Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Armario de comunicaciones con cortafuegos y panel de parcheo en una sala técnica
10 min read

The certificate ACME doesn't renew is the one that kills your VPN

Do the arithmetic: 15 March 2026, the day the 200-day ceiling for public TLS certificates came into force, plus 200 days. That lands on 1 October. Today. The first certificates issued under the new rule start expiring this week, and this stops being a 2029 problem. The CA/Browser Forum schedule (ballot SC-081v3, 25 issuers in favour and none against) drops to 100 days on 15 March 2027 and to 47 in 2029, with domain validation down to 10 days: about 37 validations a year per name. The 47 is neither arbitrary nor round: it is 31 + 15 + 1, sized so a monthly renewal fits with room for one retry. But the web server has renewed itself for years; the problem is the firewall portal, the VPN gateway and the RADIUS box doing EAP-TLS. And here is the uncomfortable conclusion: ACME validates from the outside, and those devices are not published on the Internet precisely because you segmented properly. The better your network, the worse your position. What path is left, what new risk comes from giving a script write access to your DNS, why half the list should not be in the public chain at all, and the four columns that decide by themselves what to do with each row.

TLS Networking Cybersecurity
Read more →
Sala de servidores con racks cableados y un módulo de gestión de potencia
9 min read

Moving to Proxmox 9.2 wasn't your call: the repository made it

Ask whoever runs your cluster who decided to go from 9.1 to 9.2, and in which meeting it was approved. In most places nobody decided: Proxmox VE ships no repository per minor version —there is nothing like a pve-9.1-security— so a routine apt dist-upgrade, the same one applying the patches you do want, leaves you on the latest published minor. The software that takes your backups does have a supported-version matrix, and it runs behind: Proxmox VE 9.2 shipped on 21 May 2026 and the Veeam plug-in covering it arrived on 29 July, 69 days later. And one detail misleads: plug-in 3.3 for the 13.0 branch shipped on 25 August, twenty-seven days AFTER 4.0, so "I am up to date" can mean up to date on the branch that does not carry the new support. Nothing turns red; what you lose is the right to open a case. The three facts that must live on the same line before you open the window, why the right order is matrix first and apt second, the ARM architecture boundary, and where this crack does not exist.

Proxmox Backup Maintenance
Read more →
Seta de parada de emergencia sobre una pared, con el pulsador rojo sin accionar
8 min read

The email asked for six hours; the press release said nine: who signs off a shutdown like that?

On 25 September, Kiteworks asked customers for something almost no advisory asks: not to patch, but to switch off. No CVE, no patch and no indicators of compromise, on credible intelligence about an "imminent" attack that weekend. The email customers received, first published by Heise, said six hours; the company's public press release said nine. And the advisory asked them to switch off even systems not reachable from the internet, so there was no way to scope it by exposure. Two days later the advisory was lifted, and during the window an unknown critical flaw turned up, "confined to a capability that is enabled for less than 1% of the customer base". We rebuild the case from the six original sources and get to what it leaves behind: who in your company signs off a stoppage like that and on what evidence (with the words of the CISO who did sign it), which channel your users will use during those hours if you do not give them one, and the three things that bite during an unrehearsed stoppage —the HA manager bringing back what you shut down from inside the guest, the weekend of backups that pushes good restore points out of retention, and monitoring with no maintenance window declared—.

Continuity Disaster recovery Suppliers
Read more →
Armario de red mural de una pequeña empresa con un conmutador y cables sin ordenar
7 min read

Windows Server 2016 ESU is billed from 12 January, whenever you buy it

Windows Server 2016 leaves support on 12 January 2027, 104 days from now. Everyone repeats that; the Azure Arc billing page, less so: licences provisioned after that date are back-billed to 12 January, the charge appears as a separate line item, deactivating and reactivating does not avoid it, deleting and recreating does not either, and Microsoft writes that "there are no conditions under which it can be avoided". Deferring stops being free. And before the price comes eligibility, which is where many smaller companies fall out: on-premises ESU requires Software Assurance or an equivalent Server Subscription, SPLA is not available for 2016, neither is the Visual Studio benefit, and transitioning from Volume Licensing is not supported with Azure Arc. Also: why the bill is decided by how you count cores —16 physical per machine or 8 virtual per VM, with Microsoft's own 1,024-versus-506-core example—, what to ask your CSP now that no list price has been published, and the option that is not on the slide.

Windows Licensing Infrastructure
Read more →
Filas de puestos con ordenadores en una sala vacía; solo una pantalla encendida
8 min read

Four EDRs and no alerts: what are you left with

On 6 July, two SensePost researchers published a code injection technique and tested it against four market-leading EDRs configured to detect, block and remediate: it worked on all four and no alerts were created. On 22 September, Flashpoint reproduced it. The technique does not write into another process's memory —the path every EDR has watched for a decade— but instead places the payload into the parameters a new process starts with. We read both publications in full, including the part the headlines skipped: in Flashpoint's lab the XDR component DID block, and only stopped once two further evasions were stacked on top; and the authors themselves warn the technique "has multiple opportunities for detection". Also: why this is post-exploitation and not a way in, why the same primitive had already been described publicly before (with no known date), the four checks you can ask your console for this week —and the catch that none of them is a button, but a query over telemetry someone has to have kept and someone has to write—.

Cybersecurity EDR/MDR Monitoring
Read more →
Interior de una librería de cintas con los cartuchos alineados en sus ranuras
9 min read

Your immutable backup has a permission that deletes it

"Our backups are immutable" is an incomplete sentence, and Amazon's documentation proves it. Object Lock has two modes: in compliance mode nobody can delete anything, not even the root user, and the only documented way out is closing the AWS account; in governance mode anyone holding the s3:BypassGovernanceRetention permission can delete. Both are called immutability. And AWS adds a note almost nobody has read: the web console includes the header needed to override the lock by default, so the friction exists in the API and vanishes in the interface. Also: why the intuitive test (trying to delete an object) returns 200 OK and misleads you in both directions, why Veeam adds 30 days to the immutability you configured on S3, and what that 93% / 16% study doing the rounds in September actually says —including a sample that looks nothing like your company—. And at the end, a sentence with four blanks that whoever runs your backups has to be able to finish.

Backup Ransomware Cybersecurity
Read more →
Bahías de disco de un servidor con bandejas medio extraídas y huecos vacíos
8 min read

Your redundancy assumes the spare arrives tomorrow

A drive dies on a Tuesday and nothing happens: that is what you paid the replica for. But what you bought is not immunity, it is a window of time in which to replace the part before the next failure — and that window was calculated assuming the spare arrives tomorrow. Western Digital told its earnings call it was "pretty much sold out for calendar year 2026" and Seagate said its nearline capacity was "fully allocated" for the same period, with cloud agreements now reaching into 2027 and 2028. We run the arithmetic on Backblaze's published failure rates: with the spare in 48 hours, the probability of a second failure before the repair is 0.18%; with the spare in 20 weeks, it is 11.5%. Same design, same drives, 66 times the risk from a variable that appears in no diagram. Where it hurts most (the node, not the disk), the retention cut nobody signs off, and the six questions we ask now before approving a design.

Infrastructure Storage Continuity
Read more →
Sala con filas de puestos de trabajo y ordenadores bajo luz fluorescente
8 min read

CVE-2026-32996: the backup agent left the administrator ticket written in a log file

The exploit overflows no stack and corrupts no memory: it opens a text file any user on the machine can read, finds a session identifier inside, presents it over a named pipe and runs whatever you want as SYSTEM. With the vendor advisory in front of us, three things being reported wrong about CVE-2026-32996 in Veeam Agent for Windows: the version the headlines quote (13.0.1.2067) is the server build, not the agent one —the number to check is 13.0.3.1220—; the patch for two hundred laptops hangs off the change window of the backup server, the machine nobody wants to touch; and the phrase "active exploitation" was only ever in the headline of a bulletin whose body said something else, and which was then pulled. Why AT:P in the vector changes which machines you look at first, and the four things we would do this week.

Backup Vulnerabilities Patching
Read more →
Vestíbulo de oficina con una fila de tornos de acceso de cristal alineados y vacíos
8 min read

The Conditional Access policies you never wrote are already in your tenant

Open the Conditional Access policy list in your tenant and look at the Created by column. If any row says Microsoft, nobody in your company wrote that policy: Microsoft creates it in Report-only and switches it on itself "no less than 30 days" later, with two weeks' notice and a note saying it can be sooner. They cannot be renamed or deleted; the only thing you can change is who you exclude —starting with your emergency account—. Which ten exist today, the three that actually break things (device code flow and Teams rooms, legacy authentication and the scan-to-email printer, MFA for all users and licensed service accounts), the detail almost nobody quotes —your P2 license count and MFA registration draw who the risk policy protects— and the audit query that tells you what Microsoft changed in your tenant and when.

Microsoft 365 Identity Cybersecurity
Read more →
Pasillo entre armarios de servidores en penumbra, con centenares de indicadores luminosos encendidos a la vez
7 min read

Retry storms: the second outage is the one you cause

On 12 June 2025 Google Cloud went down hard. 40 minutes in, the mitigation had been rolled out and regions started to recover, the smaller ones first; us-central1 was not fully resolved until 2 h 40 min after the incident began. What stretched that region was not the bug: it was the retries. The public incident report says it plainly —"Service Control did not have the appropriate randomized exponential backoff implemented to avoid this"— and describes a herd effect on the Spanner table everything depended on. Here we cover where that same mechanism lives in an ordinary company (the cron job that takes longer than its interval, the overlapping backup, the sixty desktops booting at once when the power comes back, the monitoring that pushes hardest when it hurts), why three retries across three layers mean 64 attempts against your database, the four numbers you need written down, and when NOT to touch anything.

High availability Infrastructure Monitoring
Read more →
Armario de comunicaciones de pared en una sede pequeña, con router, módem y switch conectados con cables de red
9 min read

Your site-to-site tunnel doesn't ask for MFA because there's nobody to ask

CVE-2026-85102 entered the CISA catalog on September 22 with a three-day deadline, and almost all the coverage stopped at "patch your remote access VPN". The official description says "Site to Site VPN or Remote Access VPN": the tunnel between your own offices too, where there is no user to ask for a second factor, the trust was configured once and never expires, and the flaw happens during certificate negotiation — before your MFA and conditional access ever get to run. With the caveat almost nobody mentions (that path only applies if the tunnel authenticates with certificates, not a pre-shared key), the cross-reading of both advisories — the branch that saves you from one is the one listed in the scope of the other — and the four things we would check this week.

Zero Trust VPN Networking
Read more →
Oficina diáfana vacía con mesas de trabajo al fondo y una zona de sofás en primer plano
10 min read

AI speeds up what you write, not what you can deploy

Of the two things DORA said about AI in 2024, in 2025 it observed the opposite for one — delivery throughput flipped sign — and exactly the same for the other, which is the one that costs money: more AI still comes with less delivery stability. Two consecutive reports, same sign. With the METR trial that measured a 19% slowdown where participants perceived a 20% improvement — and the caveats its own authors published afterwards, including a second trial with intervals that cross zero — what the 2026 ROI report assumes in money (one point of change failure rate, $344,000) and the four things that have to take more flow before you buy anything: an environment that looks like production, small batches, a timed rollback and telemetry by symptom.

AI Automation Data
Read more →
Pasillo de un archivo con estanterías compactas llenas de cajas de archivo numeradas
9 min read

The first AI-agent breach is on file. The hard part was being able to describe it

On 14 September the Spanish data protection authority published that it had received the first notification of a personal data breach that "would have been executed by means of an artificial intelligence agent" — its own conditional. The whole attack fits in one sentence, and the authority warns the information comes from the affected organisation and is still pending analysis. We read those four phases as what they will eventually be for somebody else: a regulator's form with a 72-hour clock on it. Which record you need to write each sentence, why "autonomously" is inferred rather than logged, what the authority now expects in writing in your risk assessment, and why three of the four phases are stopped by boring things that involve no AI at all.

AI Compliance Cybersecurity
Read more →
Técnico agachado detrás de un rack, con el portátil apoyado en el suelo técnico y un manojo de cables sueltos al lado
10 min read

Moving to Proxmox doesn't touch your licences; failover does

The Windows licensing question comes up in every migration meeting, and the short answer disappoints everyone: changing hypervisor recalculates nothing. Something else changes the bill, and Microsoft has it written in a single sentence: "License Mobility across Server Farms is not available for Windows Server, so each server must be licensed for peak capacity at all times." Each server, peak capacity, at all times. The licence does not follow the virtual machine, so the number depends on how many nodes it could ever start on: 32 core licences or 96, for exactly the same installation. What changed in SQL Server 2022, why the AVMA myth does not apply to you if you are coming from vSphere, and why a Proxmox affinity rule is a useful control but not a contractual boundary.

Migration Licensing Virtualization
Read more →
Armario de comunicaciones montado en la pared de una pequeña empresa, con un router, un módem y un switch, y los cables recogidos sin orden dentro
8 min read

The flaw is WordPress's; your php.ini decides the exposure

CVE-2026-87902 entered CISA's Known Exploited Vulnerabilities catalogue on 25 September, three days after the advisory and a proof of concept went public. It is a 9.2 and it is WordPress core, patched across 25 branches down to 4.7.37 (December 2016). But 9.2 measures the damage, not your exposure: the CVSS 4.0 vector itself carries AT:P — "conditions are required" — and none of the deciding conditions belong to WordPress. A PHP directive, a PEAR file and a directory inside your active theme. What each one checks, why the obvious command for looking at it from a shell returns a false answer — we measured it on a box running PHP 8.3.6 — and what NOT to do if you suspect it already happened.

Cybersecurity WordPress PHP
Read more →
Nave industrial vacía con el suelo de hormigón, un palé en primer plano y la puerta abierta al fondo
8 min read

Data Act: in January 2027 leaving the cloud becomes free; moving does not

On 12 January 2027 your cloud provider loses the right to charge you for leaving: Article 29(1) of the EU Data Act forbids it. But the big three already dropped that fee back in 2024, so what changes is not the amount — it is that this stops being a conditional credit programme and starts reaching the small providers too. The exit invoice disappears; the cost of leaving stays exactly where it was. The definition of "functional equivalence" speaks of "a minimum level of functionality", binds infrastructure services only, and covers only the features both source and destination offer alike. What you actually get back, what the trade-secret carve-out hides, why multicloud traffic still gets billed, the exact deadlines you can already enforce (two months, thirty days, seven months) and the exit drill that reveals the number no contract contains.

Cloud Regulation Data
Read more →
Fila de mesas de oficina con los monitores apagados y una silla vacía
8 min read

Office 2021 does not stop working: it stops being tested against Microsoft 365

On 13 October 2026 nothing switches off: Word will open, Outlook will sync and nobody will notice. That day two clocks start at once and only one makes noise. The first is the ordinary end of support — Microsoft stops providing technical support, bug fixes and security updates. The second raises no alert: Microsoft stops checking that its own services still work with your Office, and the outage arrives months later without you touching a thing. The two different dates Microsoft itself publishes, the Office 2016/2019 precedent from 2023, and the finding that decides who is in a hurry: Windows 11 24H2 Home and Pro expires in the very same second, but the Enterprise edition holds on for another year.

Workplace Licensing Microsoft 365
Read more →
Nodos idénticos apilados en un rack, cada uno con su pantalla y su etiqueta
9 min read

Your three-node Ceph does not heal itself: it holds on

A dead disk in a three-node cluster fixes itself provided another disk remains on that same server: the CRUSH rule descends to another OSD on the same host. A dead HOST does not. With replica 3 and the failure domain set to "host" — what Proxmox ships by default — there is no fourth place to put the third copy, so placement groups sit at active+undersized+degraded until the node comes back. And the cluster keeps serving, which is exactly why nobody looks at it. Ceph's real timers (20 seconds, 10 minutes, 15 minutes), what you cannot touch while the degraded window lasts, why recovery can cost you corosync quorum, and why the number that matters is not how many nodes you have but how many distinct places.

Ceph Proxmox Storage
Read more →
Sala de servidores con el pasillo de racks y el cableado de red ordenado
8 min read

Kubernetes expires every fourteen months, and you cannot skip versions

On 27 October 2026 the Kubernetes 1.34 branch stops receiving patches, and that date has been published since the version shipped. The project supports each branch for "roughly fourteen (14) months" — twelve months plus two in maintenance mode — and only the three most recent minor versions. Subtract the published end-of-life dates and you get the number that matters: a version expires every four months. What maintenance mode actually means, why the control plane cannot skip versions on upgrade, how much slack the nodes have, and why that slack makes a cluster look healthy while it drifts.

Kubernetes Infrastructure DevOps
Read more →
Armario de servidores con cada máquina etiquetada a mano, una por una
8 min read

Your Proxmox backup skips disks and the job still turns green

The limitations page for the Veeam plug-in for Proxmox VE was updated on 15 September 2026, and two lines in it carry the word that really matters: skipped. There are two very different kinds of "not supported": the one that stops your job and the one that skips a disk and paints the job green. What falls outside the backup of a Proxmox platform, what does not come back when the machine comes back, why LXC containers are a separate inventory, and why the backup manual gets read before you choose your storage rather than on restore day.

Proxmox Backup Disaster Recovery
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN