Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Interior de un portátil abierto: placa base, módulo de memoria, ventilador y disipador
7 min read

Windows' blocked driver list is 1,702 hashes

We downloaded Microsoft's official vulnerable driver blocklist on 6 October 2026 and counted the rules: 1,713 blocks, of which 1,702 identify the file by hash and 11 by name. Inside: what Microsoft's own documentation admits its list does not cover, why only 50 of the 218 certificate blocks burn a whole publisher, how many samples in the public catalogue of abusable drivers load anyway with memory integrity on, and the two possible readings of the contrast between 45% and 18%.

Windows EDR/MDR Cybersecurity
Read more →
Armario rack de pared con un switch de 16 puertos y cables de red
8 min read

Your unattend.xml carries the domain password in clear text

The file you install machines with over the network contains the account that joins them to the domain, written as-is. That is not sloppiness: it is the example in Microsoft's own documentation. Inside: why PlainText false does not mean encrypted, what CVE-2026-0386 says about the channel that file travelled over, why the January 2026 update mitigated nothing until somebody touched the registry, and why switching the feature off does not rotate the credential already handed out.

Windows Maintenance Cybersecurity
Read more →
Disco duro externo conectado a un portátil sobre una mesa de despacho
7 min read

The clone doesn't carry the .git/config. The ZIP does

Four CVEs published in August and September 2026 describe the same sequence: you open a folder with an AI coding agent, the agent calls git to work out where it is, and that folder's local configuration runs a program with your credentials before anybody asks whether you trust it. Inside: what git's documentation says about core.fsmonitor, why an ordinary clone does not work as a delivery route, why the ownership check git does have is disarmed by the most ordinary gesture there is, and the trick that hides the key from your own grep.

AI Cybersecurity DevOps
Read more →
Multifunción de oficina junto a una mesa con bandejas de correo entrante y formularios de fax
7 min read

Your SPF passes, your DKIM passes, and DMARC still fails

The header says spf=pass and dkim=pass, and two lines below it says dmarc=fail. That is not a bug: it is alignment, and it is what breaks the mail your applications send. Inside: what DMARC actually compares, the row in Microsoft's own table where onmicrosoft.com fails even in relaxed mode, why your aggregate reports never arrive if you have a gateway in front of the tenant, and the sender inventory to write down before touching DNS.

Microsoft 365 DNS Cybersecurity
Read more →
Parte trasera de un rack con servidores de 1U, sus puertos de consola a la vista y los mazos de cables recogidos
10 min read

Moving to Proxmox: permissions do not travel, and the role that sounds like "user" opens the console

The migration brings the disks, the configuration and the networks. It brings not one line of the permissions table, and because the two tables look alike in shape, almost nobody rebuilds theirs: they copy it from memory, going by the names of the roles. Inside: the mapping between a vCenter permission and a Proxmox ACL, with its three gaps; the literal definition of the PVEVMUser role —"view, backup, configure CD-ROM, VM console, VM power management"— and why console, CD-ROM and power together do not describe a reader; the question only your installation can answer; the inheritance rule that subtracts instead of adding and bites everyone arriving from Active Directory; the family of privileges that reads and writes files inside the guest, has no mental equivalent in vCenter and is a virtue of the model that nobody uses; root@pam, the unconfined account that cannot be deleted; and the four commands that tell you, the following Monday, who can do what on your cluster.

Proxmox Migration Virtualization
Read more →
Archivo compacto de oficina con los paneles cerrados y las manivelas de apertura alineadas
9 min read

DLP alerts leave the queue on 12 October: the table they land in may be empty

On 12 October a built-in rule turns itself on and converts Purview DLP alerts into "behaviors": they stop raising alerts and stop entering the Defender XDR incident queue. Inside: the literal quote from the Microsoft Learn box, which says "early October 2026" and gives no day —the day comes from notice MC1465771, published on 1 September—; what "Set as behavior" means exactly and why the three words that matter are "or trigger incidents"; the finding that made us write this: the BehaviorInfo table reference says it is populated by Defender for Cloud Apps and UEBA and that without those services queries return nothing, and the second door, CloudAppEvents, closes with the same key; the way out that is safe and almost nobody mentions; why we are not telling you to disable the rule; the line that leaves a third route open —built-in rules do not apply to custom detections— with its full price; and four checks, two of them queries you can paste today.

Microsoft 365 Data Compliance
Read more →
Hilera de barreras de acceso con lectores de tarjeta en el vestíbulo de una estación, vacía
9 min read

The replacement risk policy does not cover guests (and the old one never did)

On 1 October the deadline for the legacy Entra ID Protection risk policies fell due. No outage, no warning —just as there was none on 31 July 2025, when those screens went read-only. Inside: the date with the two different wordings Microsoft uses; why almost all the coverage says the policies "stop being enforced" when the original announcement spoke of retiring the interface, and why we will not write a sentence Microsoft has not written; why "migrate" describes a rebuilding job badly, and the order of the two mandatory steps; the two settings the recommended control applies by itself —authentication strength and "every time" reauthentication, the latter mandatory—; the line we found in no guide: "Require risk remediation" is not supported for external and guest users, and the part almost nobody tells you: with the previous policy, you blocked the risky guest with no way of unblocking them and without seeing them in any report; what Microsoft actually recommends for guests —exclude them from risk-based MFA and require MFA always— with its two traps; how to prove it is migrated by reading the log, with the trap of the field called "applied" that also lists the ones that were not; and the exception Microsoft documents with its AppId.

Identity Microsoft 365 Zero Trust
Read more →
Escritorio doméstico de noche con un monitor, un teclado retroiluminado y un micrófono, iluminado solo por una lámpara
10 min read

$250 to get in, one million euros of damage

On 30 September, in Operation KillSwitch, authorities switched off KillSec: three arrests, eight premises searched, five servers and at least 110 TB of stolen data secured. The figure that was nobody's headline is the price list: joining that business as an affiliate cost $250 and the house kept 12 % of every ransom. Inside: Operation ROTOMA by the Guardia Civil and the Mossos, the two Alicante searches and the early-2025 cyberattack on a Catalan organisation with an estimated damage of close to one million euros; the January 2025 price change and the ESXi locker that deleted snapshots; why the suspect's age measures the barrier to entry rather than sophistication; the four doors they came in through, one of them without even touching your network; our two averages on the 110 TB with the assumptions declared; what a seizure does not delete; and the inventory of checks, run from the outside, that you can close this week.

Ransomware Cybersecurity Cloud
Read more →
Sala de reuniones vacía con dos pizarras blancas y sillas alrededor de una mesa larga
9 min read

Your patching policy has no entry for "there is no patch"

On 21 September someone broke into the Dutch Institute for Vulnerability Disclosure, the people whose job is telling everyone else to patch. Eleven days later, the second of the two chained flaws still has no published fix. Inside: the timeline the victim published under its own name; why the headline —"an AI agent did it"— is not what decides the outcome, and what the logs actually say ("loud and very messy"); the advisory field reading "Patch status: Available" two sections above the paragraph saying the vendor "are working on a fix", and why your vulnerability process reads the field and not the paragraph; the two public documents that do not agree and are both true; what is left when the patch does not exist —break the chain at the other link, remove exposure, cut the blast radius, raise detection—; and the paragraph missing from your security policy, written out in full so you can copy it, with the two clauses that make it work: it expires by itself, and it carries a name and a job title.

Patching Cybersecurity Continuity
Read more →
Aula de informática con filas de equipos de sobremesa idénticos y pantallas apagadas
8 min read

Memory integrity turns itself on in October, and only where nobody decided anything

Microsoft announced on 1 September that the October 2026 quality updates will start enabling memory integrity on more eligible Windows devices. The press read the sentence «existing administrator and user choices and policies will remain in effect» as reassurance. Read it as a census: if the existing decision is respected, the change lands precisely where no decision was ever written down, and there the administrator becomes Windows Update. Inside: what actually gets switched on (HVCI on top of VBS) and why «eligible» is not a list you can query; the three Win32_DeviceGuard fields that answer where you stand today and why «configured» is not the same as «running» —the manual documents a case where they diverge—; why the symptom will not arrive as «a security failure» but as «the accounts scanner has stopped appearing», one at a time over a period Microsoft does not specify; the UEFI lock trap that turns undoing the policy into a physical trip to the machine; the counter-intuitive detail that the stricter value of RequirePlatformSecurityFeatures protects FEWER machines; the seven-day plan with a dated census, a pilot ring and a rollback prepared in advance; and the other two clocks expiring on that same 13 October, of different natures and with no shared rollback plan.

Windows Workplace Cybersecurity
Read more →
Pasillo entre racks de equipos de red en una sala técnica
9 min read

CVE-2026-76504: the rule compared strings, not resources

Cisco published the Catalyst SD-WAN Manager advisory yesterday: CVSS 9.8, exploited before the advisory was published, and CISA allowing three days to fix it. Authentication did not fail. What failed was the list deciding which requests have to go through it: the list said /j_security_check and the request said /%6a_security_check, the same path with the j written in hex. Two different strings to the list, the same resource to the server behind it, and an administrator fits in that one-character gap. What decides how you read the rest is why that path HAD to be exempt from the session check: it is where the session is obtained, and if you protected it nobody could ever log in. So the flaw is not having the exception, it is how you check whether a request falls inside it. And that is not Cisco's: it happens anywhere the layer protecting a path by name is not the one resolving it. Inside: the table of branches and first fixed releases, the thirty-second test for your own proxy, the two greps that answer whether anyone got in before the patch, and the awkward question of whether those logs ever leave the box.

SD-WAN Cybersecurity Networking
Read more →
Armario de comunicaciones con cortafuegos y panel de parcheo en una sala técnica
10 min read

The certificate ACME doesn't renew is the one that kills your VPN

Do the arithmetic: 15 March 2026, the day the 200-day ceiling for public TLS certificates came into force, plus 200 days. That lands on 1 October. Today. The first certificates issued under the new rule start expiring this week, and this stops being a 2029 problem. The CA/Browser Forum schedule (ballot SC-081v3, 25 issuers in favour and none against) drops to 100 days on 15 March 2027 and to 47 in 2029, with domain validation down to 10 days: about 37 validations a year per name. The 47 is neither arbitrary nor round: it is 31 + 15 + 1, sized so a monthly renewal fits with room for one retry. But the web server has renewed itself for years; the problem is the firewall portal, the VPN gateway and the RADIUS box doing EAP-TLS. And here is the uncomfortable conclusion: ACME validates from the outside, and those devices are not published on the Internet precisely because you segmented properly. The better your network, the worse your position. What path is left, what new risk comes from giving a script write access to your DNS, why half the list should not be in the public chain at all, and the four columns that decide by themselves what to do with each row.

TLS Networking Cybersecurity
Read more →
Seta de parada de emergencia sobre una pared, con el pulsador rojo sin accionar
8 min read

The email asked for six hours; the press release said nine: who signs off a shutdown like that?

On 25 September, Kiteworks asked customers for something almost no advisory asks: not to patch, but to switch off. No CVE, no patch and no indicators of compromise, on credible intelligence about an "imminent" attack that weekend. The email customers received, first published by Heise, said six hours; the company's public press release said nine. And the advisory asked them to switch off even systems not reachable from the internet, so there was no way to scope it by exposure. Two days later the advisory was lifted, and during the window an unknown critical flaw turned up, "confined to a capability that is enabled for less than 1% of the customer base". We rebuild the case from the six original sources and get to what it leaves behind: who in your company signs off a stoppage like that and on what evidence (with the words of the CISO who did sign it), which channel your users will use during those hours if you do not give them one, and the three things that bite during an unrehearsed stoppage —the HA manager bringing back what you shut down from inside the guest, the weekend of backups that pushes good restore points out of retention, and monitoring with no maintenance window declared—.

Continuity Disaster recovery Suppliers
Read more →
Filas de puestos con ordenadores en una sala vacía; solo una pantalla encendida
8 min read

Four EDRs and no alerts: what are you left with

On 6 July, two SensePost researchers published a code injection technique and tested it against four market-leading EDRs configured to detect, block and remediate: it worked on all four and no alerts were created. On 22 September, Flashpoint reproduced it. The technique does not write into another process's memory —the path every EDR has watched for a decade— but instead places the payload into the parameters a new process starts with. We read both publications in full, including the part the headlines skipped: in Flashpoint's lab the XDR component DID block, and only stopped once two further evasions were stacked on top; and the authors themselves warn the technique "has multiple opportunities for detection". Also: why this is post-exploitation and not a way in, why the same primitive had already been described publicly before (with no known date), the four checks you can ask your console for this week —and the catch that none of them is a button, but a query over telemetry someone has to have kept and someone has to write—.

Cybersecurity EDR/MDR Monitoring
Read more →
Interior de una librería de cintas con los cartuchos alineados en sus ranuras
9 min read

Your immutable backup has a permission that deletes it

"Our backups are immutable" is an incomplete sentence, and Amazon's documentation proves it. Object Lock has two modes: in compliance mode nobody can delete anything, not even the root user, and the only documented way out is closing the AWS account; in governance mode anyone holding the s3:BypassGovernanceRetention permission can delete. Both are called immutability. And AWS adds a note almost nobody has read: the web console includes the header needed to override the lock by default, so the friction exists in the API and vanishes in the interface. Also: why the intuitive test (trying to delete an object) returns 200 OK and misleads you in both directions, why Veeam adds 30 days to the immutability you configured on S3, and what that 93% / 16% study doing the rounds in September actually says —including a sample that looks nothing like your company—. And at the end, a sentence with four blanks that whoever runs your backups has to be able to finish.

Backup Ransomware Cybersecurity
Read more →
Sala con filas de puestos de trabajo y ordenadores bajo luz fluorescente
8 min read

CVE-2026-32996: the backup agent left the administrator ticket written in a log file

The exploit overflows no stack and corrupts no memory: it opens a text file any user on the machine can read, finds a session identifier inside, presents it over a named pipe and runs whatever you want as SYSTEM. With the vendor advisory in front of us, three things being reported wrong about CVE-2026-32996 in Veeam Agent for Windows: the version the headlines quote (13.0.1.2067) is the server build, not the agent one —the number to check is 13.0.3.1220—; the patch for two hundred laptops hangs off the change window of the backup server, the machine nobody wants to touch; and the phrase "active exploitation" was only ever in the headline of a bulletin whose body said something else, and which was then pulled. Why AT:P in the vector changes which machines you look at first, and the four things we would do this week.

Backup Vulnerabilities Patching
Read more →
Vestíbulo de oficina con una fila de tornos de acceso de cristal alineados y vacíos
8 min read

The Conditional Access policies you never wrote are already in your tenant

Open the Conditional Access policy list in your tenant and look at the Created by column. If any row says Microsoft, nobody in your company wrote that policy: Microsoft creates it in Report-only and switches it on itself "no less than 30 days" later, with two weeks' notice and a note saying it can be sooner. They cannot be renamed or deleted; the only thing you can change is who you exclude —starting with your emergency account—. Which ten exist today, the three that actually break things (device code flow and Teams rooms, legacy authentication and the scan-to-email printer, MFA for all users and licensed service accounts), the detail almost nobody quotes —your P2 license count and MFA registration draw who the risk policy protects— and the audit query that tells you what Microsoft changed in your tenant and when.

Microsoft 365 Identity Cybersecurity
Read more →
Armario de comunicaciones de pared en una sede pequeña, con router, módem y switch conectados con cables de red
9 min read

Your site-to-site tunnel doesn't ask for MFA because there's nobody to ask

CVE-2026-85102 entered the CISA catalog on September 22 with a three-day deadline, and almost all the coverage stopped at "patch your remote access VPN". The official description says "Site to Site VPN or Remote Access VPN": the tunnel between your own offices too, where there is no user to ask for a second factor, the trust was configured once and never expires, and the flaw happens during certificate negotiation — before your MFA and conditional access ever get to run. With the caveat almost nobody mentions (that path only applies if the tunnel authenticates with certificates, not a pre-shared key), the cross-reading of both advisories — the branch that saves you from one is the one listed in the scope of the other — and the four things we would check this week.

Zero Trust VPN Networking
Read more →
Pasillo de un archivo con estanterías compactas llenas de cajas de archivo numeradas
9 min read

The first AI-agent breach is on file. The hard part was being able to describe it

On 14 September the Spanish data protection authority published that it had received the first notification of a personal data breach that "would have been executed by means of an artificial intelligence agent" — its own conditional. The whole attack fits in one sentence, and the authority warns the information comes from the affected organisation and is still pending analysis. We read those four phases as what they will eventually be for somebody else: a regulator's form with a 72-hour clock on it. Which record you need to write each sentence, why "autonomously" is inferred rather than logged, what the authority now expects in writing in your risk assessment, and why three of the four phases are stopped by boring things that involve no AI at all.

AI Compliance Cybersecurity
Read more →
Armario de comunicaciones montado en la pared de una pequeña empresa, con un router, un módem y un switch, y los cables recogidos sin orden dentro
8 min read

The flaw is WordPress's; your php.ini decides the exposure

CVE-2026-87902 entered CISA's Known Exploited Vulnerabilities catalogue on 25 September, three days after the advisory and a proof of concept went public. It is a 9.2 and it is WordPress core, patched across 25 branches down to 4.7.37 (December 2016). But 9.2 measures the damage, not your exposure: the CVSS 4.0 vector itself carries AT:P — "conditions are required" — and none of the deciding conditions belong to WordPress. A PHP directive, a PEAR file and a directory inside your active theme. What each one checks, why the obvious command for looking at it from a shell returns a false answer — we measured it on a box running PHP 8.3.6 — and what NOT to do if you suspect it already happened.

Cybersecurity WordPress PHP
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN