Every migration plan has a line that says "if it goes wrong, we roll back". Almost none says what you roll back to, or until when. Proxmox has shipped an ESXi import wizard since 8.2; the way back is not a button. And the window closes from three directions at once: the contract, the unpatched hypervisor, and the data delta.
CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on 7 August and set the deadline for the 10th. Progress had shipped the patch on 4 June. In between: a public PoC on 29 June and forty days of exploitation attempts. If your patch queue is ordered by the KEV catalog, you are late by design — here is the clock you should actually be watching.
At the end of September, Microsoft moves whiteboards created in Teams channels out of the creator's OneDrive and into the channel's SharePoint site. It is a small change that concedes a large problem: much of a company's collective work lives inside one individual's personal account. Where each recording actually lands, why the deletion clock starts the day you delete the account rather than the day the person leaves, and why leaving the account blocked "just in case" is not the plan you think it is.
On 4 August, between 09:35 and 13:20 UTC, a worm spread by itself across 444 npm packages, stealing the credentials it needed to keep spreading. The first malicious version went out through the legitimate pipeline, carrying a valid provenance signature. And there is a trap that inverts the correct reflex: revoking the stolen token is exactly what fires the next payload. What to look for in your lockfiles, in what order to rotate, and why there is no fixed version to install here.
On 3 August, attackers walked into Metabase instances through the "forgot my password" endpoint, unauthenticated, with a CVSS of 10.0. Framework and Tally have already told their users. What an attacker takes from a compromised BI dashboard is not the charts: it is the credentials for every connected database, stored unencrypted unless somebody turned encryption on by hand. Which versions are in range, why this hole never shows up in your CVE feed, and why patching is the easy half of the job.
On 6 August, Huntress published its analysis of a Go-based credential stealer for macOS that had been sitting inside a monitored Mac for three months. There is no CVE, no exploit and nothing to patch: the chain starts with a web page dictating a command and a user pasting it into Terminal. What that command does line by line, why Gatekeeper never gets involved, what it actually takes from a company (Keychain, session cookies, browser passwords) and why the warning Apple added in macOS 26.4 is a speed bump rather than a wall.
On 30 September 2026, any Entra Connect synchronisation running below version 2.5.79.0 stops working. This is not the Cloud Sync migration: it is a separate thing, and it is the only one of the two with a fixed date. The migration runs in waves, allows exceptions and has no announced retirement date. What exactly breaks when sync stops (hint: not email — the offboarding that never reaches the cloud), why auto-upgrade fails to save precisely the servers that need it, and the eight rows in Microsoft's own comparison table that decide whether you can move to Cloud Sync yet.
Sounding convincing is not proof of identity, and in many organisations it is the only thing asked for. On 7 August Levi Strauss told the SEC that corporate information was taken from three company computers through social engineering: the work we use to measure security — patch, update, reboot — would have changed nothing. The joint CISA and FBI advisory on Scattered Spider says the targets are large companies and their contracted IT help desks, and that includes us. Why 65% of initial access now arrives through identity, why passkeys will not save you if the desk can enrol a new factor, and the eight things we ask of a reset procedure.
On 24 and 27 June, two of the certificates Microsoft has used to sign the boot chain since 2011 expired. Not a single machine went down: Microsoft states plainly that the device keeps starting and updating normally. What stops is something else — revocations, the boot manager, early-boot mitigations — and it raises no alert at all. A third date is still open: 19 October. How to check in two minutes whether your Windows estate, your Linux servers and — this is the one nobody looks at — your virtual machines already carry the 2023 certificates.
In mid-August Microsoft starts rolling out cross-tenant message recall in Exchange Online (MC1423106). It ships switched off, and you do not turn it on to recover your own emails: you turn it on so senders in another tenant can delete messages already delivered to your people's mailboxes. What cloud recall does today (hard delete, read messages included, retrying for up to 24 hours), why the allow list looks far too much like the list of domains invoice fraud uses, what actually protects you (retention, not the checkbox), and the logging gap almost nobody has read.
Two Linux kernel flaws published this week break the two boundaries we take for granted: the virtual machine (Zapscape, CVE-2026-64561) and the container (SCTPhantom, CVE-2026-64564). Understanding them is the easy part. The hard part is answering whether the kernel your node actually boots already carries the fixes, because the versions in the advisory — 6.12.101, 7.1.6 — do not exist on your server: Proxmox does not use Debian's kernel. The exact proxmox-kernel versions that do close them (and why 7.0.14-9 is not enough), how to check in four commands, and who genuinely needs to hurry.
Any ordinary customer on a cPanel server could execute SQL as database root simply by renaming a database. The headline is the 9.4, but the figure almost nobody reads sits at the end of the vector: SC:H/SI:H/SA:H, CVSS 4.0's way of stating in writing that the damage leaves the vulnerable system. On a shared server, "the subsequent system" has a name: everybody else. What the flaw does, why its 5.6 sibling says it more plainly, what to check this week, and the honest question of whether you should flee shared hosting (not always).
Ceph Tentacle ships Fast EC, the erasure coding performance work people had been waiting years for. And it arrives switched off: you enable it pool by pool, with one command, and the monitor then refuses to clear it — rolling back means draining and recreating the pool. On top of that, the "at least double" in the headline was measured with a 16K stripe unit, which is precisely what an existing pool cannot have. The conditions the monitor enforces, the half of the improvement frozen on the day you created the pool, what happens to the cluster when you flip it, and why three-way replication is still faster.
In June, Veeam fixed a 9.4-out-of-10 flaw that let "an authenticated domain user" run code on the backup server. According to third-party technical analysis, on a workgroup server that flaw never came into existence. The difference is not in the code: it is in who your backup server asks whether you can be trusted. What it actually checks, why this is the sixth flaw with the same description in little over a year, the circular dependency nobody draws in the recovery plan, what taking the server out of the domain really costs, and the cases where we would not do it.
70.31% of internet routes now carry a valid RPKI signature, yet only 12.3% of the autonomous systems measured achieve full protection on their routes. And the hijack that actually gets used — copying your ASN into the origin and putting yourself in front of it — passes validation with a green light. What a ROA signs and what it leaves out, the four families of attack left outside, today's event counter with its small print, and the two questions worth all the others for your provider if you do not run your own AS.
Documenting a network is not scanning it. NetBox's own documentation says so plainly: it represents the desired state of a network rather than its operational state, and it discourages automated import of live network state. That is the criterion almost nobody applies. What NetBox is and is not, the three-question test for whether your inventory is worth anything, what we document and what we deliberately do not, and when you do not need any of this.
On 5 August Proxmox shipped the first officially supported edition of Proxmox VE 9.2 for arm64: same codebase, same repositories, same lifecycle and feature parity with x86-64. Buried in the announcement there is one sentence that decides how you design your infrastructure: guests only run on nodes matching their architecture, and live migration only works between nodes of the same architecture. What they actually shipped, what you give up crossing to Arm, why the Raspberry Pi is left out, and the five questions we ask before quoting an Arm node.
The fix for the Apache Tomcat vulnerability CISA flagged as exploited on 4 August fits in a single line of code moved somewhere else. For two weeks, if decryption of a cluster message failed, Tomcat logged the error and processed the message anyway. And only 11.0.20, 10.1.53 and 9.0.116 were affected: precisely the versions carrying the patch for the previous flaw. What it means for a control to "fail open", why the log was the only signal, and what we check.
On 4 August, CISA added a 9.8 in Langflow to its exploited-vulnerabilities catalogue: one endpoint that hands superuser tokens to anyone who reaches the port, chained with another that runs whatever code you send it. The patch had been out for six weeks. It is not an isolated case: in Open WebUI the ENABLE_CODE_EXECUTION=false switch turned nothing off, and in n8n anyone who could edit a workflow could run commands on the host. Three products, the same starting assumption. What we do with the AI and automation layer, and when we recommend not self-hosting it at all.
On 2 August the bulk of the EU AI Act became applicable. Six days earlier, the Digital Omnibus on AI (Regulation EU 2026/1744, in force since 27 July) pushed high-risk obligations to December 2027 and August 2028. What does apply from 2 August is Article 50 — transparency — with fines of up to €15M or 3% (the lower amount for SMEs) and a date almost nobody wrote down: 2 December 2026. What actually changed, where Article 25 really bites, and the inventory checklist we run on a Microsoft 365 tenant.
To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list
Microsoft 365
ES 
CAT 
EN