a pilot ring and a rollback prepared in advance; and the other two clocks expiring on that same 13 October, of different natures and with no shared rollback plan.

Windows Workplace Cybersecurity
Read more →
Sala con filas de puestos de trabajo y ordenadores bajo luz fluorescente
8 min read

CVE-2026-32996: the backup agent left the administrator ticket written in a log file

The exploit overflows no stack and corrupts no memory: it opens a text file any user on the machine can read, finds a session identifier inside, presents it over a named pipe and runs whatever you want as SYSTEM. With the vendor advisory in front of us, three things being reported wrong about CVE-2026-32996 in Veeam Agent for Windows: the version the headlines quote (13.0.1.2067) is the server build, not the agent one —the number to check is 13.0.3.1220—; the patch for two hundred laptops hangs off the change window of the backup server, the machine nobody wants to touch; and the phrase "active exploitation" was only ever in the headline of a bulletin whose body said something else, and which was then pulled. Why AT:P in the vector changes which machines you look at first, and the four things we would do this week.

Backup Vulnerabilities Patching
Read more →
Fila de mesas de oficina con los monitores apagados y una silla vacía
8 min read

Office 2021 does not stop working: it stops being tested against Microsoft 365

On 13 October 2026 nothing switches off: Word will open, Outlook will sync and nobody will notice. That day two clocks start at once and only one makes noise. The first is the ordinary end of support — Microsoft stops providing technical support, bug fixes and security updates. The second raises no alert: Microsoft stops checking that its own services still work with your Office, and the outage arrives months later without you touching a thing. The two different dates Microsoft itself publishes, the Office 2016/2019 precedent from 2023, and the finding that decides who is in a hurry: Windows 11 24H2 Home and Pro expires in the very same second, but the Enterprise edition holds on for another year.

Workplace Licensing Microsoft 365
Read more →
Sala con filas de puestos de trabajo: torres bajo las mesas, monitores apagados, teclados y cables recogidos
10 min read

EDR isolates the device on its own; the rule that brings it back is written beforehand

On 3 September Microsoft added a sentence to the Defender for Endpoint documentation and by the next day it was gone: it warned that automatic isolation fires as FULL isolation and that, with a web proxy, the device might not recover. The two facts it joined are both still published, but in separate sections. What gets isolated on its own and what does not, what "containing" does and what "isolating" does, and the way back point by point.

Cybersecurity EDR/MDR Microsoft 365
Read more →
Sala llena de puestos de trabajo vacíos con los monitores apagados
9 min read

The RDS failure is listed as "mitigated". The mitigation is turning the machine off and on

On 11 September Microsoft opened an issue for Remote Desktop Services hanging after the September update. Eight hours later it marked it as "Mitigated". We went and read the mitigation: stop the virtual machine and start it again. The affected-platform list on that same page is not the three Windows Server versions in the headlines either: it runs to six. And the package you want to uninstall is the one closing a 9.8 unauthenticated hole in the very same service.

Workplace Windows Patching
Read more →
Fila de puestos de trabajo vacíos en una oficina
10 min read

Entra ID retires memberOf on 3 November: after that date, membership stops being recalculated

Message centre post MC1448379, published on 5 August, has been read as a deadline. Read it the other way round: if you run a memberOf rule in production, you already have the problem it describes, and the preview documentation says so in a paragraph almost nobody reads. What happens on 3 November is not an outage or an error: memberships stay "in their last known state". That is where licences, Conditional Access and Teams membership hang from.

Identity Microsoft 365 Licensing
Read more →
Mesa de soporte de una oficina con un teléfono fijo de sobremesa, una libreta de anillas, un cordón con llaves y un teclado apartado a un lado
9 min read

The phone number on the record was a credential: Entra ID stops accepting it

Microsoft's own documentation has said it plainly for years: if you fill in a user's mobile phone or alternate email, that user can reset their password immediately "even if they haven't registered for the service". Which means a field written by a sync or by an admin worked as proof of identity. Entra ID is about to stop accepting it. What changes, why the 86% everyone quotes does not mean what it looks like, and the four different dates Microsoft gives for the same cutoff.

Identity Microsoft 365 Workplace
Read more →
Omnissa Horizon certificado en Proxmox VE: dos puestos de oficina vacíos con los monitores apagados y un cliente ligero detrás de la pantalla
9 min read

Proxmox VE is now Horizon Ready, but in manual mode: you create and power off the desktops yourself

On 4 September 2026 Proxmox announced that Proxmox VE has achieved Omnissa Horizon Ready Hypervisor certification. It is real and it removes a requirement, but it lands in "Manual Provisioning Mode": the program page states that provisioning and power policy are not supported. Meanwhile, Horizon has been integrating over the API with another non-vSphere hypervisor since December. Two different regimes, what Horizon stops doing for you, the RAM and GPU arithmetic nobody runs, and which estates this is a way out for today.

Virtualization Proxmox Workplace
Read more →
Sala de reuniones pequeña y vacía, con un altavoz de conferencia sobre la mesa, sillas desordenadas y luz natural entrando por la persiana
5 min read

Teams can now block meeting bots: it ships turned off

On 21 August Microsoft announced (MC1459141) that admins will be able to automatically block detected external bots in Teams meetings. We read the documentation for the ExternalBotAccessMode parameter: the word doing all the work is "detected", the new mode has to be assigned through policy, and it touches neither Copilot nor the assistant recording from your client's tenant. What actually decides where the transcript ends up — and when we would not switch it on.

Teams Microsoft 365 Workplace
Read more →
Fichero de archivo de madera con un cajón abierto lleno de tarjetas catalogadas: dónde vive de verdad cada documento y quién puede abrir el cajón

Warning: Undefined array key "read_time" in /var/www/html/public/blog.php on line 5669
min read

That recording lives in the OneDrive of someone who no longer works here

At the end of September, Microsoft moves whiteboards created in Teams channels out of the creator's OneDrive and into the channel's SharePoint site. It is a small change that concedes a large problem: much of a company's collective work lives inside one individual's personal account. Where each recording actually lands, why the deletion clock starts the day you delete the account rather than the day the person leaves, and why leaving the account blocked "just in case" is not the plan you think it is.

Microsoft Teams Backup
Read more →
  • 1
  • 2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN