Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis

Cybersecurity

IT Trends

Filter by:

Pulsador de parada de emergencia rojo sobre carcasa amarilla, en el panel de control de una máquina industrial

19 Oct 2026 9 min read

"One in ten outages is now AI": that figure measures something else

The 10.7% going round this week comes from a serious report — 109,000 status-page incidents, 390 companies, 2018 to 2026 — but it does not say AI causes one outage in ten: it says one published outage in ten was published by an AI company. The same report holds another number that does change a decision: a cascade triggered by a third party takes a median of 247 minutes to resolve, against 96 for an internal configuration failure. Two and a half times, because the fix is not in your hands. We go through what each figure in this week's three studies actually measures, why the 61% of failures that passed internal testing is not an AI problem but a staging one, and the switch-off test.

AI Automation Continuity

Escritorio con un portátil de pantalla apagada, una libreta abierta con anotaciones a mano y una taza de café

12 Oct 2026 9 min read

The SDK behind your AI agents has six new advisories. Your scanner says zero

Between 28 September and 5 October 2026, the Model Context Protocol Python SDK published six security advisories, three of them scored 7.5. As of 12 October none of the six appears in OSV, nor in the global GitHub database that fires Dependabot, nor in the PyPI API that pip-audit queries by default; the only one carrying a CVE is not in the NVD either. We checked it with two public API calls you can repeat in a minute. And two of the six state in writing that upgrading, on its own, fixes nothing.

AI Automation Vulnerabilities

Disco duro externo conectado a un portátil sobre una mesa de despacho

5 Oct 2026 7 min read

The clone doesn't carry the .git/config. The ZIP does

Four CVEs published in August and September 2026 describe the same sequence: you open a folder with an AI coding agent, the agent calls git to work out where it is, and that folder's local configuration runs a program with your credentials before anybody asks whether you trust it. Inside: what git's documentation says about core.fsmonitor, why an ordinary clone does not work as a delivery route, why the ownership check git does have is disarmed by the most ordinary gesture there is, and the trick that hides the key from your own grep.

AI Cybersecurity DevOps

Armario de comunicaciones con cortafuegos y panel de parcheo en una sala técnica

1 Oct 2026 10 min read

The certificate ACME doesn't renew is the one that kills your VPN

Do the arithmetic: 15 March 2026, the day the 200-day ceiling for public TLS certificates came into force, plus 200 days. That lands on 1 October. Today. The first certificates issued under the new rule start expiring this week, and this stops being a 2029 problem. The CA/Browser Forum schedule (ballot SC-081v3, 25 issuers in favour and none against) drops to 100 days on 15 March 2027 and to 47 in 2029, with domain validation down to 10 days: about 37 validations a year per name. The 47 is neither arbitrary nor round: it is 31 + 15 + 1, sized so a monthly renewal fits with room for one retry. But the web server has renewed itself for years; the problem is the firewall portal, the VPN gateway and the RADIUS box doing EAP-TLS. And here is the uncomfortable conclusion: ACME validates from the outside, and those devices are not published on the Internet precisely because you segmented properly. The better your network, the worse your position. What path is left, what new risk comes from giving a script write access to your DNS, why half the list should not be in the public chain at all, and the four columns that decide by themselves what to do with each row.

TLS Networking Cybersecurity

Oficina diáfana vacía con mesas de trabajo al fondo y una zona de sofás en primer plano

27 Sep 2026 10 min read

AI speeds up what you write, not what you can deploy

Of the two things DORA said about AI in 2024, in 2025 it observed the opposite for one — delivery throughput flipped sign — and exactly the same for the other, which is the one that costs money: more AI still comes with less delivery stability. Two consecutive reports, same sign. With the METR trial that measured a 19% slowdown where participants perceived a 20% improvement — and the caveats its own authors published afterwards, including a second trial with intervals that cross zero — what the 2026 ROI report assumes in money (one point of change failure rate, $344,000) and the four things that have to take more flow before you buy anything: an environment that looks like production, small batches, a timed rollback and telemetry by symptom.

AI Automation Data

Dos portátiles abiertos sobre una mesa de oficina y una mano escribiendo sobre unos papeles

19 Sep 2026 7 min read

The agent pinned the plugin's commit. Git handed it the attacker's branch

Plugin4Shell affects the four most widely used AI coding agents: they clone the plugin repository, check out the pinned commit and never verify they landed on it. We reproduced in the lab, with git 2.43, the git behaviour it rests on: exit code 0, a warning nobody reads, and the attacker's content in the working tree. The same 40-character string gives a different answer depending on which git command reads it, so auditing with git log is no help. And today's defence today depends above all on where the plugin repository is hosted.

IA Cybersecurity DevOps

Sala con filas de puestos de trabajo: torres bajo las mesas, monitores apagados, teclados y cables recogidos

15 Sep 2026 10 min read

EDR isolates the device on its own; the rule that brings it back is written beforehand

On 3 September Microsoft added a sentence to the Defender for Endpoint documentation and by the next day it was gone: it warned that automatic isolation fires as FULL isolation and that, with a web proxy, the device might not recover. The two facts it joined are both still published, but in separate sections. What gets isolated on its own and what does not, what "containing" does and what "isolating" does, and the way back point by point.

Cybersecurity EDR/MDR Microsoft 365

Rack de una pequeña oficina con panel de parcheo, latiguillos y equipos de red apilados

12 Sep 2026 9 min read

The AI agent will not show up in your log: whoever lent it the token will

Connecting an assistant to SharePoint or the ERP is not an integration decision, it is a delegation decision. The Model Context Protocol specification, revision 2026-07-28, forbids forwarding somebody else's token in capital letters, and spells out why: the destination system's logs will show a different identity from the one that made the request. We go through the spec, the permission fallback that asks for everything on offer, the CVE in the official SDK, and the seven questions we ask before connecting anything.

AI Automation Identity

Cuarto de instalaciones de una oficina con un ordenador de sobremesa y un conmutador de red pequeño en una estantería metálica, junto a una caja de cables y material de limpieza

6 Sep 2026 9 min read

Kestra, 10 out of 10: the flaw that does not need to face the internet

On 2 September 2026 CISA added seven exploited flaws to the KEV catalog. Three were perimeter appliances; another three are services your own team stood up (JFrog Artifactory, Kestra and LiteLLM), and the seventh, Starlette, nobody installed at all. The Kestra one scores 10.0 and opens because an authentication filter uses endsWith instead of an exact comparison. And the advisory says internet exposure is not required: reaching the port from inside is enough. What that changes in your patching queue.

Cybersecurity Automation AI

Sala de reuniones vacía con seis portátiles cerrados sobre la mesa y cargadores enredados

31 Aug 2026 5 min read

The warning came from Anthropic, not from your antivirus

On 30 August it emerged that Anthropic was warning Claude users that an infostealer had taken their browser session. Coverage treated it as an AI story. If somebody at your company got that email, it is something else: it is an infection report for a machine in your estate, signed by a supplier that is not yours and spotted through billing. We go through why MFA never even enters the picture, the five critical events that do cut a session in Microsoft Entra and the one missing from that list, the real arithmetic of revocation (1 hour, 28 hours, up to 15 minutes of latency, up to a day for a group change) and where the purpose-built defence against token theft stands today: in preview precisely in the browser, which is where this happened.

AI Cybersecurity Identity

Puesto de trabajo vacío en una oficina técnica de noche, con dos monitores apagados y un rack al fondo

31 Aug 2026 5 min read

Defender switches off the investigate button: AIR can no longer be triggered by hand

Tomorrow, 1 September 2026, Microsoft Defender's automated investigation and response stops running as a separate experience and can no longer be triggered by hand. The official documentation says so in a two-paragraph box, and message MC1411577 went up on 2 July: sixty-one days of notice. We go through what actually breaks (the scripts calling startInvestigation), why "run a full scan" does not answer the same question, who this does not affect at all, and the seven-day clock in the Action center you should look at today.

EDR/MDR Cybersecurity Microsoft 365

Armario metálico de llaves abierto en la pared de una sala de máquinas, con llaves colgadas de sus ganchos y varios ganchos vacíos

23 Aug 2026 5 min read

88% of leaked AWS keys still work

On 10 August Truffle Security re-tested 10,616 AWS credential pairs that had surfaced publicly since August 2022 and 88% still authenticated. Of those traceable to a company, 768 out of 817 granted full control of the account. The median age is 1,831 days and the oldest predates IAM itself. Separately from that tally, Hugging Face holds another 8,482 live keys across 3,394 public datasets.

Cybersecurity AI Identity

Panel de parcheo de fibra con latiguillos etiquetados a mano: la documentación de red que deja de coincidir con la realidad

6 Aug 2026 7 min read

Your network spreadsheet lies: how we build a source of truth with NetBox

Documenting a network is not scanning it. NetBox's own documentation says so plainly: it represents the desired state of a network rather than its operational state, and it discourages automated import of live network state. That is the criterion almost nobody applies. What NetBox is and is not, the three-question test for whether your inventory is worth anything, what we document and what we deliberately do not, and when you do not need any of this.

Networks NetBox Documentation

CVE-2026-9198 en Langflow entra en el catálogo KEV de CISA el 4 de agosto de 2026: la capa de IA y automatización autoalojada (Langflow, n8n, Open WebUI) tratada como producción

5 Aug 2026 5 min read

The AI pilot nobody switched off is already production

On 4 August, CISA added a 9.8 in Langflow to its exploited-vulnerabilities catalogue: one endpoint that hands superuser tokens to anyone who reaches the port, chained with another that runs whatever code you send it. The patch had been out for six weeks. It is not an isolated case: in Open WebUI the ENABLE_CODE_EXECUTION=false switch turned nothing off, and in n8n anyone who could edit a workflow could run commands on the host. Three products, the same starting assumption. What we do with the AI and automation layer, and when we recommend not self-hosting it at all.

AI Automation Cybersecurity

El AI Act ya aplica desde el 2 de agosto de 2026: qué obligaciones entraron de verdad, qué aplazó el Ómnibus digital sobre IA y el checklist de inventario de everyWAN

5 Aug 2026 5 min read

The AI Act already applies to you — and not for the reason the headlines gave

On 2 August the bulk of the EU AI Act became applicable. Six days earlier, the Digital Omnibus on AI (Regulation EU 2026/1744, in force since 27 July) pushed high-risk obligations to December 2027 and August 2028. What does apply from 2 August is Article 50 — transparency — with fines of up to €15M or 3% (the lower amount for SMEs) and a date almost nobody wrote down: 2 December 2026. What actually changed, where Article 25 really bites, and the inventory checklist we run on a Microsoft 365 tenant.

AI Compliance Regulation

CVE-2026-63077, un fallo de CVSS 9,8 sin autenticación en todas las versiones de JetBrains TeamCity On-Premises, pone el foco en el servidor de CI/CD como sistema crítico

3 Aug 2026 8 min read

Your CI/CD holds the keys to production. And you treat it as a developer tool

On 27 July 2026 JetBrains published CVE-2026-63077: an unauthenticated 9.8 affecting EVERY version of TeamCity On-Premises and allowing operating system commands to be run on the build server. There is no known exploitation. The two previous times TeamCity had a flaw like this ended with Russia's SVR inside technology companies and with BianLian operators creating users on build servers. The underlying problem is not TeamCity: it is that the machine which deploys to production is in almost nobody's critical systems inventory.

CI/CD DevOps Cybersecurity

EWS en Exchange Online: la fecha límite real para escribir la lista de aplicaciones permitidas es el 31 de agosto de 2026

1 Aug 2026 5 min read

EWS shuts down in October, but your deadline is 31 August

On 1 October Exchange Online starts disabling EWS, and on 1 April 2027 it disables it for good, with no re-enablement. But one detail turns the calendar on its head: from October, leaving EWSEnabled set to True with an empty allowed-application list starts to mean "block everything", and if you do not write that list before the end of August, in September Microsoft writes it for you based on whatever it saw running. What to look at in the usage report, the exact commands, why that automatic list fails both by omission and by excess, and the gaps Graph still does not cover according to Microsoft's own roadmap.

Exchange Microsoft Migration

Antenas de radiotelescopio al anochecer: la adolescencia tecnológica de la humanidad según el ensayo de Dario Amodei

30 Jul 2026 12 min read

The adolescence of technology: reading Dario Amodei's essay with our hands in the mud

In January 2026 the CEO of Anthropic published a twenty-two-thousand-word essay on the five risks of powerful AI and on whether we are ready for them. His answer is no. We read the whole thing from inside a company that deploys automation and AI on real infrastructure: the five risks laid out, an honest scorecard, the four points where we do not buy his argument — including one almost nobody has reported correctly — and what a company that does not build models should be doing today.

AI Society AI Ethics

Una IA autónoma automatiza la post-explotación en un ataque real; la respuesta es detección 24/7

25 Jul 2026 5 min read

The tireless intern now works for the other side: an autonomous AI is already automating real attacks

In an intrusion at Thailand's Ministry of Finance, the attacker left an open-source AI agent running unattended to automate the boring part of the attack: enumerate, escalate privileges, find the next step. It broke nothing new —it got in through default credentials and unpatched 2021 CVEs— but it did the dirty work faster and without rest. What actually changes is speed, and the only answer to speed is 24/7 detection and response.

Cybersecurity IA EDR/MDR

40% canceled by 2027 (Gartner)

21 Jul 2026 5 min read

AI agents in the enterprise: Gartner expects over 40% of projects to be canceled before 2028 (and it won't be the AI's fault)

Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027, and MIT measured that 95% of pilots show no return. Why AI agent projects really die, and the six questions we ask before starting one.

AI Automation Technology

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

I agree to receive commercial communications from MINORISA DE SISTEMAS INFORMÁTICOS Y DE GESTIÓN, S.L., in accordance with the privacy policy, which I have read and accept without reservations, which contains additional information about the processing of my data and about the exercise of my rights of access, rectification, restriction, erasure, objection and portability.

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026

Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel

LOGIN REGISTER

Language
- ES
- CAT
- EN