Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Panel de parcheo de fibra con latiguillos etiquetados a mano: la documentación de red que deja de coincidir con la realidad
7 min read

Your network spreadsheet lies: how we build a source of truth with NetBox

Documenting a network is not scanning it. NetBox's own documentation says so plainly: it represents the desired state of a network rather than its operational state, and it discourages automated import of live network state. That is the criterion almost nobody applies. What NetBox is and is not, the three-question test for whether your inventory is worth anything, what we document and what we deliberately do not, and when you do not need any of this.

Networks NetBox Documentation
Read more →
Proxmox VE 9.2 para arm64 anunciado el 5 de agosto de 2026: paridad de funciones con x86-64, plataformas NVIDIA Grace y Vera, y sin migración en vivo entre arquitecturas
8 min read

Proxmox on Arm doesn't extend your cluster — it makes you run two

On 5 August Proxmox shipped the first officially supported edition of Proxmox VE 9.2 for arm64: same codebase, same repositories, same lifecycle and feature parity with x86-64. Buried in the announcement there is one sentence that decides how you design your infrastructure: guests only run on nodes matching their architecture, and live migration only works between nodes of the same architecture. What they actually shipped, what you give up crossing to Arm, why the Raspberry Pi is left out, and the five questions we ask before quoting an Arm node.

Proxmox Arm Virtualisation
Read more →
CVE-2026-34486 en Apache Tomcat: el EncryptInterceptor procesaba los mensajes del clúster aunque fallara el descifrado, un control de seguridad que falla abriendo
8 min read

If decryption fails, the message goes through anyway

The fix for the Apache Tomcat vulnerability CISA flagged as exploited on 4 August fits in a single line of code moved somewhere else. For two weeks, if decryption of a cluster message failed, Tomcat logged the error and processed the message anyway. And only 11.0.20, 10.1.53 and 9.0.116 were affected: precisely the versions carrying the patch for the previous flaw. What it means for a control to "fail open", why the log was the only signal, and what we check.

Cybersecurity Applications Open Source
Read more →
CVE-2026-9198 en Langflow entra en el catálogo KEV de CISA el 4 de agosto de 2026: la capa de IA y automatización autoalojada (Langflow, n8n, Open WebUI) tratada como producción
8 min read

The AI pilot nobody switched off is already production

On 4 August, CISA added a 9.8 in Langflow to its exploited-vulnerabilities catalogue: one endpoint that hands superuser tokens to anyone who reaches the port, chained with another that runs whatever code you send it. The patch had been out for six weeks. It is not an isolated case: in Open WebUI the ENABLE_CODE_EXECUTION=false switch turned nothing off, and in n8n anyone who could edit a workflow could run commands on the host. Three products, the same starting assumption. What we do with the AI and automation layer, and when we recommend not self-hosting it at all.

AI Automation Cybersecurity
Read more →
El AI Act ya aplica desde el 2 de agosto de 2026: qué obligaciones entraron de verdad, qué aplazó el Ómnibus digital sobre IA y el checklist de inventario de everyWAN
8 min read

The AI Act already applies to you — and not for the reason the headlines gave

On 2 August the bulk of the EU AI Act became applicable. Six days earlier, the Digital Omnibus on AI (Regulation EU 2026/1744, in force since 27 July) pushed high-risk obligations to December 2027 and August 2028. What does apply from 2 August is Article 50 — transparency — with fines of up to €15M or 3% (the lower amount for SMEs) and a date almost nobody wrote down: 2 December 2026. What actually changed, where Article 25 really bites, and the inventory checklist we run on a Microsoft 365 tenant.

AI Compliance Regulation
Read more →
WireGuard o IPsec: comparativa honesta entre los dos protocolos de túnel, con el criterio de everyWAN sobre cuál usar en cada caso y el calendario post-cuántico europeo
8 min read

WireGuard or IPsec: what we deploy where

WireGuard is about 4,000 lines of code, it landed in the Linux kernel in 2020 and it fits on one page of config. IPsec drags along thirty years of RFCs and proposals that never quite match. And we still deploy IPsec in a good share of the places we work, for three reasons that show up in no comparison table: who is on the other end of the tunnel, who authenticates the people, and what happens when the cryptography has to change. An honest comparison, no fanboyism, with Europe's post-quantum calendar on the table.

WireGuard IPsec VPN
Read more →
Pass-ta-key: tres técnicas de Unit 42 contra las passkeys sincronizadas de Google Password Manager en Chrome sobre Windows, incluida la extracción del secreto de 32 bytes que las descifra todas
8 min read

Your passkey isn't broken — the master key gets copied

On 3 August, Unit 42 published three ways into passkey-protected accounts without breaking a single line of cryptography. The worst of them lifts a 32-byte secret out of Chrome's memory that decrypts every passkey synced to the account — and in Google's current implementation that secret cannot be rotated or revoked. All three start the same way: with malware already running on a Windows machine, with no administrator rights and no privilege escalation. We still recommend passkeys, and this post explains why that is not a contradiction.

Passkeys Identity EDR/MDR
Read more →
CVE-2026-18577 en N-able N-central: un salto de autenticación en la consola desde la que los proveedores de IT gestionan los equipos de sus clientes, explotado con el control remoto del propio producto
10 min read

The agent we install on your machines is also a door

On 3 August, CISA added CVE-2026-18577 to its exploited-vulnerabilities catalogue with a deadline of the 6th. It is a flaw in the console many IT providers use to manage their customers' machines, and it arrived as the incomplete patch for another flaw published two days earlier. The vendor found out through a rise in licensing issues, not a security alert. Access was not granted by malware: the attackers used the product's own remote-control feature and left a tunnel behind so they would still be inside after the console was cut off. We are a managed services provider, and this post is about what that means for the people who hire us.

RMM Maintenance Security
Read more →
El 31 de octubre de 2026 se acaba el modelo de licencia de VMware incluida en los nodos de Azure VMware Solution: a partir del 1 de noviembre hay que aportar una suscripción portable de VMware Cloud Foundation comprada a Broadcom
8 min read

Plan B expires on 31 October: VMware with the licence included is ending in the cloud

On 31 October 2026 the Azure VMware Solution model in which the licence came bundled with the node comes to an end: from 1 November you must bring a VMware Cloud Foundation key bought directly from Broadcom. On Google Cloud VMware Engine it already happened on 1 November 2025. Eighty-nine days to go. For two years, "I will just lift my vSphere into the hyperscaler" has been the favourite plan B for not deciding; it was an extension, and extensions expire. The maths you can finish this week, and when staying put is the right call.

VMware Licensing Cloud
Read more →
CVE-2026-66066, un fallo de CVSS 9,5 en Active Storage de Ruby on Rails, permite leer ficheros del servidor subiendo una imagen cuando la aplicación procesa variantes con libvips
10 min read

A 9.5 in Rails: the flaw is not in your application, it is in the library nobody chose

On 29 July 2026 Rails published CVE-2026-66066: a 9.5 in Active Storage letting an unauthenticated attacker read files from the server — including the process environment with secret_key_base and the database credentials — by uploading an image. The flaw is not in the code you commissioned, nor exactly in Rails: it is in which formats libvips considers safe to read, a C library nobody at your company chose. And libvips has published since 2022 which of its operations it has not verified, with a switch to block them. The label was there; what was missing was flipping it.

Applications Development Cybersecurity
Read more →
CVE-2026-63077, un fallo de CVSS 9,8 sin autenticación en todas las versiones de JetBrains TeamCity On-Premises, pone el foco en el servidor de CI/CD como sistema crítico
11 min read

Your CI/CD holds the keys to production. And you treat it as a developer tool

On 27 July 2026 JetBrains published CVE-2026-63077: an unauthenticated 9.8 affecting EVERY version of TeamCity On-Premises and allowing operating system commands to be run on the build server. There is no known exploitation. The two previous times TeamCity had a flaw like this ended with Russia's SVR inside technology companies and with BianLian operators creating users on build servers. The underlying problem is not TeamCity: it is that the machine which deploys to production is in almost nobody's critical systems inventory.

CI/CD DevOps Cybersecurity
Read more →
Por primera vez el 46% de las cargas de IT corporativa vive en instalaciones de terceros frente al 44% en centros de datos propios, según la encuesta de Uptime Institute de 2026
11 min read

Half of corporate IT now lives off premises. That does not mean it went to the cloud

On 28 July 2026 Uptime Institute published the figure that went around the industry: for the first time, third-party facilities (46%) overtake companies' own data centres (44%). The number is real. The "the cloud won" reading is not: that 46% puts colocation and SaaS in the same box, and they are opposite decisions. And the most interesting part of the report is not in the headline but in the remaining 10%, and in what is happening to kilowatts per rack.

Datacenter Colocation Infrastructure
Read more →
La nueva retención por último acceso de Microsoft Purview borra ficheros de SharePoint y OneDrive y deja 93 días de papelera como único margen
7 min read

What nobody opens gets deleted: Purview, last accessed, and the 93 days to notice

By mid-August 2026 Microsoft finishes rolling out a Purview retention rule that deletes SharePoint and OneDrive files nobody has opened for a given period, justified on the grounds that Copilot will answer better. It deletes nothing on its own: somebody has to configure it. But it is the first deletion trigger that measures not a property of the document but the absence of human activity, and the file nobody opens in three years may well be the one you need in year four. What is actually shipping, the 93 recycle-bin days that are your only margin, why version history will not save you, and what we would do before touching that button.

Microsoft Backup SharePoint
Read more →
Más de 700 organizaciones afectadas por el robo de tokens OAuth de una aplicación conectada, sin ninguna contraseña robada
8 min read

The token that never asks for MFA: connected apps in your Microsoft 365

More than 700 organisations were potentially exposed in August 2025 without a single password being stolen: the attacker took the OAuth tokens of an application they had connected themselves. On 13 July 2026 Microsoft published the map of a full year of that technique: two attack chains and not one suspicious sign-in. The part that fails is not the login, it is consent: how to inventory the applications connected to your tenant with two Graph queries, what each button actually switches off, and why changing the consent setting revokes nothing already granted.

Microsoft Identity Cybersecurity
Read more →
Google corrige 1.072 fallos de seguridad de Chrome con agentes de IA y pasa a publicar un hito cada dos semanas
8 min read

Google fixed 1,072 Chrome bugs with AI: the bottleneck is now you

Chrome 149 and 150 fixed 1,072 security bugs, more than the previous 23 releases combined, with AI agents that find, reproduce, triage and patch. But the number is not the story: Chrome is moving to a milestone every two weeks and piloting two security releases a week. What really changes in your patch cycle, why counting CVEs no longer measures anything, and which of your software will never get this treatment.

AI Maintenance Chrome
Read more →
Nueve entradas del catálogo KEV de CISA en 2026 apuntan al plano de gestión de una red SD-WAN
8 min read

Your SD-WAN doesn't go down: it gets reconfigured

Of the 172 vulnerabilities CISA has flagged as exploited so far in 2026, nine point at the same place: the management plane of an SD-WAN. And the attacker Mandiant documented inside a Catalyst SD-WAN Manager took nothing down: they registered as a peer, copied the fabric's configuration templates through the product's own API and wiped their tracks. The numbers are our own count over the KEV catalogue, including the only two entries all year with a 48-hour deadline. What to look at when the attack looks like a legitimate configuration change and your monitoring stays green.

SD-WAN Networks Security
Read more →
EWS en Exchange Online: la fecha límite real para escribir la lista de aplicaciones permitidas es el 31 de agosto de 2026
8 min read

EWS shuts down in October, but your deadline is 31 August

On 1 October Exchange Online starts disabling EWS, and on 1 April 2027 it disables it for good, with no re-enablement. But one detail turns the calendar on its head: from October, leaving EWSEnabled set to True with an empty allowed-application list starts to mean "block everything", and if you do not write that list before the end of August, in September Microsoft writes it for you based on whatever it saw running. What to look at in the usage report, the exact commands, why that automatic list fails both by omission and by excess, and the gaps Graph still does not cover according to Microsoft's own roadmap.

Exchange Microsoft Migration
Read more →
El peaje del ESU de Windows 10: el precio se duplica cada año y es acumulativo
8 min read

Windows 10 and the October toll: ESU doubles every year and you cannot skip year one

Microsoft charges $61 per device for the first year of Windows 10 extended security updates, and its own documentation says two things almost nobody puts together: the price doubles every consecutive year and ESUs are cumulative, so enrolling in year three means paying for all three. Delaying enrolment does not reduce the bill if you end up enrolling: it shifts the payment and leaves you without patches while you wait. The full math, the three blind spots that cost real money (the 2027 headline is not about your company, LTSC is not covered, and Office lives on until 2028 but you can no longer log a bug) and when paying for ESU really is the right call.

Windows Licensing Workplace
Read more →
Ceph Squid 19.2 llega a su fin de vida estimado el 19 de septiembre de 2026
7 min read

Your Ceph has a date: Squid runs out of patches on 19 September

Ceph's lifecycle table puts the estimated end of life of Squid (19.2) on 19 September 2026: fifty days from today. Its replacement, Tentacle (20.2), has been stable since November and Proxmox has marked it stable since 9.2. The problem is not the jump, it is that it is not a jump: it is a sequence of three maintenance windows whose order you do not get to choose, with two details almost nobody has looked at — the mgr/zabbix module is gone, and erasure coding optimisations do not switch themselves on.

Ceph Proxmox Storage
Read more →
Informe de ransomware 2026: 1,7 millones de dólares de coste medio de recuperación por incidente
7 min read

Restoring is not recovering: two in three recover from backup and nearly half still pay

Sophos's annual ransomware report (2,158 IT leaders across 17 countries, Spain included) brings the biggest backup rebound in the series: 66% of victims whose data was encrypted recovered from backup, twelve points above the 54% of 2025. At the same time 48% paid, and the average cost of recovering rose 11% to $1.7 million with the ransom excluded. Why the two numbers do not contradict each other, the note on method about the two medians almost nobody is reading correctly, what is inside that bill, and the five things worth timing before the bad day.

Ransomware Backup Disaster Recovery
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN