Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Sala de cuadros eléctricos de una instalación real: una hilera de armarios de maniobra grises con un técnico midiendo en un interruptor
8 min read

The zone that went down in London was a power panel

On 20 October 2026, at 06:08 UTC, a "power event" inside a single zone — europe-west2-b, one of the three in Google Cloud's London region — took banks, parcel services and listing portals offline for nearly eight hours. No region went down: the power went down inside one zone. And "we are spread across two zones" is not an answer, because a zone name is a distribution label, not a place you can audit: AWS documents that us-east-1a is not the same physical location in two different accounts. We explain why the failure domain that costs the most is the one nobody draws, why Ceph's default hierarchy has had a bucket type called pdu for years, when NOT to raise your failure domain, and the one-row-per-replica map we fill in standing next to the rack.

Bastidores de servidores vacíos, con los montantes y los raíles a la vista y sin ningún equipo montado
7 min read

The control plane fails first, and your plan B needs it

A year ago, on Monday 20 October 2025 at 08:48 Spanish time, a DNS record went empty and took half the internet with it. AWS's own post-event summary leaves an uncomfortable reading for any recovery plan: instances already running stayed healthy. What you could not do was launch another one, update a function, start a container, request temporary credentials, sign in to the console or open a support case. The headline was 2 h 52 min; the last thing AWS declared restored came 28 h 17 min later. We go through the document on local time, the six questions we ask of a continuity plan, and why building it on your own hardware does not get you out of the problem: it brings it home.

Pasillo en penumbra de una sala de servidores, con dos filas de armarios cerrados y sus pilotos encendidos
9 min read

Your VMware provider expires before your contract does

On 8 October 2026 IBM handed "hundreds" of its VMware cloud customers over to another company. None of them signed that deal. The date that governs a hosted VMware cloud is not in your contract: it is in the partner agreement your provider holds with Broadcom. Inside: the January FAQ sentence that describes what just happened nine months in advance, the seven dates with their owner in one table, the two days between 31 March and 2 April 2027, why "VCF 7" does not exist in Broadcom's documentation, and four questions that fit in one email.

Armario de cableado de red con latiguillos de pares trenzados y paneles de parcheo
8 min read

The Azure outage: four doors and the place your plan B lived

On 30 September 2026, a five-hour-forty-five-minute incident on Azure. Of the five services Microsoft lists as impacted, four are the road to your infrastructure and the fifth is Azure VMware Solution. Inside: what the official 7Q30-010 record does and does not say, the real detection clock, why the region figure going round is not in the source, and what happens to your contingency procedure when the thing that fails is the console.

Escritorio doméstico de noche con un monitor, un teclado retroiluminado y un micrófono, iluminado solo por una lámpara
10 min read

$250 to get in, one million euros of damage

On 30 September, in Operation KillSwitch, authorities switched off KillSec: three arrests, eight premises searched, five servers and at least 110 TB of stolen data secured. The figure that was nobody's headline is the price list: joining that business as an affiliate cost $250 and the house kept 12 % of every ransom. Inside: Operation ROTOMA by the Guardia Civil and the Mossos, the two Alicante searches and the early-2025 cyberattack on a Catalan organisation with an estimated damage of close to one million euros; the January 2025 price change and the ESXi locker that deleted snapshots; why the suspect's age measures the barrier to entry rather than sophistication; the four doors they came in through, one of them without even touching your network; our two averages on the 110 TB with the assumptions declared; what a seizure does not delete; and the inventory of checks, run from the outside, that you can close this week.

Nave industrial vacía con el suelo de hormigón, un palé en primer plano y la puerta abierta al fondo
8 min read

Data Act: in January 2027 leaving the cloud becomes free; moving does not

On 12 January 2027 your cloud provider loses the right to charge you for leaving: Article 29(1) of the EU Data Act forbids it. But the big three already dropped that fee back in 2024, so what changes is not the amount — it is that this stops being a conditional credit programme and starts reaching the small providers too. The exit invoice disappears; the cost of leaving stays exactly where it was. The definition of "functional equivalence" speaks of "a minimum level of functionality", binds infrastructure services only, and covers only the features both source and destination offer alike. What you actually get back, what the trade-secret carve-out hides, why multicloud traffic still gets billed, the exact deadlines you can already enforce (two months, thirty days, seven months) and the exit drill that reveals the number no contract contains.

Vista aérea de un corredor de centros de datos: naves industriales bajas y anchas repartidas a lo largo de una autopista
13 min read

Your cloud can lose one zone. AWS just lost a Region

On 15 September AWS wrote on its health dashboard that it cannot restore resources and data hosted "exclusively" in the Bahrain Region or in the mec1-az2 zone in the UAE. That one word separates the customers who lost data from the ones who did not. The perimeter of that redundancy was published all along: S3 is designed to survive the loss of ONE zone, and zones sit within 100 km of each other. What the documentation says, what the contract says, and the four questions we write down before touching anything.

Pasillo estrecho de un centro de datos, con un rack abierto de paneles de parcheo de fibra en primer plano y latiguillos aguamarina y amarillos recogidos en las guías de cable
10 min read

Redundancy does not survive the procedure

On 1 September, a scheduled capacity upgrade sequentially unplugged 100% of the fiber paths serving part of Google Cloud's us-central1-b zone, in thirteen minutes. Just before that, the report describes a correct architecture: physically separated paths, diverse power, tolerance to double and triple failures. A 2003 Berkeley study already explained why none of it helped: operator error is not more frequent than hardware failure, it is just less frequently masked.

Mostrador de pedidos de un almacén con el monitor apagado apartado, una libreta con los pedidos apuntados a mano, albaranes en un pincho y un teléfono descolgado
5 min read

The backup was safe. And it had spent 47 hours inside the same outage

A hosting provider's official status page said two things on the same day: \"there is no risk of data loss\" and \"it is not possible to access backups or migrate affected services to another node\". Both were true, and together they describe the design flaw almost nobody has in their plan: a perfect RPO with an RTO that has no number. We rebuild the clock from the provider's own status page and propose the figure missing from almost every plan: the hour at which you stop waiting.

Sala de archivo con estanterías metálicas llenas de cajas de cartón y una caja sacada a medias del estante
5 min read

Microsoft 365 Archive is coming to retention policies: compliance up, availability down

This autumn, a Purview retention policy will be able to move SharePoint files into the cold tier (roadmap 561208: preview in September, GA in October). Microsoft promises cost, compliance and search; its own documentation adds that archived content is "no longer directly accessible to anyone" and lists the apps that break: Word and PowerPoint online, the mobile apps, the macOS sync client and Office builds not updated since March. A reactivated file cannot be archived again for 120 days.

Cuadro eléctrico industrial abierto en una sala técnica, con embarrado de cobre, magnetotérmicos en carril DIN y cableado de potencia
5 min read

Colocation is no longer negotiated in U: it is negotiated in kW

In the first half of 2026, AI cloud providers signed 420 MW of colocation capacity in Europe. In the same period a year earlier they signed 89. Powered land in the big markets costs 82% more than in 2021. None of that raises your invoice tomorrow, which is exactly why it is worth looking at today: what changes is not the price of a rack unit, it is what your contract actually measures.

Cajón abierto de un fichero de tarjetas de archivo de madera en una sala de oficina, con las fichas de papel apretadas y vistas de canto
5 min read

Some people have not been able to search in Microsoft 365 since Monday. For the SLA, that is not downtime

Incident MO1456424 has been open since Monday 17 August: some Microsoft 365 users get nothing back when they search in SharePoint Online, OneDrive and Outlook. Files still open, mail still flows, and that is why the availability counter does not move. What Microsoft's advisory says word for word, why its SLA definitions of downtime leave exactly this out, and which check you need so that you find out before your users do.

Fachada de un edificio residencial con balcones: en el hosting compartido, tu superficie de ataque incluye a los vecinos que no elegiste
5 min read

cPanel CVE-2026-58048: in shared hosting, your neighbour sets the risk

Any ordinary customer on a cPanel server could execute SQL as database root simply by renaming a database. The headline is the 9.4, but the figure almost nobody reads sits at the end of the vector: SC:H/SI:H/SA:H, CVSS 4.0's way of stating in writing that the damage leaves the vulnerable system. On a shared server, "the subsequent system" has a name: everybody else. What the flaw does, why its 5.6 sibling says it more plainly, what to check this week, and the honest question of whether you should flee shared hosting (not always).

El 31 de octubre de 2026 se acaba el modelo de licencia de VMware incluida en los nodos de Azure VMware Solution: a partir del 1 de noviembre hay que aportar una suscripción portable de VMware Cloud Foundation comprada a Broadcom
5 min read

Plan B expires on 31 October: VMware with the licence included is ending in the cloud

On 31 October 2026 the Azure VMware Solution model in which the licence came bundled with the node comes to an end: from 1 November you must bring a VMware Cloud Foundation key bought directly from Broadcom. On Google Cloud VMware Engine it already happened on 1 November 2025. Eighty-nine days to go. For two years, "I will just lift my vSphere into the hyperscaler" has been the favourite plan B for not deciding; it was an extension, and extensions expire. The maths you can finish this week, and when staying put is the right call.

Por primera vez el 46% de las cargas de IT corporativa vive en instalaciones de terceros frente al 44% en centros de datos propios, según la encuesta de Uptime Institute de 2026
8 min read

Half of corporate IT now lives off premises. That does not mean it went to the cloud

On 28 July 2026 Uptime Institute published the figure that went around the industry: for the first time, third-party facilities (46%) overtake companies' own data centres (44%). The number is real. The "the cloud won" reading is not: that 46% puts colocation and SaaS in the same box, and they are opposite decisions. And the most interesting part of the report is not in the headline but in the remaining 10%, and in what is happening to kilowatts per rack.

La nueva retención por último acceso de Microsoft Purview borra ficheros de SharePoint y OneDrive y deja 93 días de papelera como único margen
7 min read

What nobody opens gets deleted: Purview, last accessed, and the 93 days to notice

By mid-August 2026 Microsoft finishes rolling out a Purview retention rule that deletes SharePoint and OneDrive files nobody has opened for a given period, justified on the grounds that Copilot will answer better. It deletes nothing on its own: somebody has to configure it. But it is the first deletion trigger that measures not a property of the document but the absence of human activity, and the file nobody opens in three years may well be the one you need in year four. What is actually shipping, the 93 recycle-bin days that are your only margin, why version history will not save you, and what we would do before touching that button.

Más de 700 organizaciones afectadas por el robo de tokens OAuth de una aplicación conectada, sin ninguna contraseña robada
5 min read

The token that never asks for MFA: connected apps in your Microsoft 365

More than 700 organisations were potentially exposed in August 2025 without a single password being stolen: the attacker took the OAuth tokens of an application they had connected themselves. On 13 July 2026 Microsoft published the map of a full year of that technique: two attack chains and not one suspicious sign-in. The part that fails is not the login, it is consent: how to inventory the applications connected to your tenant with two Graph queries, what each button actually switches off, and why changing the consent setting revokes nothing already granted.

Caída de Google Cloud en europe-west4-a por fallo de energía y refrigeración en el datacenter
5 min read

Three milliseconds and 44 degrees: the cloud outage that had nothing to do with software

On 15 July 2026 a three-millisecond voltage dip on the utility feed took three services in a Google Cloud zone in the Netherlands out of service for almost fifteen hours. No CVE, no botched deployment, no BGP route: an electrical transient, a backup system that failed to pick up the load, a chiller controller that dropped offline, and a data hall at 44°C. What exactly failed according to the official incident report, why redundancy on paper is not always redundancy, what it means that a zone is not a building, and the seven questions worth asking any datacenter — including your own — before it happens.

La subida de precios de Microsoft 365 del 1 de julio de 2026, con la cuenta real por usuario
5 min read

Microsoft 365 has already gone up: the percentage that scares you is not the one that costs you money

On 1 July the price increase for Microsoft 365 commercial suites came into force. Through June everyone repeated the same advice —renew before the 1st and you freeze your price— and that advice expired four weeks ago. The official before-and-after price table, the math that actually matters (per-user increase multiplied by headcount and by twelve), why the price that does NOT change is the most informative figure in the announcement, which capabilities land in each suite, and the five things we would do before your renewal.

Subida del precio de la memoria DRAM y NAND en 2026 por la demanda de centros de datos de IA
5 min read

AI took the RAM: what to do with your 2026 hardware plan

TrendForce forecast second-quarter contract price rises of 58% to 63% for conventional DRAM and 70% to 75% for NAND. In one quarter, with nothing inside your company to explain it. Why the big cloud providers are hedged by multi-year contracts and you are not, how this lands in your refresh plan, what to check before signing a purchase order, and how long it lasts — with dates.

  • 1
  • 2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
everyWAN
everyWAN