Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Fatiga de alertas: cómo montar una monitorización que avisa de lo que importa
8 min read

Your monitoring is not broken: it is shouting

An organisation receives an average of 2,992 security alerts a day and 63% of them go unaddressed, according to Vectra AI's 2026 count. The interesting part is that the volume has been falling for three years and the unaddressed share has not moved. Filtering harder does not fix it, because the problem was never how many alerts arrive: it is how many arrived with an owner and an action written next to them. How we prune monitoring that shouts, what wakes us at three in the morning, and what waits for the morning report.

Monitoring Zabbix 24/7 Support
Read more →
Proxmox VE entra en el ecosistema de NVIDIA Mission Control: qué cambia de verdad para tu infraestructura
7 min read

Proxmox joins NVIDIA's ecosystem: a logo will not migrate your infrastructure

Today Proxmox Server Solutions announced it is joining the NVIDIA Mission Control ecosystem: Proxmox VE as the virtualisation and high-availability layer beneath the management services of AI factories, with engineering work for the Grace and Vera CPUs. What the announcement actually says, where Proxmox sits in that picture and where it does not, and why an announcement changes the conversation in a boardroom but changes none of the things that decide your migration.

Proxmox NVIDIA Virtualisation
Read more →
CVE-2026-16812 en el VeloCloud Orchestrator: el orquestador SD-WAN expuesto por diseño
7 min read

Your WAN orchestrator is on the internet by design: VeloCloud's 10.0

CVE-2026-16812 is an unauthenticated command injection in the on-premises VeloCloud Orchestrator: CVSS 10.0, exploited before a patch existed, and in CISA's KEV catalogue the same day with three days to fix it. Arista's advisory says the console is exposed by default and that no configuration prevents that exposure; a few lines further down it recommends restricting access to the web interface to trusted administrative networks. Both are true, and the bad day is decided in the distance between them.

Security Networking SD-WAN
Read more →
CVE-2026-14266 en 7-Zip: por qué en la mayoría de los PCs de empresa el mejor parche es desinstalarlo
6 min read

The best patch for 7-Zip is uninstalling it (on most of your PCs)

CVE-2026-14266 is a heap overflow in 7-Zip's XZ decoder: it affects version 21.07 and every release up to 26.01. With no public exploit and no known exploitation, it is not an emergency. But that is two code-execution flaws in two months, the program updates by hand, and Windows 11 has opened .7z and .rar natively since 2023. Before updating two hundred machines, it is worth checking how many actually need it.

Security Windows Endpoint
Read more →
Subida del precio de la memoria DRAM y NAND en 2026 por la demanda de centros de datos de IA
8 min read

AI took the RAM: what to do with your 2026 hardware plan

TrendForce forecast second-quarter contract price rises of 58% to 63% for conventional DRAM and 70% to 75% for NAND. In one quarter, with nothing inside your company to explain it. Why the big cloud providers are hedged by multi-year contracts and you are not, how this lands in your refresh plan, what to check before signing a purchase order, and how long it lasts — with dates.

Hardware Infrastructure Datacenter
Read more →
Despliegues reproducibles con Docker Swarm y GitOps: latest no es una versión
7 min read

"latest" is not a version: three lessons from deploying our own website with Docker Swarm

The pipeline went green, the webhook returned 200, and the site kept serving the old content. Three real lessons from our GitOps CI/CD on Docker Swarm: why the orchestrator does not chase your tag and what it takes for a redeploy to actually redeploy, why a linter is not a test (and the smoke test that saved our blog index), and the "zero downtime" our own file claimed but never delivered with a single replica.

Docker DevOps Infrastructure
Read more →
Cl0p extorsiona sin cifrar: campaña contra PTC Windchill y FlexPLM
7 min read

Cl0p didn't encrypt a single file: extortion walks in through the app nobody watches

Cl0p is exploiting a critical vulnerability in PTC Windchill and FlexPLM (CVE-2026-12569, CVSS 9.3) to steal engineering data and extort without encrypting anything. The patch had existed since June 17; the wave of extortion emails arrived a month later. Why your backups can't undo a theft, what the Accellion→MOVEit→Oracle EBS pattern teaches (2,700+ organizations in a single campaign), and the five things we would do this week.

Ransomware Cybersecurity Security
Read more →
SD-WAN multi-sede: cuándo compensa y cuándo sobra
5 min read

SD-WAN yes, but not everywhere: when it pays off and when it's overkill

Gartner predicted that by 2026, 70% of enterprises would have SD-WAN. We deploy it — and even so, more than once we have recommended against it. What problem it actually solves, when it pays off (changing sites, two transports, suffering applications), when two lines and WireGuard do the job, and the costs that never show up in the demo: the forever license, the orchestrator as a dependency and the complexity that doesn't disappear — it relocates.

SD-WAN Networking Infrastructure
Read more →
Secuestro de DNS en Wi-Fi de hoteles para robar cuentas de Microsoft 365
7 min read

The hotel Wi-Fi works for someone else: DNS hijacked to steal Microsoft 365 accounts

Since June 2026 an active campaign has been compromising captive portals at hotels and conference centers, changing their DNS and redirecting guests to fake Microsoft 365 pages. The refined part: by abusing the device code flow they take your account without stealing your password, with MFA "satisfied". What is happening, why the padlock won't save you, and what we would do: from full-tunnel VPN to blocking the device code flow.

Zero Trust Cybersecurity Microsoft
Read more →
Colocation vs cloud público: la cuenta a cinco años, con el caso 37signals
8 min read

The cloud isn't expensive: it's expensive for the wrong workload. Colocation vs public cloud, with the math done

37signals was paying $3.2 million a year for cloud, bought $700,000 of servers and recouped them in the first year; in 2025 it announced moving its 18 PB out of S3. Meanwhile, worldwide cloud spending keeps growing at a 20% annual clip. Both things are true: the difference is who does the math. Which workloads overpay in the cloud, when the cloud still wins, and the five-year colocation math, line by line.

Colocation Cloud Datacenter
Read more →
Una IA autónoma automatiza la post-explotación en un ataque real; la respuesta es detección 24/7
8 min read

The tireless intern now works for the other side: an autonomous AI is already automating real attacks

In an intrusion at Thailand's Ministry of Finance, the attacker left an open-source AI agent running unattended to automate the boring part of the attack: enumerate, escalate privileges, find the next step. It broke nothing new —it got in through default credentials and unpatched 2021 CVEs— but it did the dirty work faster and without rest. What actually changes is speed, and the only answer to speed is 24/7 detection and response.

Cybersecurity IA EDR/MDR
Read more →
Certighost (CVE-2026-54121): impersonar un Domain Controller vía AD CS
9 min read

Certighost: any user could become your Domain Controller. The question isn't whether you patched, it's whether you've audited your AD CS

Certighost (CVE-2026-54121) let an unprivileged domain user impersonate a Domain Controller via Active Directory Certificate Services and take over the entire domain. Microsoft patched it on July 14; a working PoC has been public since July 24. The mechanism in one sentence, why AD CS is the escalation surface almost nobody audits, and the plan for today: patch, inventory your CAs, machine account quota to zero, and audit templates.

Cybersecurity Active Directory Microsoft
Read more →
Microsoft retira el SMS como MFA en Entra ID: passkeys por defecto
7 min read

Microsoft is retiring SMS for MFA: in February 2027 Entra ID stops sending them. The strange part is that it lasted this long

On July 13 Microsoft announced that Entra ID will stop providing SMS and voice calls as an authentication method: passkeys by default from September 1 and full retirement on February 1, 2027, with no opt-out. Anyone insisting on SMS will have to contract and pay their own telecom provider. The full timeline, why SMS was never a serious second factor, and the plan we would apply to any tenant.

Microsoft MFA Security
Read more →
Check Point SmartConsole
Zero-day CVE-2026-16232 · exposed management
9 min read

The Check Point zero-day wasn't after your firewall: it was after its console

CVE-2026-16232: an authentication bypass in SmartConsole allowed logging into the server that governs all your Check Point gateways as an administrator, with no credentials. It was exploited before the patch existed and CISA gave three days to remediate. Why the management plane is a bigger prize than the firewall itself, and the checklist that applies even without Check Point.

Firewall Cybersecurity Security
Read more →
SharePoint 2016/2019
Unsupported since Jul 14; no ESU
9 min read

SharePoint 2016 and 2019 just ran out of patches, and this time there's no extension you can pay for

On July 14 SharePoint Server 2016 and 2019 fell out of extended support, and Microsoft offers no ESU: there is no paid extension. A year ago ToolShell compromised over 400 organizations attacking on-prem SharePoint that was still receiving patches. The three real ways out, and the fourth one almost nobody offers you.

SharePoint Microsoft Security
Read more →
FakeGit
7,600 fake repos; your AI is the target
8 min read

Malware no longer fools you: it fools your AI. FakeGit and its 7,600 fake GitHub repositories

The FakeGit campaign seeded GitHub with 7,600 fake repositories; roughly 200 of them alone account for over 14 million malware downloads. The news isn't the volume: more than 800 posed as MCP servers and AI skills, and the assistants recommended them on their own. It has a name now: agentbaiting.

AI Cybersecurity GitHub
Read more →
Romania's land registry
Wiped; saved by the out-of-reach copy
8 min read

Romania's land registry was wiped, backups included. It was saved by the copy the attacker couldn't touch

On July 14 an attacker got into Romania's ANCPI with valid credentials, failed to extort the agency, and wiped the land registry database plus every backup within reach. A week with no property sales or mortgages nationwide. The difference between incident and catastrophe was one copy beyond his reach.

Backup Ransomware Cybersecurity
Read more →
  • 1
  • 2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
everyWAN