Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Armario de comunicaciones real con switch, regletas de conexión y latiguillos de fibra sobre pared de contrachapado
8 min read

Thirteen of ClearPass's twenty-eight flaws are in the agent, not the server

On 6 October 2026 HPE published advisory HPESBNW05158 with 28 ClearPass Policy Manager vulnerabilities: 10 critical, 11 high and 7 medium. The interim mitigation the advisory itself recommends names the CLI and the web-based management interface, both of them on the server. We classified all 28 by the component HPE names in each title: thirteen live in the OnGuard agent or the client software, which is to say on the laptops. Two of those thirteen are 9.8 criticals needing no prior authentication. Inside: the table of the thirteen, the end-of-maintenance note that decides whether yours is a patch or a branch jump, and the question worth answering before the change window.

Networks Zero Trust Vulnerabilities
Read more →
Técnico agachado con un portátil delante de un armario de servidores abierto en una sala técnica
7 min read

Read-only in the backup console was not read-only

On 6 October 2026 Veeam published advisory KB4934 with three Backup & Replication vulnerabilities. Two of the three are triggered by the same role: Backup Viewer, the one handed out without a second thought because it is there for looking. The worst reaches 9.4 and runs code on the backup server; the other, scored 6.1, allows deleting the Enterprise Manager master key, which is the documented mechanism for decrypting a backup when the password is lost. Inside: the table of all three CVEs with their vectors, why PR:L is the part that matters, and the role assignment list no recovery plan includes.

Backup Continuity Vulnerabilities
Read more →
Armario de red de oficina abierto, con un conmutador y una maraña de latiguillos acumulados dentro
7 min read

Eight products, nineteen versions: Atlassian's advisory tells you what to do, not what you have

The CVE-2026-21589 advisory, dated 5 October 2026, affects eight self-hosted Atlassian products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. It is one of the thorough ones: nineteen fixed versions, temporary mitigations if you cannot patch —including taking the instance off the internet— and a method for hunting traces in your access logs. All three instructions start from a question the vendor cannot answer for you. Inside: the version table, why "we are on 10.2" points at three different products, and Atlassian's thirteen entries in CISA's KEV catalogue.

Vulnerabilities Patching DevOps
Read more →
Panel de servicio de una librería de cintas con el testigo de aviso encendido y las llaves puestas
6 min read

Dell published the advisory on 1 October. The CVE records landed five days later

Dell advisory DSA-2026-448, carrying two CVSS 10.0 flaws in Container Storage Modules, is dated 1 October 2026. On 6 October we queried its thirteen own CVE identifiers against the public CVE Services API and watched them being published live, one every four or five minutes and in descending order of severity. When they reached NVD, they reached it without a CPE. Inside: the table of timestamps to the second, and why your scanner still cannot tell you whether you are affected.

Vulnerabilities Kubernetes Patching
Read more →
Pasillo entre armarios de servidores con las puertas cerradas en un centro de datos
9 min read

VCF hardening: the P0 shuts the door and the P2 leaves you the key

On 5 October 2026 VMware published its security configuration guidance for VMware Cloud Foundation. We downloaded the 9.1 spreadsheet and counted: 260 controls, 160 of them without the secure value set out of the box. Inside: why the control that shuts off host access is a P0 while the one that leaves you a recovery path is a P2, which virtual switch setting ships open on only one kind of switch, and the lines where the guide itself says what it does not do.

VMware Cybersecurity Virtualization
Read more →
Interior de un portátil abierto: placa base, módulo de memoria, ventilador y disipador
7 min read

Windows' blocked driver list is 1,702 hashes

We downloaded Microsoft's official vulnerable driver blocklist on 6 October 2026 and counted the rules: 1,713 blocks, of which 1,702 identify the file by hash and 11 by name. Inside: what Microsoft's own documentation admits its list does not cover, why only 50 of the 218 certificate blocks burn a whole publisher, how many samples in the public catalogue of abusable drivers load anyway with memory integrity on, and the two possible readings of the contrast between 45% and 18%.

Windows EDR/MDR Cybersecurity
Read more →
Armario de cableado de red con latiguillos de pares trenzados y paneles de parcheo
8 min read

The Azure outage: four doors and the place your plan B lived

On 30 September 2026, a five-hour-forty-five-minute incident on Azure. Of the five services Microsoft lists as impacted, four are the road to your infrastructure and the fifth is Azure VMware Solution. Inside: what the official 7Q30-010 record does and does not say, the real detection clock, why the region figure going round is not in the source, and what happens to your contingency procedure when the thing that fails is the console.

Cloud Infrastructure High availability
Read more →
Armario rack de pared con un switch de 16 puertos y cables de red
8 min read

Your unattend.xml carries the domain password in clear text

The file you install machines with over the network contains the account that joins them to the domain, written as-is. That is not sloppiness: it is the example in Microsoft's own documentation. Inside: why PlainText false does not mean encrypted, what CVE-2026-0386 says about the channel that file travelled over, why the January 2026 update mitigated nothing until somebody touched the registry, and why switching the feature off does not rotate the credential already handed out.

Windows Maintenance Cybersecurity
Read more →
Disco duro externo conectado a un portátil sobre una mesa de despacho
7 min read

The clone doesn't carry the .git/config. The ZIP does

Four CVEs published in August and September 2026 describe the same sequence: you open a folder with an AI coding agent, the agent calls git to work out where it is, and that folder's local configuration runs a program with your credentials before anybody asks whether you trust it. Inside: what git's documentation says about core.fsmonitor, why an ordinary clone does not work as a delivery route, why the ownership check git does have is disarmed by the most ordinary gesture there is, and the trick that hides the key from your own grep.

AI Cybersecurity DevOps
Read more →
Multifunción de oficina junto a una mesa con bandejas de correo entrante y formularios de fax
7 min read

Your SPF passes, your DKIM passes, and DMARC still fails

The header says spf=pass and dkim=pass, and two lines below it says dmarc=fail. That is not a bug: it is alignment, and it is what breaks the mail your applications send. Inside: what DMARC actually compares, the row in Microsoft's own table where onmicrosoft.com fails even in relaxed mode, why your aggregate reports never arrive if you have a gateway in front of the tenant, and the sender inventory to write down before touching DNS.

Microsoft 365 DNS Cybersecurity
Read more →
Interior de una librería de cintas con el mecanismo del lector a la vista y una columna de ranuras vacías al fondo
9 min read

Microsoft deleted data before the window closed, and cannot say which

In late September 2026 it emerged that Microsoft, "due to an error", deleted data from expired subscriptions under its nonprofit programme before the retention and export window had closed. It could not be recovered. And there is a second half: it is currently unable to hand over a list of which data may have been deleted. Inside: the official Microsoft 365 countdown —30 days of Expired plus 90 of Disabled— and its asterisk; the 30 days that counter lost on 9 February 2026 for anyone buying direct under a Microsoft Customer Agreement; the four documented shortcuts that zero it, including the immediate deletion of SharePoint and OneDrive; and why article 33(5) of the GDPR asks you to document facts that, without an independent copy, you cannot enumerate.

Backup Microsoft 365 Compliance
Read more →
Parte trasera de un rack con servidores de 1U, sus puertos de consola a la vista y los mazos de cables recogidos
10 min read

Moving to Proxmox: permissions do not travel, and the role that sounds like "user" opens the console

The migration brings the disks, the configuration and the networks. It brings not one line of the permissions table, and because the two tables look alike in shape, almost nobody rebuilds theirs: they copy it from memory, going by the names of the roles. Inside: the mapping between a vCenter permission and a Proxmox ACL, with its three gaps; the literal definition of the PVEVMUser role —"view, backup, configure CD-ROM, VM console, VM power management"— and why console, CD-ROM and power together do not describe a reader; the question only your installation can answer; the inheritance rule that subtracts instead of adding and bites everyone arriving from Active Directory; the family of privileges that reads and writes files inside the guest, has no mental equivalent in vCenter and is a virtue of the model that nobody uses; root@pam, the unconfined account that cannot be deleted; and the four commands that tell you, the following Monday, who can do what on your cluster.

Proxmox Migration Virtualization
Read more →
Archivo compacto de oficina con los paneles cerrados y las manivelas de apertura alineadas
9 min read

DLP alerts leave the queue on 12 October: the table they land in may be empty

On 12 October a built-in rule turns itself on and converts Purview DLP alerts into "behaviors": they stop raising alerts and stop entering the Defender XDR incident queue. Inside: the literal quote from the Microsoft Learn box, which says "early October 2026" and gives no day —the day comes from notice MC1465771, published on 1 September—; what "Set as behavior" means exactly and why the three words that matter are "or trigger incidents"; the finding that made us write this: the BehaviorInfo table reference says it is populated by Defender for Cloud Apps and UEBA and that without those services queries return nothing, and the second door, CloudAppEvents, closes with the same key; the way out that is safe and almost nobody mentions; why we are not telling you to disable the rule; the line that leaves a third route open —built-in rules do not apply to custom detections— with its full price; and four checks, two of them queries you can paste today.

Microsoft 365 Data Compliance
Read more →
Hilera de barreras de acceso con lectores de tarjeta en el vestíbulo de una estación, vacía
9 min read

The replacement risk policy does not cover guests (and the old one never did)

On 1 October the deadline for the legacy Entra ID Protection risk policies fell due. No outage, no warning —just as there was none on 31 July 2025, when those screens went read-only. Inside: the date with the two different wordings Microsoft uses; why almost all the coverage says the policies "stop being enforced" when the original announcement spoke of retiring the interface, and why we will not write a sentence Microsoft has not written; why "migrate" describes a rebuilding job badly, and the order of the two mandatory steps; the two settings the recommended control applies by itself —authentication strength and "every time" reauthentication, the latter mandatory—; the line we found in no guide: "Require risk remediation" is not supported for external and guest users, and the part almost nobody tells you: with the previous policy, you blocked the risky guest with no way of unblocking them and without seeing them in any report; what Microsoft actually recommends for guests —exclude them from risk-based MFA and require MFA always— with its two traps; how to prove it is migrated by reading the log, with the trap of the field called "applied" that also lists the ones that were not; and the exception Microsoft documents with its AppId.

Identity Microsoft 365 Zero Trust
Read more →
Escritorio doméstico de noche con un monitor, un teclado retroiluminado y un micrófono, iluminado solo por una lámpara
10 min read

$250 to get in, one million euros of damage

On 30 September, in Operation KillSwitch, authorities switched off KillSec: three arrests, eight premises searched, five servers and at least 110 TB of stolen data secured. The figure that was nobody's headline is the price list: joining that business as an affiliate cost $250 and the house kept 12 % of every ransom. Inside: Operation ROTOMA by the Guardia Civil and the Mossos, the two Alicante searches and the early-2025 cyberattack on a Catalan organisation with an estimated damage of close to one million euros; the January 2025 price change and the ESXi locker that deleted snapshots; why the suspect's age measures the barrier to entry rather than sophistication; the four doors they came in through, one of them without even touching your network; our two averages on the 110 TB with the assumptions declared; what a seizure does not delete; and the inventory of checks, run from the outside, that you can close this week.

Ransomware Cybersecurity Cloud
Read more →
Sala de reuniones vacía con dos pizarras blancas y sillas alrededor de una mesa larga
9 min read

Your patching policy has no entry for "there is no patch"

On 21 September someone broke into the Dutch Institute for Vulnerability Disclosure, the people whose job is telling everyone else to patch. Eleven days later, the second of the two chained flaws still has no published fix. Inside: the timeline the victim published under its own name; why the headline —"an AI agent did it"— is not what decides the outcome, and what the logs actually say ("loud and very messy"); the advisory field reading "Patch status: Available" two sections above the paragraph saying the vendor "are working on a fix", and why your vulnerability process reads the field and not the paragraph; the two public documents that do not agree and are both true; what is left when the patch does not exist —break the chain at the other link, remove exposure, cut the blast radius, raise detection—; and the paragraph missing from your security policy, written out in full so you can copy it, with the two clauses that make it work: it expires by itself, and it carries a name and a job title.

Patching Cybersecurity Continuity
Read more →
Aula de informática con filas de equipos de sobremesa idénticos y pantallas apagadas
8 min read

Memory integrity turns itself on in October, and only where nobody decided anything

Microsoft announced on 1 September that the October 2026 quality updates will start enabling memory integrity on more eligible Windows devices. The press read the sentence «existing administrator and user choices and policies will remain in effect» as reassurance. Read it as a census: if the existing decision is respected, the change lands precisely where no decision was ever written down, and there the administrator becomes Windows Update. Inside: what actually gets switched on (HVCI on top of VBS) and why «eligible» is not a list you can query; the three Win32_DeviceGuard fields that answer where you stand today and why «configured» is not the same as «running» —the manual documents a case where they diverge—; why the symptom will not arrive as «a security failure» but as «the accounts scanner has stopped appearing», one at a time over a period Microsoft does not specify; the UEFI lock trap that turns undoing the policy into a physical trip to the machine; the counter-intuitive detail that the stricter value of RequirePlatformSecurityFeatures protects FEWER machines; the seven-day plan with a dated census, a pilot ring and a rollback prepared in advance; and the other two clocks expiring on that same 13 October, of different natures and with no shared rollback plan.

Windows Workplace Cybersecurity
Read more →
Filas de bahías de disco SAS en servidores de almacenamiento montados en rack
13 min read

You set noout to upgrade Ceph and switched off re-replication

The Ceph upgrade procedure on Proxmox recommends, as its fourth step, that you run "ceph osd set noout": "optional, but recommended", says the wiki. Ceph's own OSD troubleshooting page says this is "more a thought exercise" than a suggestion that anyone "in the post-Luminous world" should run it. Both sentences are published today and both are defensible. What that flag switches off is not rebalancing: it is a "down" OSD ever reaching "out", which is precisely the step that makes CRUSH recompute and recreate the missing copy. And the flag does not tell the disk you rebooted apart from the disk that genuinely died. Inside: why mon_osd_down_out_subtree_limit already brakes the scenario that actually frightens you, the chain almost nobody spells out (degraded PGs are not flagged as clean, and what is not clean is not scrubbed, so checksum verification stops on exactly the data that just lost a copy), the arithmetic of the two warnings arriving at 10.5 and 12.25 days to a dashboard that has been amber since minute one, the table of what each flag really switches off, and the four commands that do the same job on one disk or one host without touching the rest of the cluster.

Ceph Proxmox Storage
Read more →
Pasillo entre racks de equipos de red en una sala técnica
9 min read

CVE-2026-76504: the rule compared strings, not resources

Cisco published the Catalyst SD-WAN Manager advisory yesterday: CVSS 9.8, exploited before the advisory was published, and CISA allowing three days to fix it. Authentication did not fail. What failed was the list deciding which requests have to go through it: the list said /j_security_check and the request said /%6a_security_check, the same path with the j written in hex. Two different strings to the list, the same resource to the server behind it, and an administrator fits in that one-character gap. What decides how you read the rest is why that path HAD to be exempt from the session check: it is where the session is obtained, and if you protected it nobody could ever log in. So the flaw is not having the exception, it is how you check whether a request falls inside it. And that is not Cisco's: it happens anywhere the layer protecting a path by name is not the one resolving it. Inside: the table of branches and first fixed releases, the thirty-second test for your own proxy, the two greps that answer whether anyone got in before the patch, and the awkward question of whether those logs ever leave the box.

SD-WAN Cybersecurity Networking
Read more →
Subestación eléctrica de alta tensión con aisladores, embarrados y un transformador
7 min read

6,329 MW granted to data centres and none in service

The figure ran this morning in the energy press, so nobody in IT is going to read it: for the first time Spain's grid operator has published the breakdown by consumption type of the access capacity granted on the transmission network, and data centres take the largest slice —6,329 MW, 34.2% of the total— with 0 MW in service. Industry, with less capacity granted (5,838 MW), already has 4,346 energised: 74% against 0%. We do the three divisions that are not in the release, and one of them is that more than half the power Spain has promised and not yet delivered is spoken for by server rooms. But the part that made us stop is a different one: in February the network was "75% taken" and today there is margin at more than 35% of nodes, with the improvement coming not from new construction but from revising the CNMC calculation scenario —firm capacity up at 204 nodes, flat at 658, down at 75—. Of the three figures in circulation, only "in service" is physical. What that means the day you ask to go from 4 to 8 kW per rack, why the dangerous answer is not "I cannot" but "you can have them down a single feed", and the four-line annex we suggest stapling to the colocation contract —ours included—.

Colocation Datacenter Infrastructure
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN