Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Vista aérea de un enlace de autopista en trébol, con varias rutas posibles entre los mismos dos puntos
8 min read

Your SD-WAN orchestrator is the key to every one of your sites

On 22 September CISA added CVE-2026-93952 to the known exploited vulnerabilities catalogue: a 10.0 out of 10 in VeloCloud Orchestrator, the system that configures every site in an SD-WAN network. The second exploited 10.0 in that same orchestrator in eight weeks. And the exploitation condition the vendor itself publishes is an uncomfortable line: it requires access to the PUBLIC portion of the certificate the branch device authenticates with. Why that points at the trust model and not just at an input validation bug, what to do if your version train has no patch yet, the three traces to look for in the filesystem today, and the question we ask before centralising a control plane.

SD-WAN Networking Cybersecurity
Read more →
Rack de comunicaciones con paneles de parcheo, latiguillos de red y una bandeja de fibra en la parte baja
5 min read

The DDoS that takes you down is not in the headlines

In the first half of 2026, 96.62% of the network-layer attacks Cloudflare mitigated stayed under 500 Mbps and 90.60% ended in under ten minutes. The attack that makes the press is measured in tens of terabits; the one that will take a mid-sized company offline fits inside an ordinary fibre link and is over before anyone picks up the phone. Why the metric that matters is time to activation and not terabits of capacity, what changes now that DNS floods have gone from 25.7% to 40% in a single quarter, and the five questions we ask before buying any mitigation.

Networking DDoS Cybersecurity
Read more →
Frontal de varios servidores de rack apilados, con sus bandejas de disco etiquetadas y los pilotos de estado encendidos
9 min read

Piloting a VMware alternative is not migrating

Gartner has put a number on leaving VMware, and the number will be misquoted all autumn: by 2029, 55% of enterprises "will initiate proofs of concept" for alternatives, up from 25% in 2026. Initiate pilots, not migrate. Our argument is that most of those pilots will not help anyone decide anything, because they are built to succeed: install it, boot a VM, close the meeting. The six things an honest pilot has to try to break — starting with the restore, not the migration — the variable no analyst can give you (your renewal date), and the cases where we still tell people to stay.

Virtualization VMware Migration
Read more →
Pasillo frío de un centro de datos con una silla vacía y un carro de consola aparcado junto a un armario abierto
7 min read

The Proxmox CVE your scanner cannot evaluate

CVE-2023-54391 is a 9.8: you get in as root@pam with no password. We queried its record through the NVD API and the GitHub Advisories API, and here is what comes back: NVD publishes no CPE configuration at all and flags the record as Deferred; GitHub returns an empty list of affected packages; and the only range that exists stops at "7.4" while your nodes call themselves 7.4-17. A scanner that decides by version matching has nothing to decide with. Meanwhile a provider published its post mortem: twelve hypervisors mining from 31 August to 17 September, logs wiped and the sentence "we cannot prove it".

Proxmox Vulnerabilities Virtualization
Read more →
Sala de reuniones vacía con mesa larga, sillas y una pizarra de cristal borrada al fondo
5 min read

Your Teams chats are not in your backup

Microsoft 365 Backup protects three workloads: OneDrive, SharePoint and Exchange Online. Teams chat is none of them. And on the limitations page of one of the most widely deployed third-party tools, individual and group chats appear in the list of what is not backed up. Where a Teams message actually lives according to Microsoft's own documentation, why a retention policy preserves but does not restore, the 21 days it takes a deleted message to reach the SubstrateHolds folder, and the six questions we ask of a company's Microsoft 365 backup before touching anything.

Backup Microsoft 365 Continuity
Read more →
Batería de torniquetes de acceso vacíos en el vestíbulo de una estación de metro
9 min read

Ingress NGINX: half of Kubernetes was maintained by two people

The kubernetes/ingress-nginx repository is archived read-only and its last release is dated 19 March: 187 days without a new release. This is not neglect, it is a deliberate retirement, and the reason signed by the Kubernetes Steering Committee and Security Response Committee was not a CVE: the component that publishes half of all cloud native environments to the internet was maintained by "one or two people working in their free time". What to check today with one command, why migrating to Gateway API is not translating YAML, and the five behaviours your routing has that nobody chose.

Kubernetes Containers Infrastructure
Read more →
Armario de comunicaciones con paneles de parcheo y una maraña de cables de red azules
5 min read

The patch for your switch had been out for 97 days

On 21 September CISA added a single CVE to its catalogue of exploited vulnerabilities: a stack-based buffer overflow in the CGI program of Zyxel GS1900 switch firmware, unauthenticated and with command execution. Zyxel published the advisory and the ten fixed firmware builds on 16 June: 97 days earlier. We counted the 30 entries the catalogue has taken in so far this month and the median is 5 days, so the list mixes two different populations. Why "LAN-based" is not a mitigating factor but the attack's requirement, what the small print does not say about models out of support, and why the entry asks for forensic triage before you reflash.

Networking Patching Maintenance
Read more →
Hilera de buzones de correo metálicos alineados junto a un camino de tierra
5 min read

onmicrosoft.com is no longer just an ugly domain: it is the slow lane

On 28 August Microsoft warned (MC1463510) that organisations using only the default domain will face external messaging limits in Teams, with rollout from mid-September. Read on its own it looks like an anti-spam tweak. Read alongside email it is something else: the limit of 100 external recipients per rolling 24 hours for onmicrosoft.com domains finished rolling out to every size band on 1 June 2026, with its own 550 5.7.236 bounce code. The case that catches companies who think they are unaffected, and why fixing it is not buying a domain but changing what people log in with.

Microsoft 365 Exchange Identity
Read more →
Dos portátiles abiertos sobre una mesa de oficina y una mano escribiendo sobre unos papeles
7 min read

The agent pinned the plugin's commit. Git handed it the attacker's branch

Plugin4Shell affects the four most widely used AI coding agents: they clone the plugin repository, check out the pinned commit and never verify they landed on it. We reproduced in the lab, with git 2.43, the git behaviour it rests on: exit code 0, a warning nobody reads, and the attacker's content in the working tree. The same 40-character string gives a different answer depending on which git command reads it, so auditing with git log is no help. And today's defence today depends above all on where the plugin repository is hosted.

IA Cybersecurity DevOps
Read more →
Pasillo de un depósito de archivo con estanterías móviles cerradas y cajas de documentación
8 min read

Project Online shuts down on 30 September: no licence, no export

Microsoft switches Project Online off on 30 September and PWA sites stop being available. But what decides whether you make it in time is not in the announcement: it is in the service description, which requires a live Plan 3 or Plan 5 subscription in the tenant for ANY interaction. Which means the licence you were going to drop to save money during the migration is the one you need in order to export. There is also a second 120-day clock written somewhere else, the PWA is a SharePoint site and not a calendar, and the destination's published limits explicitly exclude your plan.

Microsoft 365 Data SaaS
Read more →
Vista aérea de un corredor de centros de datos: naves industriales bajas y anchas repartidas a lo largo de una autopista
13 min read

Your cloud can lose one zone. AWS just lost a Region

On 15 September AWS wrote on its health dashboard that it cannot restore resources and data hosted "exclusively" in the Bahrain Region or in the mec1-az2 zone in the UAE. That one word separates the customers who lost data from the ones who did not. The perimeter of that redundancy was published all along: S3 is designed to survive the loss of ONE zone, and zones sit within 100 km of each other. What the documentation says, what the contract says, and the four questions we write down before touching anything.

Cloud Disaster recovery Continuity
Read more →
Interior de un servidor de dos zócalos abierto, con los procesadores y dos bancos de módulos de memoria a la vista
8 min read

Patching the kernel means rebooting, and the reboot erases the evidence

CISA added two Linux kernel flaws to its exploited catalogue today, due by Monday. One has sat in your scanner for eleven months rated 3.3 out of 10; the kernel project scores it 7.8 on the very same record. Both entries carry the forensic-triage flag CISA now attaches to two out of every three new additions, and its guidance says not to remediate before collecting evidence. In the kernel, remediating means rebooting. And rebooting erases a good part of what you are asked to keep.

Cybersecurity Linux Patching
Read more →
Cabina de disco montada en rack, con dos filas de bandejas de disco y sus pilotos de actividad
10 min read

Moving to Proxmox and reusing your SAN: the snapshot is what does not travel

The array is paid for, so it stays: the cheapest-looking decision in the project and the one that changes your day-to-day the most. In Proxmox the snapshot is not taken by the hypervisor but by the storage plugin, and on a shared LUN with LVM-thick the documentation says «snapshots are not possible by default…». What fixes that has been labelled a technology preview since 9.0, and the vendor puts it in writing on its own roadmap. The seven real options and the decision tree we are willing to sign.

Proxmox Virtualization Storage
Read more →
Cerro con torres de comunicaciones, antenas parabólicas y radioenlaces contra el cielo
9 min read

MikroTik shipped that port closed: the flaw is theirs, the exception is yours

On 5 September CERT Polska published six RouterOS vulnerabilities; two of them chained give full control of a MikroTik with no authentication, and Shadowserver counted 122,500 devices with SSH reachable from the internet. The vendor's own advisory says its default configuration blocks that port. So the thing to look at is not the CVE: it is who opened the exception, when, and why nobody gave it an expiry date.

Networking Cybersecurity Vulnerabilities
Read more →
Armario de red de pared en una sede pequeña: switch de 16 puertos, router, ONT y cableado desordenado
5 min read

In the branch you did not buy a firewall: you bought an SD-WAN checkbox

Arista is retiring VeloCloud Security VNFs: the Fortinet, Palo Alto or Check Point firewall running inside the Edge loses support on 28 February 2027, and 5.2.x is the last release that carries it. What expires is not a licence, it is the idea that the branch firewall was ever yours: the day branch security became a checkbox inside the transport product, its calendar stopped being yours.

SD-WAN Networking Cybersecurity
Read more →
Interior de un armario de comunicaciones de planta con switch, panel de conexiones y cableado de cobre y fibra
12 min read

Cisco ISE, a perfect 10 with no workaround: your network already decided what to do without it

On 16 September Cisco published a CVSS 10.0 in Identity Services Engine: an authentication bypass in an API, no workaround available, active exploitation and command execution as root. Before arguing about the maintenance window there are two things to look at: ISE's own access.log, because the advisory ships indicators and the recommendation to re-image the node if anything shows up, and the show run on a floor switch, because that is where what your network will do when the policy engine stops answering is already written. The default value of radius-server deadtime is 0.

Cybersecurity Networking Zero Trust
Read more →
Parte trasera de un chasis de servidor con módulos de ventilador y cables de alimentación
10 min read

Acronis Backup: "requires local access" — and that access is what you sell your customers

On 15 September Acronis published a one-sentence advisory: local privilege escalation through insecure file permissions in its backup plugin for cPanel and Plesk, CVSS 7.8, exploited in targeted attacks. A "local" 7.8 is exactly the CVE almost every patching queue pushes to next week. On a machine with a single administrator, that call is defensible. On a server where every customer gets their own system user, the requirement for "local access with low privileges" is not describing a barrier: it is describing your business model.

Cybersecurity Backup Patching
Read more →
Nave de un centro de distribución: estanterías metálicas con palés embalados y pasillo de preparación de pedidos
8 min read

Cutting you off takes 101 minutes; reconnecting you, nine days

Boston Scientific disclosed its incident on a Wednesday. That same day, 101 minutes after the first notice, the platform its customers use to send it orders cut every one of its global connections. It took nine days to give them back. The full timeline sits on a public status page and teaches three things that are in almost no continuity plan: who decides to disconnect you, which degraded channel keeps you alive meanwhile, and why your status system stops telling the truth.

Continuity Disaster recovery Compliance
Read more →
Sala con filas de puestos de trabajo: torres bajo las mesas, monitores apagados, teclados y cables recogidos
10 min read

EDR isolates the device on its own; the rule that brings it back is written beforehand

On 3 September Microsoft added a sentence to the Defender for Endpoint documentation and by the next day it was gone: it warned that automatic isolation fires as FULL isolation and that, with a web proxy, the device might not recover. The two facts it joined are both still published, but in separate sections. What gets isolated on its own and what does not, what "containing" does and what "isolating" does, and the way back point by point.

Cybersecurity EDR/MDR Microsoft 365
Read more →
Varios servidores de 1U apilados en un rack, con cableado de red blanco recogido y pantallas LCD de estado en el frontal
13 min read

Ceph changes cipher: rebooting the virtual machine does not refresh the key

On 9 September Proxmox published the procedure to migrate cephx keys from aes to aes256k. The hard part is not cryptographic: it is knowing what counts as "refreshing a client". The documentation says it in six words — "A guest reboot is not enough" — and the failure does not show up when you run the command, but minutes or days later, when a ticket expires. What has changed since August, the kernel 7.0 gate, and the order we follow.

Ceph Proxmox Storage
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN