Fotocopiadora multifunción de oficina con la puerta de tóner abierta y la bandeja de papel a medio sacar

August's patch broke printing in WPF apps: the three ways out, with the maths done

The 11 August .NET Framework cumulative update breaks printing and PDF export in WPF applications using Calibri, Cambria, Constantia and Corbel: <code>System.IO.FileFormatException</code> on a font Windows itself installs. Microsoft acknowledged it on the 24th, thirteen days later, and the interim workaround switches off the overflow protection that same patch had just added. We looked at what exactly it turns off, why the decision should be per application rather than per fleet, and which of the three ways out costs least in each case.

Patching Maintenance Windows

Read more →

Pasillo frío de un centro de datos entre dos filas de racks cerrados: los aparatos que están delante de todo y casi nunca aparecen en el inventario de parcheo

11 Aug 2026
Warning: Undefined array key "read_time" in /var/www/html/public/blog.php on line 5290
min read

By the time CISA flagged LoadMaster, the patch had been out for 64 days

CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on 7 August and set the deadline for the 10th. Progress had shipped the patch on 4 June. In between: a public PoC on 29 June and forty days of exploitation attempts. If your patch queue is ordered by the KEV catalog, you are late by design — here is the clock you should actually be watching.

Patching Cybersecurity Networks

Read more →

CVE-2026-18577 en N-able N-central: un salto de autenticación en la consola desde la que los proveedores de IT gestionan los equipos de sus clientes, explotado con el control remoto del propio producto

4 Aug 2026 5 min read

The agent we install on your machines is also a door

On 3 August, CISA added CVE-2026-18577 to its exploited-vulnerabilities catalogue with a deadline of the 6th. It is a flaw in the console many IT providers use to manage their customers' machines, and it arrived as the incomplete patch for another flaw published two days earlier. The vendor found out through a rise in licensing issues, not a security alert. Access was not granted by malware: the attackers used the product's own remote-control feature and left a tunnel behind so they would still be inside after the console was cut off. We are a managed services provider, and this post is about what that means for the people who hire us.

RMM Maintenance Security

Read more →

Google corrige 1.072 fallos de seguridad de Chrome con agentes de IA y pasa a publicar un hito cada dos semanas

1 Aug 2026 5 min read

Google fixed 1,072 Chrome bugs with AI: the bottleneck is now you

Chrome 149 and 150 fixed 1,072 security bugs, more than the previous 23 releases combined, with AI agents that find, reproduce, triage and patch. But the number is not the story: Chrome is moving to a milestone every two weeks and piloting two security releases a week. What really changes in your patch cycle, why counting CVEs no longer measures anything, and which of your software will never get this treatment.

AI Maintenance Chrome

Read more →

CVE-2026-14266 en 7-Zip: por qué en la mayoría de los PCs de empresa el mejor parche es desinstalarlo

28 Jul 2026 9 min read

The best patch for 7-Zip is uninstalling it (on most of your PCs)

CVE-2026-14266 is a heap overflow in 7-Zip's XZ decoder: it affects version 21.07 and every release up to 26.01. With no public exploit and no known exploitation, it is not an emergency. But that is two code-execution flaws in two months, the program updates by hand, and Windows 11 has opened .7z and .rar natively since 2023. Before updating two hundred machines, it is worth checking how many actually need it.

Security Windows Endpoint

Read more →

wp2shell

Patch to exploit in 48h

22 Jul 2026 5 min read

wp2shell: WordPress patched on Friday, the exploits landed by Sunday. Who maintains your website?

On July 17 WordPress shipped 6.9.5 and 7.0.2 to plug wp2shell, a no-login RCE in core. It was being exploited that same evening, and by Sunday there were more than twenty public exploits. The uncomfortable question isn't technical: who is responsible for updating your website?

WordPress Security Maintenance

Read more →

everyWAN Blog

August's patch broke printing in WPF apps: the three ways out, with the maths done

By the time CISA flagged LoadMaster, the patch had been out for 64 days

The agent we install on your machines is also a door

Google fixed 1,072 Chrome bugs with AI: the bottleneck is now you

The best patch for 7-Zip is uninstalling it (on most of your PCs)

wp2shell: WordPress patched on Friday, the exploits landed by Sunday. Who maintains your website?

Subscribe to our newsletter