Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Estanterías de un depósito de archivo con legajos y cajas de documentos etiquetados
9 min read

"Read-only" does not exist: GitLab scores 10.0 on a flaw that can only read

CVE-2026-85706 lets a stranger read files off a self-hosted GitLab server. It writes nothing, and it still carries the maximum score. The explanation is not in the headline: it is in the vector the vendor itself signed off, with a changed scope and high integrity impact. We go through what the vector says, why CISA gave it three days and a forensic triage flag, and how to answer the one question the patch does not: were we read?

Cybersecurity GitLab Vulnerabilities
Read more →
Rack de una pequeña oficina con panel de parcheo, latiguillos y equipos de red apilados
9 min read

The AI agent will not show up in your log: whoever lent it the token will

Connecting an assistant to SharePoint or the ERP is not an integration decision, it is a delegation decision. The Model Context Protocol specification, revision 2026-07-28, forbids forwarding somebody else's token in capital letters, and spells out why: the destination system's logs will show a different identity from the one that made the request. We go through the spec, the permission fallback that asks for everything on offer, the CVE in the official SDK, and the seven questions we ask before connecting anything.

AI Automation Identity
Read more →
Sala llena de puestos de trabajo vacíos con los monitores apagados
9 min read

The RDS failure is listed as "mitigated". The mitigation is turning the machine off and on

On 11 September Microsoft opened an issue for Remote Desktop Services hanging after the September update. Eight hours later it marked it as "Mitigated". We went and read the mitigation: stop the virtual machine and start it again. The affected-platform list on that same page is not the three Windows Server versions in the headlines either: it runs to six. And the package you want to uninstall is the one closing a 9.8 unauthenticated hole in the very same service.

Workplace Windows Patching
Read more →
Ordenador abierto sobre el banco de trabajo de un servicio de reparación informática
10 min read

Remote support: the file runs on the technician's machine

On 11 September, CISA added a ConnectWise ScreenConnect advisory to its catalogue of exploited vulnerabilities. The detail almost nobody highlights comes from the vendor itself: "ScreenConnect servers are not impacted". The machine that ends up running the file is the one support is given from. Three days earlier, N-able N-central had entered the same list with a 10.0. We counted the whole catalogue: fifteen entries in 2026 for software whose job is governing other people's computers. Windows, thirteen.

Maintenance RMM Cybersecurity
Read more →
Reloj de pared de esfera oscura en una pared gris de oficina
8 min read

Cyber Resilience Act: 24 hours to report, and the clock does not start with the CVE

Article 14 of the Cyber Resilience Act starts to apply today: 24 hours for the first warning about an actively exploited vulnerability. Two details almost nobody is covering: it is the only article the regulation stretches backwards, reaching what you have already sold, and the deadline runs not from the CVE being published but from the moment you "become aware". That turns a legal obligation into an instrumentation problem: telemetry, a watched mailbox and who declares the time.

Regulation Compliance Cybersecurity
Read more →
Panel de parcheo a oscuras con cuatro conectores RJ45 desconectados
10 min read

Cisco FMC: patching closes the door, but nobody gives you back your network blueprint

On 9 September, Cisco Talos confirmed active exploitation of two flaws in Secure Firewall Management Center, and counted three separate attacker clusters inside the same box. One of them dropped two scripts to harvest the configurations of the managed firewalls. That is the part almost nobody is discussing: credentials rotate, a domain gets restored, and your perimeter configuration does not rotate. It is a description of your network, and it stays valid after the patch.

Cybersecurity Vulnerabilities Networking
Read more →
Fila de puestos de trabajo vacíos en una oficina
10 min read

Entra ID retires memberOf on 3 November: after that date, membership stops being recalculated

Message centre post MC1448379, published on 5 August, has been read as a deadline. Read it the other way round: if you run a memberOf rule in production, you already have the problem it describes, and the preview documentation says so in a paragraph almost nobody reads. What happens on 3 November is not an outage or an error: memberships stay "in their last known state". That is where licences, Conditional Access and Teams membership hang from.

Identity Microsoft 365 Licensing
Read more →
Sala de celdas de media tensión de una subestación eléctrica
12 min read

"Resilience" is in the title of Spain's data centre decree. It is not in the articles

The consultation window closed today at 17:00. The draft is called "energy and environmental sustainability, resilience and digital sovereignty requirements applicable to data centres", and its article 5 carries "resilience" in the heading. Read in full, it creates not a single resilience requirement: it defers them to whatever regulation already applies to you. We think that is sound legislative technique and bad news for anyone hoping somebody would hand them availability. It does not bind you — the threshold is 1 MW of grid access capacity — but it will reach you anyway, through the contract of whoever hosts you.

Regulation Datacenter Colocation
Read more →
Pasillo de un centro de datos con dos filas de armarios de rack idénticos
9 min read

The cluster picks a node by counting guests: anti-affinity in Proxmox VE 9 and the rule nobody declares

When a node goes down, the Proxmox VE scheduler decides where your HA-managed machines come back up. On a freshly installed cluster it does that by counting active guests: it has no idea that 101 is the second leg of 100. Proxmox VE 9.0 brought affinity rules so you can tell it, with an asymmetry worth knowing — the rule that pins a guest to a node is a preference, the rule that keeps two guests apart is an order — and an arithmetic that decides whether your VM comes back degraded or does not come back at all.

Proxmox High availability Virtualization
Read more →
Parte trasera de una librería de cintas con las unidades LTO y su cableado de fibra
5 min read

Broadcom pulls the VDDK: the first thing that breaks is not your migration, it is your backup

In late August the download pages for the Virtual Disk Development Kit started returning a 404, with no announcement and no deprecation notice. The coverage has read it as "leaving VMware just got harder", and that is half true: it depends where you are going, because Proxmox VE's ESXi importer does not even use it. What almost nobody has looked at is Broadcom's exact wording — "no longer available for use or download" — or the place where that library has been working for twenty years without anyone looking at it: inside your backup.

VMware Backup Virtualization
Read more →
Armarios de rack vacíos recién instalados en el pasillo de una oficina
9 min read

VMware to Proxmox: the disk arrives intact, Windows will not boot, and the mistake was made two weeks earlier

The Proxmox VE import wizard copies the machine off ESXi without a hitch. Then Windows will not boot, and it is not the wizard's fault: the official documentation says that to boot from VirtIO SCSI, Windows "needs to see a disk requiring the driver before". That before is the problem, because the only place you can do it is the machine you have already shut down. The official way out works, but it is a per-machine, sequential procedure that lives inside the maintenance window. The alternative is not to speed it up: it is to move it to another date.

Virtualization Migration VMware
Read more →
Armario de comunicaciones de pared con switch y cables de red
10 min read

Windows DNS, an unauthenticated 9.8: what turns a bug into a worm is not the bug, it's your network

On 8 September Microsoft shipped the largest batch of patches in its history. Dustin Childs, of the Zero Day Initiative, counts twenty that could be classified as wormable, spread across thirteen components. Those thirteen are not one list: they are two. Seven of those CVEs sit in services your domain requires every machine to reach — DNS, Netlogon, Active Directory, DHCP — and eleven sit in roles Windows does not install on its own. The first half is managed with patching order; the second, by uninstalling. And hardly anyone knows which of the two they have switched on.

Cybersecurity Networking Windows
Read more →
Cajas de archivo numeradas en estanterías de un depósito documental
9 min read

One checkbox will protect a whole workload in Microsoft 365 Backup. What it bills is not what you see in the usage report

Full Workload Backup reaches general availability from mid-September: one policy per workload protecting every SharePoint site, or every OneDrive account, or every mailbox, including the ones created later. List price is $0.15 per GB per month, applied to a base that adds in the second-stage recycle bin and online archives. Microsoft warns that its own usage report includes neither, "and is thus incomplete", and offers a calculator that does ask for them. The problem is that the report is what everybody looks at.

Backup Microsoft 365 Costs
Read more →
Sala de control con un muro de pantallas de monitorización y varias personas mirándolo de pie
10 min read

AI now finds zero-days on its own. Your problem is the 43 days that come after

On 4 September OpenAI launched GPT-6 Astra and declared it the first model it deploys reaching the "Critical" cybersecurity capability level of its preparedness framework. Almost all the coverage went after that half. The two numbers that decide what happens to you predate Astra and neither is about finding flaws: mean time to exploit is minus seven days according to M-Trends 2026, and the median to fully remediate a KEV-listed vulnerability is 43 days according to Verizon's DBIR. The bottleneck was never finding.

Patching AI Cybersecurity
Read more →
Técnico agachado con un portátil trabajando en la parte trasera de un rack de servidores
5 min read

REPLICATION was never a read-only privilege: PostgreSQL closed a twelve-year dlopen()

On 13 August PostgreSQL shipped 18.6, 17.11, 16.15, 15.19 and 14.24. Among the CVEs they close there is one that is not about buffer overflows: any account holding the REPLICATION attribute could name as its logical decoding plugin any file visible to the system, and the server would load it and run its code as the operating system user. The patch adds a whitelist with two entries by default: if your change data capture uses decoderbufs or wal2json, it stops your replication until somebody edits postgresql.conf.

PostgreSQL Zero Trust Data
Read more →
Filas de bandejas de disco SAS en el frontal de varios servidores de almacenamiento montados en rack
9 min read

Squid gained 42 days and Tentacle lost 170: a single commit moved Ceph's end of life

On 5 August, a commit in the Ceph documentation moved the two dates that govern the calendar of anyone running distributed storage in production: Squid went from 19 September to 31 October, and Tentacle from 18 November 2027 to 1 June 2027. The extension is visible in the chart; the 170-day cut to the version everyone is migrating to we have not seen discussed anywhere. What it means that the field is called target_eol, and why Tentacle lives 560 days where Squid lived 765.

Ceph Proxmox Storage
Read more →
Pasillo estrecho de un centro de datos, con un rack abierto de paneles de parcheo de fibra en primer plano y latiguillos aguamarina y amarillos recogidos en las guías de cable
10 min read

Redundancy does not survive the procedure

On 1 September, a scheduled capacity upgrade sequentially unplugged 100% of the fiber paths serving part of Google Cloud's us-central1-b zone, in thirteen minutes. Just before that, the report describes a correct architecture: physically separated paths, diverse power, tolerance to double and triple failures. A 2003 Berkeley study already explained why none of it helped: operator error is not more frequent than hardware failure, it is just less frequently masked.

Disaster recovery Continuity Datacenter
Read more →
Armario de red mural abierto en el pasillo de una oficina, con anillas pasahilos y cables recogidos, y un extintor apoyado en la pared al fondo
7 min read

July's patch is September's vulnerable build

SonicWall closed the SMA 1000 zero-day pair in build 12.4.3-03453 on 14 July. The 1 September advisory lists 12.4.3-03453 and earlier as affected: anyone who met the three-day KEV deadline landed on exactly the build that is back in the catalog 49 days later, with the same shape of flaw. When an appliance repeats the shape of the flaw, the question stops being whether it is patched and becomes how far that box reaches.

SD-WAN Networking Vulnerabilities
Read more →
Servidor de dos alturas con la tapa quitada sobre una estantería metálica, en el trastero de una oficina, con cartones apoyados en la pared
5 min read

Artifactory's "medium" CVE hit the catalog before the critical one

CISA confirmed exploitation of a 5.3 JFrog Artifactory flaw on 27 August; of the 9.8 that lets anyone forge admin tokens, on 2 September. Six days apart, and in the opposite order to the scores. Look at the full vector of the "medium" one and you see why: two of the three impact dimensions are zero and the one left at maximum is integrity. In an artifact repository, integrity is exactly what you are buying.

Cybersecurity Containers Vulnerabilities
Read more →
Puesto de monitorización vacío de noche, con los dos monitores apagados, unos auriculares sobre la mesa y la silla apartada
9 min read

The agent says SECURE and your console has received nothing for days

At DEF CON 34, Akamai showed how to turn a commercial EDR into the attacker's hiding place. The least-reported part is the ending: one line in the hosts file cuts off all telemetry while the agent still shows "SECURE". The signal you watch is controlled by the endpoint; the only one an attacker cannot fabricate is silence in your console. And almost nobody alerts on it.

EDR/MDR Cybersecurity Monitoring
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN