Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
WireGuard o IPsec: comparativa honesta entre los dos protocolos de túnel, con el criterio de everyWAN sobre cuál usar en cada caso y el calendario post-cuántico europeo
5 min read

WireGuard or IPsec: what we deploy where

WireGuard is about 4,000 lines of code, it landed in the Linux kernel in 2020 and it fits on one page of config. IPsec drags along thirty years of RFCs and proposals that never quite match. And we still deploy IPsec in a good share of the places we work, for three reasons that show up in no comparison table: who is on the other end of the tunnel, who authenticates the people, and what happens when the cryptography has to change. An honest comparison, no fanboyism, with Europe's post-quantum calendar on the table.

WireGuard IPsec VPN
Read more →
Pass-ta-key: tres técnicas de Unit 42 contra las passkeys sincronizadas de Google Password Manager en Chrome sobre Windows, incluida la extracción del secreto de 32 bytes que las descifra todas
5 min read

Your passkey isn't broken — the master key gets copied

On 3 August, Unit 42 published three ways into passkey-protected accounts without breaking a single line of cryptography. The worst of them lifts a 32-byte secret out of Chrome's memory that decrypts every passkey synced to the account — and in Google's current implementation that secret cannot be rotated or revoked. All three start the same way: with malware already running on a Windows machine, with no administrator rights and no privilege escalation. We still recommend passkeys, and this post explains why that is not a contradiction.

Passkeys Identity EDR/MDR
Read more →
CVE-2026-18577 en N-able N-central: un salto de autenticación en la consola desde la que los proveedores de IT gestionan los equipos de sus clientes, explotado con el control remoto del propio producto
5 min read

The agent we install on your machines is also a door

On 3 August, CISA added CVE-2026-18577 to its exploited-vulnerabilities catalogue with a deadline of the 6th. It is a flaw in the console many IT providers use to manage their customers' machines, and it arrived as the incomplete patch for another flaw published two days earlier. The vendor found out through a rise in licensing issues, not a security alert. Access was not granted by malware: the attackers used the product's own remote-control feature and left a tunnel behind so they would still be inside after the console was cut off. We are a managed services provider, and this post is about what that means for the people who hire us.

RMM Maintenance Security
Read more →
El 31 de octubre de 2026 se acaba el modelo de licencia de VMware incluida en los nodos de Azure VMware Solution: a partir del 1 de noviembre hay que aportar una suscripción portable de VMware Cloud Foundation comprada a Broadcom
5 min read

Plan B expires on 31 October: VMware with the licence included is ending in the cloud

On 31 October 2026 the Azure VMware Solution model in which the licence came bundled with the node comes to an end: from 1 November you must bring a VMware Cloud Foundation key bought directly from Broadcom. On Google Cloud VMware Engine it already happened on 1 November 2025. Eighty-nine days to go. For two years, "I will just lift my vSphere into the hyperscaler" has been the favourite plan B for not deciding; it was an extension, and extensions expire. The maths you can finish this week, and when staying put is the right call.

VMware Licensing Cloud
Read more →
CVE-2026-66066, un fallo de CVSS 9,5 en Active Storage de Ruby on Rails, permite leer ficheros del servidor subiendo una imagen cuando la aplicación procesa variantes con libvips
5 min read

A 9.5 in Rails: the flaw is not in your application, it is in the library nobody chose

On 29 July 2026 Rails published CVE-2026-66066: a 9.5 in Active Storage letting an unauthenticated attacker read files from the server — including the process environment with secret_key_base and the database credentials — by uploading an image. The flaw is not in the code you commissioned, nor exactly in Rails: it is in which formats libvips considers safe to read, a C library nobody at your company chose. And libvips has published since 2022 which of its operations it has not verified, with a switch to block them. The label was there; what was missing was flipping it.

Applications Development Cybersecurity
Read more →
CVE-2026-63077, un fallo de CVSS 9,8 sin autenticación en todas las versiones de JetBrains TeamCity On-Premises, pone el foco en el servidor de CI/CD como sistema crítico
8 min read

Your CI/CD holds the keys to production. And you treat it as a developer tool

On 27 July 2026 JetBrains published CVE-2026-63077: an unauthenticated 9.8 affecting EVERY version of TeamCity On-Premises and allowing operating system commands to be run on the build server. There is no known exploitation. The two previous times TeamCity had a flaw like this ended with Russia's SVR inside technology companies and with BianLian operators creating users on build servers. The underlying problem is not TeamCity: it is that the machine which deploys to production is in almost nobody's critical systems inventory.

CI/CD DevOps Cybersecurity
Read more →
Por primera vez el 46% de las cargas de IT corporativa vive en instalaciones de terceros frente al 44% en centros de datos propios, según la encuesta de Uptime Institute de 2026
8 min read

Half of corporate IT now lives off premises. That does not mean it went to the cloud

On 28 July 2026 Uptime Institute published the figure that went around the industry: for the first time, third-party facilities (46%) overtake companies' own data centres (44%). The number is real. The "the cloud won" reading is not: that 46% puts colocation and SaaS in the same box, and they are opposite decisions. And the most interesting part of the report is not in the headline but in the remaining 10%, and in what is happening to kilowatts per rack.

Datacenter Colocation Infrastructure
Read more →
La nueva retención por último acceso de Microsoft Purview borra ficheros de SharePoint y OneDrive y deja 93 días de papelera como único margen
7 min read

What nobody opens gets deleted: Purview, last accessed, and the 93 days to notice

By mid-August 2026 Microsoft finishes rolling out a Purview retention rule that deletes SharePoint and OneDrive files nobody has opened for a given period, justified on the grounds that Copilot will answer better. It deletes nothing on its own: somebody has to configure it. But it is the first deletion trigger that measures not a property of the document but the absence of human activity, and the file nobody opens in three years may well be the one you need in year four. What is actually shipping, the 93 recycle-bin days that are your only margin, why version history will not save you, and what we would do before touching that button.

Microsoft Backup SharePoint
Read more →
Más de 700 organizaciones afectadas por el robo de tokens OAuth de una aplicación conectada, sin ninguna contraseña robada
5 min read

The token that never asks for MFA: connected apps in your Microsoft 365

More than 700 organisations were potentially exposed in August 2025 without a single password being stolen: the attacker took the OAuth tokens of an application they had connected themselves. On 13 July 2026 Microsoft published the map of a full year of that technique: two attack chains and not one suspicious sign-in. The part that fails is not the login, it is consent: how to inventory the applications connected to your tenant with two Graph queries, what each button actually switches off, and why changing the consent setting revokes nothing already granted.

Microsoft Identity Cybersecurity
Read more →
Google corrige 1.072 fallos de seguridad de Chrome con agentes de IA y pasa a publicar un hito cada dos semanas
5 min read

Google fixed 1,072 Chrome bugs with AI: the bottleneck is now you

Chrome 149 and 150 fixed 1,072 security bugs, more than the previous 23 releases combined, with AI agents that find, reproduce, triage and patch. But the number is not the story: Chrome is moving to a milestone every two weeks and piloting two security releases a week. What really changes in your patch cycle, why counting CVEs no longer measures anything, and which of your software will never get this treatment.

AI Maintenance Chrome
Read more →
Nueve entradas del catálogo KEV de CISA en 2026 apuntan al plano de gestión de una red SD-WAN
5 min read

Your SD-WAN doesn't go down: it gets reconfigured

Of the 172 vulnerabilities CISA has flagged as exploited so far in 2026, nine point at the same place: the management plane of an SD-WAN. And the attacker Mandiant documented inside a Catalyst SD-WAN Manager took nothing down: they registered as a peer, copied the fabric's configuration templates through the product's own API and wiped their tracks. The numbers are our own count over the KEV catalogue, including the only two entries all year with a 48-hour deadline. What to look at when the attack looks like a legitimate configuration change and your monitoring stays green.

SD-WAN Networks Security
Read more →
EWS en Exchange Online: la fecha límite real para escribir la lista de aplicaciones permitidas es el 31 de agosto de 2026
5 min read

EWS shuts down in October, but your deadline is 31 August

On 1 October Exchange Online starts disabling EWS, and on 1 April 2027 it disables it for good, with no re-enablement. But one detail turns the calendar on its head: from October, leaving EWSEnabled set to True with an empty allowed-application list starts to mean "block everything", and if you do not write that list before the end of August, in September Microsoft writes it for you based on whatever it saw running. What to look at in the usage report, the exact commands, why that automatic list fails both by omission and by excess, and the gaps Graph still does not cover according to Microsoft's own roadmap.

Exchange Microsoft Migration
Read more →
El peaje del ESU de Windows 10: el precio se duplica cada año y es acumulativo
5 min read

Windows 10 and the October toll: ESU doubles every year and you cannot skip year one

Microsoft charges $61 per device for the first year of Windows 10 extended security updates, and its own documentation says two things almost nobody puts together: the price doubles every consecutive year and ESUs are cumulative, so enrolling in year three means paying for all three. Delaying enrolment does not reduce the bill if you end up enrolling: it shifts the payment and leaves you without patches while you wait. The full math, the three blind spots that cost real money (the 2027 headline is not about your company, LTSC is not covered, and Office lives on until 2028 but you can no longer log a bug) and when paying for ESU really is the right call.

Windows Licensing Workplace
Read more →
Ceph Squid 19.2 llega a su fin de vida estimado el 19 de septiembre de 2026
7 min read

Your Ceph has a date: Squid runs out of patches on 19 September

Ceph's lifecycle table puts the estimated end of life of Squid (19.2) on 19 September 2026: fifty days from today. Its replacement, Tentacle (20.2), has been stable since November and Proxmox has marked it stable since 9.2. The problem is not the jump, it is that it is not a jump: it is a sequence of three maintenance windows whose order you do not get to choose, with two details almost nobody has looked at — the mgr/zabbix module is gone, and erasure coding optimisations do not switch themselves on.

Ceph Proxmox Storage
Read more →
Informe de ransomware 2026: 1,7 millones de dólares de coste medio de recuperación por incidente
7 min read

Restoring is not recovering: two in three recover from backup and nearly half still pay

Sophos's annual ransomware report (2,158 IT leaders across 17 countries, Spain included) brings the biggest backup rebound in the series: 66% of victims whose data was encrypted recovered from backup, twelve points above the 54% of 2025. At the same time 48% paid, and the average cost of recovering rose 11% to $1.7 million with the ransom excluded. Why the two numbers do not contradict each other, the note on method about the two medians almost nobody is reading correctly, what is inside that bill, and the five things worth timing before the bad day.

Ransomware Backup Disaster Recovery
Read more →
Caída de Google Cloud en europe-west4-a por fallo de energía y refrigeración en el datacenter
5 min read

Three milliseconds and 44 degrees: the cloud outage that had nothing to do with software

On 15 July 2026 a three-millisecond voltage dip on the utility feed took three services in a Google Cloud zone in the Netherlands out of service for almost fifteen hours. No CVE, no botched deployment, no BGP route: an electrical transient, a backup system that failed to pick up the load, a chiller controller that dropped offline, and a data hall at 44°C. What exactly failed according to the official incident report, why redundancy on paper is not always redundancy, what it means that a zone is not a building, and the seven questions worth asking any datacenter — including your own — before it happens.

Datacenter Colocation Cloud
Read more →
VMSA-2026-0006: dos vulnerabilidades CVSS 9,8 en VMware vCenter y un escape de máquina virtual en ESX
5 min read

VMSA-2026-0006: two 9.8s in vCenter, a VM escape and the flaw nobody will look at

On 29 July 2026 Broadcom published VMSA-2026-0006: five flaws in VMware ESX, vCenter, Workstation and Fusion, two of them CVSS 9.8 in vCenter and one 9.3 that allows escaping from a virtual machine to the host. There are no workarounds. What to patch first according to the advisory itself (the order is no longer the one you knew), why updating vCenter does not stop your workloads, where the patches are if you hold a perpetual licence with no support, and why the lowest-scoring flaw — ESX may not record what an administrator does — is the one that hurts afterwards.

VMware Cybersecurity Virtualization
Read more →
Antenas de radiotelescopio al anochecer: la adolescencia tecnológica de la humanidad según el ensayo de Dario Amodei
12 min read

The adolescence of technology: reading Dario Amodei's essay with our hands in the mud

In January 2026 the CEO of Anthropic published a twenty-two-thousand-word essay on the five risks of powerful AI and on whether we are ready for them. His answer is no. We read the whole thing from inside a company that deploys automation and AI on real infrastructure: the five risks laid out, an honest scorecard, the four points where we do not buy his argument — including one almost nobody has reported correctly — and what a company that does not build models should be doing today.

AI Society AI Ethics
Read more →
Controladores de gestión BMC expuestos en internet: 36.872 servicios IPMI accesibles por UDP 623
5 min read

There is another computer inside your server, and 36,872 of them are on the internet

A scan published on 29 July 2026 found 36,872 management controllers (BMCs) listening on the internet over UDP/623, and 24,650 of them hand out material derived from the account password before anyone logs in. This is not a new CVE: it is CVE-2013-4786, a flaw in the IPMI 2.0 specification itself, dating from 2004, which Dell acknowledges has no patch. The numbers, why a factory password falls in between 32 seconds and one hour, why your EDR will not see it and the six steps to close the management plane of your hardware.

Hardware Datacenter Cybersecurity
Read more →
Zabbix 8.0: análisis de qué cambia de verdad en la próxima LTS de monitorización
5 min read

Zabbix 8.0 release date, LTS and roadmap: what is real vs still a slide

Zabbix 8.0 is the next LTS and half the industry already writes about it as if it were installed. As of 30 July 2026 the latest published artefact is beta 2, dated 9 July, and in the official container registry 8.0 is called trunk. Which features are really in the official release notes (native JSON up to 128 MiB, ClickHouse as a history backend, c-ares with DNS caching), what is still only roadmap (OpenTelemetry, complex event processing, mobile app, proxy permissions) and where the real bill for the upgrade sits: the database minimums and the removed macros living inside your alerts.

Zabbix Monitoring Open Source
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN