CVE-2026-14266 is a heap overflow in 7-Zip's XZ decoder: it affects version 21.07 and every release up to 26.01. With no public exploit and no known exploitation, it is not an emergency. But that is two code-execution flaws in two months, the program updates by hand, and Windows 11 has opened .7z and .rar natively since 2023. Before updating two hundred machines, it is worth checking how many actually need it.
TrendForce forecast second-quarter contract price rises of 58% to 63% for conventional DRAM and 70% to 75% for NAND. In one quarter, with nothing inside your company to explain it. Why the big cloud providers are hedged by multi-year contracts and you are not, how this lands in your refresh plan, what to check before signing a purchase order, and how long it lasts — with dates.
The pipeline went green, the webhook returned 200, and the site kept serving the old content. Three real lessons from our GitOps CI/CD on Docker Swarm: why the orchestrator does not chase your tag and what it takes for a redeploy to actually redeploy, why a linter is not a test (and the smoke test that saved our blog index), and the "zero downtime" our own file claimed but never delivered with a single replica.
Cl0p is exploiting a critical vulnerability in PTC Windchill and FlexPLM (CVE-2026-12569, CVSS 9.3) to steal engineering data and extort without encrypting anything. The patch had existed since June 17; the wave of extortion emails arrived a month later. Why your backups can't undo a theft, what the Accellion→MOVEit→Oracle EBS pattern teaches (2,700+ organizations in a single campaign), and the five things we would do this week.
Gartner predicted that by 2026, 70% of enterprises would have SD-WAN. We deploy it — and even so, more than once we have recommended against it. What problem it actually solves, when it pays off (changing sites, two transports, suffering applications), when two lines and WireGuard do the job, and the costs that never show up in the demo: the forever license, the orchestrator as a dependency and the complexity that doesn't disappear — it relocates.
Since June 2026 an active campaign has been compromising captive portals at hotels and conference centers, changing their DNS and redirecting guests to fake Microsoft 365 pages. The refined part: by abusing the device code flow they take your account without stealing your password, with MFA "satisfied". What is happening, why the padlock won't save you, and what we would do: from full-tunnel VPN to blocking the device code flow.
37signals was paying $3.2 million a year for cloud, bought $700,000 of servers and recouped them in the first year; in 2025 it announced moving its 18 PB out of S3. Meanwhile, worldwide cloud spending keeps growing at a 20% annual clip. Both things are true: the difference is who does the math. Which workloads overpay in the cloud, when the cloud still wins, and the five-year colocation math, line by line.
In an intrusion at Thailand's Ministry of Finance, the attacker left an open-source AI agent running unattended to automate the boring part of the attack: enumerate, escalate privileges, find the next step. It broke nothing new —it got in through default credentials and unpatched 2021 CVEs— but it did the dirty work faster and without rest. What actually changes is speed, and the only answer to speed is 24/7 detection and response.
Certighost (CVE-2026-54121) let an unprivileged domain user impersonate a Domain Controller via Active Directory Certificate Services and take over the entire domain. Microsoft patched it on July 14; a working PoC has been public since July 24. The mechanism in one sentence, why AD CS is the escalation surface almost nobody audits, and the plan for today: patch, inventory your CAs, machine account quota to zero, and audit templates.
On July 13 Microsoft announced that Entra ID will stop providing SMS and voice calls as an authentication method: passkeys by default from September 1 and full retirement on February 1, 2027, with no opt-out. Anyone insisting on SMS will have to contract and pay their own telecom provider. The full timeline, why SMS was never a serious second factor, and the plan we would apply to any tenant.
Same fault tolerance and twice the usable space: pitched like that, erasure coding sounds obvious. We run Ceph in production and our VMs are still on 3-way replication. The space math, the write math, the recovery math and the node math — and where we do use erasure coding.
On July 23 a network configuration change left Teams, SharePoint and OneDrive limping for hours: the fifth major hyperscaler outage in nine months. When your entire office lives in a SaaS there is no replica to boot and no runbook that helps: the SLA is credits, not continuity. What we wouldn't do, and the two-page plan that actually works.
CVE-2026-16232: an authentication bypass in SmartConsole allowed logging into the server that governs all your Check Point gateways as an administrator, with no credentials. It was exploited before the patch existed and CISA gave three days to remediate. Why the management plane is a bigger prize than the firewall itself, and the checklist that applies even without Check Point.
On July 14 SharePoint Server 2016 and 2019 fell out of extended support, and Microsoft offers no ESU: there is no paid extension. A year ago ToolShell compromised over 400 organizations attacking on-prem SharePoint that was still receiving patches. The three real ways out, and the fourth one almost nobody offers you.
In December 2025 the largest DDoS on record was mitigated: 31.4 Tbps, roughly 31,000 times the capacity of a 1 Gbps fibre. By the time that traffic reaches your firewall, the battle is already lost. What RTBH is, why a local blackhole won't save your link, and what to ask your provider.
The FakeGit campaign seeded GitHub with 7,600 fake repositories; roughly 200 of them alone account for over 14 million malware downloads. The news isn't the volume: more than 800 posed as MCP servers and AI skills, and the assistants recommended them on their own. It has a name now: agentbaiting.
On July 14 an attacker got into Romania's ANCPI with valid credentials, failed to extort the agency, and wiped the land registry database plus every backup within reach. A week with no property sales or mortgages nationwide. The difference between incident and catastrophe was one copy beyond his reach.
86% of VMware customers are shrinking their footprint, yet only 4% have completed a full migration. Broadcom, meanwhile, signs Standard Chartered. What the data actually says two years in, and what we would do with a renewal due in 2027.
On July 17 WordPress shipped 6.9.5 and 7.0.2 to plug wp2shell, a no-login RCE in core. It was being exploited that same evening, and by Sunday there were more than twenty public exploits. The uncomfortable question isn't technical: who is responsible for updating your website?
Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027, and MIT measured that 95% of pilots show no return. Why AI agent projects really die, and the six questions we ask before starting one.
To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list
Gestiona tus servicios de forma
ágil y 100% segura
Microsoft 365
ES 
CAT 
EN