Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Vista aérea de un enlace de autopista en trébol, con varias rutas posibles entre los mismos dos puntos
8 min read

Your SD-WAN orchestrator is the key to every one of your sites

On 22 September CISA added CVE-2026-93952 to the known exploited vulnerabilities catalogue: a 10.0 out of 10 in VeloCloud Orchestrator, the system that configures every site in an SD-WAN network. The second exploited 10.0 in that same orchestrator in eight weeks. And the exploitation condition the vendor itself publishes is an uncomfortable line: it requires access to the PUBLIC portion of the certificate the branch device authenticates with. Why that points at the trust model and not just at an input validation bug, what to do if your version train has no patch yet, the three traces to look for in the filesystem today, and the question we ask before centralising a control plane.

SD-WAN Networking Cybersecurity
Read more →
Rack de comunicaciones con paneles de parcheo, latiguillos de red y una bandeja de fibra en la parte baja
5 min read

The DDoS that takes you down is not in the headlines

In the first half of 2026, 96.62% of the network-layer attacks Cloudflare mitigated stayed under 500 Mbps and 90.60% ended in under ten minutes. The attack that makes the press is measured in tens of terabits; the one that will take a mid-sized company offline fits inside an ordinary fibre link and is over before anyone picks up the phone. Why the metric that matters is time to activation and not terabits of capacity, what changes now that DNS floods have gone from 25.7% to 40% in a single quarter, and the five questions we ask before buying any mitigation.

Networking DDoS Cybersecurity
Read more →
Armario de comunicaciones con paneles de parcheo y una maraña de cables de red azules
5 min read

The patch for your switch had been out for 97 days

On 21 September CISA added a single CVE to its catalogue of exploited vulnerabilities: a stack-based buffer overflow in the CGI program of Zyxel GS1900 switch firmware, unauthenticated and with command execution. Zyxel published the advisory and the ten fixed firmware builds on 16 June: 97 days earlier. We counted the 30 entries the catalogue has taken in so far this month and the median is 5 days, so the list mixes two different populations. Why "LAN-based" is not a mitigating factor but the attack's requirement, what the small print does not say about models out of support, and why the entry asks for forensic triage before you reflash.

Networking Patching Maintenance
Read more →
Dos portátiles abiertos sobre una mesa de oficina y una mano escribiendo sobre unos papeles
7 min read

The agent pinned the plugin's commit. Git handed it the attacker's branch

Plugin4Shell affects the four most widely used AI coding agents: they clone the plugin repository, check out the pinned commit and never verify they landed on it. We reproduced in the lab, with git 2.43, the git behaviour it rests on: exit code 0, a warning nobody reads, and the attacker's content in the working tree. The same 40-character string gives a different answer depending on which git command reads it, so auditing with git log is no help. And today's defence today depends above all on where the plugin repository is hosted.

IA Cybersecurity DevOps
Read more →
Interior de un servidor de dos zócalos abierto, con los procesadores y dos bancos de módulos de memoria a la vista
8 min read

Patching the kernel means rebooting, and the reboot erases the evidence

CISA added two Linux kernel flaws to its exploited catalogue today, due by Monday. One has sat in your scanner for eleven months rated 3.3 out of 10; the kernel project scores it 7.8 on the very same record. Both entries carry the forensic-triage flag CISA now attaches to two out of every three new additions, and its guidance says not to remediate before collecting evidence. In the kernel, remediating means rebooting. And rebooting erases a good part of what you are asked to keep.

Cybersecurity Linux Patching
Read more →
Cerro con torres de comunicaciones, antenas parabólicas y radioenlaces contra el cielo
9 min read

MikroTik shipped that port closed: the flaw is theirs, the exception is yours

On 5 September CERT Polska published six RouterOS vulnerabilities; two of them chained give full control of a MikroTik with no authentication, and Shadowserver counted 122,500 devices with SSH reachable from the internet. The vendor's own advisory says its default configuration blocks that port. So the thing to look at is not the CVE: it is who opened the exception, when, and why nobody gave it an expiry date.

Networking Cybersecurity Vulnerabilities
Read more →
Armario de red de pared en una sede pequeña: switch de 16 puertos, router, ONT y cableado desordenado
5 min read

In the branch you did not buy a firewall: you bought an SD-WAN checkbox

Arista is retiring VeloCloud Security VNFs: the Fortinet, Palo Alto or Check Point firewall running inside the Edge loses support on 28 February 2027, and 5.2.x is the last release that carries it. What expires is not a licence, it is the idea that the branch firewall was ever yours: the day branch security became a checkbox inside the transport product, its calendar stopped being yours.

SD-WAN Networking Cybersecurity
Read more →
Interior de un armario de comunicaciones de planta con switch, panel de conexiones y cableado de cobre y fibra
12 min read

Cisco ISE, a perfect 10 with no workaround: your network already decided what to do without it

On 16 September Cisco published a CVSS 10.0 in Identity Services Engine: an authentication bypass in an API, no workaround available, active exploitation and command execution as root. Before arguing about the maintenance window there are two things to look at: ISE's own access.log, because the advisory ships indicators and the recommendation to re-image the node if anything shows up, and the show run on a floor switch, because that is where what your network will do when the policy engine stops answering is already written. The default value of radius-server deadtime is 0.

Cybersecurity Networking Zero Trust
Read more →
Parte trasera de un chasis de servidor con módulos de ventilador y cables de alimentación
10 min read

Acronis Backup: "requires local access" — and that access is what you sell your customers

On 15 September Acronis published a one-sentence advisory: local privilege escalation through insecure file permissions in its backup plugin for cPanel and Plesk, CVSS 7.8, exploited in targeted attacks. A "local" 7.8 is exactly the CVE almost every patching queue pushes to next week. On a machine with a single administrator, that call is defensible. On a server where every customer gets their own system user, the requirement for "local access with low privileges" is not describing a barrier: it is describing your business model.

Cybersecurity Backup Patching
Read more →
Nave de un centro de distribución: estanterías metálicas con palés embalados y pasillo de preparación de pedidos
8 min read

Cutting you off takes 101 minutes; reconnecting you, nine days

Boston Scientific disclosed its incident on a Wednesday. That same day, 101 minutes after the first notice, the platform its customers use to send it orders cut every one of its global connections. It took nine days to give them back. The full timeline sits on a public status page and teaches three things that are in almost no continuity plan: who decides to disconnect you, which degraded channel keeps you alive meanwhile, and why your status system stops telling the truth.

Continuity Disaster recovery Compliance
Read more →
Sala con filas de puestos de trabajo: torres bajo las mesas, monitores apagados, teclados y cables recogidos
10 min read

EDR isolates the device on its own; the rule that brings it back is written beforehand

On 3 September Microsoft added a sentence to the Defender for Endpoint documentation and by the next day it was gone: it warned that automatic isolation fires as FULL isolation and that, with a web proxy, the device might not recover. The two facts it joined are both still published, but in separate sections. What gets isolated on its own and what does not, what "containing" does and what "isolating" does, and the way back point by point.

Cybersecurity EDR/MDR Microsoft 365
Read more →
Varios servidores de 1U apilados en un rack, con cableado de red blanco recogido y pantallas LCD de estado en el frontal
13 min read

Ceph changes cipher: rebooting the virtual machine does not refresh the key

On 9 September Proxmox published the procedure to migrate cephx keys from aes to aes256k. The hard part is not cryptographic: it is knowing what counts as "refreshing a client". The documentation says it in six words — "A guest reboot is not enough" — and the failure does not show up when you run the command, but minutes or days later, when a ticket expires. What has changed since August, the kernel 7.0 gate, and the order we follow.

Ceph Proxmox Storage
Read more →
Estanterías de un depósito de archivo con legajos y cajas de documentos etiquetados
9 min read

"Read-only" does not exist: GitLab scores 10.0 on a flaw that can only read

CVE-2026-85706 lets a stranger read files off a self-hosted GitLab server. It writes nothing, and it still carries the maximum score. The explanation is not in the headline: it is in the vector the vendor itself signed off, with a changed scope and high integrity impact. We go through what the vector says, why CISA gave it three days and a forensic triage flag, and how to answer the one question the patch does not: were we read?

Cybersecurity GitLab Vulnerabilities
Read more →
Rack de una pequeña oficina con panel de parcheo, latiguillos y equipos de red apilados
9 min read

The AI agent will not show up in your log: whoever lent it the token will

Connecting an assistant to SharePoint or the ERP is not an integration decision, it is a delegation decision. The Model Context Protocol specification, revision 2026-07-28, forbids forwarding somebody else's token in capital letters, and spells out why: the destination system's logs will show a different identity from the one that made the request. We go through the spec, the permission fallback that asks for everything on offer, the CVE in the official SDK, and the seven questions we ask before connecting anything.

AI Automation Identity
Read more →
Ordenador abierto sobre el banco de trabajo de un servicio de reparación informática
10 min read

Remote support: the file runs on the technician's machine

On 11 September, CISA added a ConnectWise ScreenConnect advisory to its catalogue of exploited vulnerabilities. The detail almost nobody highlights comes from the vendor itself: "ScreenConnect servers are not impacted". The machine that ends up running the file is the one support is given from. Three days earlier, N-able N-central had entered the same list with a 10.0. We counted the whole catalogue: fifteen entries in 2026 for software whose job is governing other people's computers. Windows, thirteen.

Maintenance RMM Cybersecurity
Read more →
Reloj de pared de esfera oscura en una pared gris de oficina
8 min read

Cyber Resilience Act: 24 hours to report, and the clock does not start with the CVE

Article 14 of the Cyber Resilience Act starts to apply today: 24 hours for the first warning about an actively exploited vulnerability. Two details almost nobody is covering: it is the only article the regulation stretches backwards, reaching what you have already sold, and the deadline runs not from the CVE being published but from the moment you "become aware". That turns a legal obligation into an instrumentation problem: telemetry, a watched mailbox and who declares the time.

Regulation Compliance Cybersecurity
Read more →
Panel de parcheo a oscuras con cuatro conectores RJ45 desconectados
10 min read

Cisco FMC: patching closes the door, but nobody gives you back your network blueprint

On 9 September, Cisco Talos confirmed active exploitation of two flaws in Secure Firewall Management Center, and counted three separate attacker clusters inside the same box. One of them dropped two scripts to harvest the configurations of the managed firewalls. That is the part almost nobody is discussing: credentials rotate, a domain gets restored, and your perimeter configuration does not rotate. It is a description of your network, and it stays valid after the patch.

Cybersecurity Vulnerabilities Networking
Read more →
Armario de comunicaciones de pared con switch y cables de red
10 min read

Windows DNS, an unauthenticated 9.8: what turns a bug into a worm is not the bug, it's your network

On 8 September Microsoft shipped the largest batch of patches in its history. Dustin Childs, of the Zero Day Initiative, counts twenty that could be classified as wormable, spread across thirteen components. Those thirteen are not one list: they are two. Seven of those CVEs sit in services your domain requires every machine to reach — DNS, Netlogon, Active Directory, DHCP — and eleven sit in roles Windows does not install on its own. The first half is managed with patching order; the second, by uninstalling. And hardly anyone knows which of the two they have switched on.

Cybersecurity Networking Windows
Read more →
Sala de control con un muro de pantallas de monitorización y varias personas mirándolo de pie
10 min read

AI now finds zero-days on its own. Your problem is the 43 days that come after

On 4 September OpenAI launched GPT-6 Astra and declared it the first model it deploys reaching the "Critical" cybersecurity capability level of its preparedness framework. Almost all the coverage went after that half. The two numbers that decide what happens to you predate Astra and neither is about finding flaws: mean time to exploit is minus seven days according to M-Trends 2026, and the median to fully remediate a KEV-listed vulnerability is 43 days according to Verizon's DBIR. The bottleneck was never finding.

Patching AI Cybersecurity
Read more →
Armario de red mural abierto en el pasillo de una oficina, con anillas pasahilos y cables recogidos, y un extintor apoyado en la pared al fondo
7 min read

July's patch is September's vulnerable build

SonicWall closed the SMA 1000 zero-day pair in build 12.4.3-03453 on 14 July. The 1 September advisory lists 12.4.3-03453 and earlier as affected: anyone who met the three-day KEV deadline landed on exactly the build that is back in the catalog 49 days later, with the same shape of flaw. When an appliance repeats the shape of the flaw, the question stops being whether it is patched and becomes how far that box reaches.

SD-WAN Networking Vulnerabilities
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN