Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Antenas de telefonía móvil instaladas sobre la azotea de un edificio de ladrillo, con los mástiles y el cableado a la vista
9 min read

Two carriers on the invoice, one core on the network

On 21 October 2026 Orange went nearly ten hours without mobile service across France after a failure in its mobile core; fibre, by contrast, held up. If the plan B for your eight sites is a SIM card, that day you did not have eight backups: you had one. We explain why physical route diversity does not cover this failure, how to read each router's PLMN code in ten minutes to find out which network it is really registered on — and what that code does NOT answer — why Spain has fewer independent cores than the invoices suggest (Orange and Yoigo are one group on a single Ericsson core; Digi has its own core but shares radio with Movistar), and why failover that watches whether the link is "up" never notices a core outage.

Networking SD-WAN Continuity
Read more →
Sala de cuadros eléctricos de una instalación real: una hilera de armarios de maniobra grises con un técnico midiendo en un interruptor
8 min read

The zone that went down in London was a power panel

On 20 October 2026, at 06:08 UTC, a "power event" inside a single zone — europe-west2-b, one of the three in Google Cloud's London region — took banks, parcel services and listing portals offline for nearly eight hours. No region went down: the power went down inside one zone. And "we are spread across two zones" is not an answer, because a zone name is a distribution label, not a place you can audit: AWS documents that us-east-1a is not the same physical location in two different accounts. We explain why the failure domain that costs the most is the one nobody draws, why Ceph's default hierarchy has had a bucket type called pdu for years, when NOT to raise your failure domain, and the one-row-per-replica map we fill in standing next to the rack.

Cloud Energy Ceph
Read more →
Interior de una librería de cintas: filas de ranuras y una unidad de cinta extraída sobre su guía
9 min read

Ransomware: recovering fast is not evicting the attacker

Of the organisations hit by more than one ransomware attack in the last twelve months, 30% suffered them on the same day and another 29% within the same week. That does not measure long-term recidivism: it measures access that was never actually closed. 87% of attacks went after the identity system — Active Directory, Entra ID, Okta — yet recovery plans still restore machines. We go through what each figure in the Semperis report actually measures, the Spanish data point that cuts against that reading, the recovery order Microsoft publishes and almost nobody has written down, and the eight conditions we require before calling an incident closed.

Ransomware Disaster recovery Identity
Read more →
Parte trasera de un servidor montado en bastidor, con el haz de cables de red y de consola conectados y las etiquetas de aviso del fabricante
8 min read

Exchange fails 24 hours after the October patch, and the mitigation undoes the patch

The Windows Server updates of 13 October 2026 introduced a cap of 512 saved contexts in the RPC Endpoint Mapper. Exchange burns through them at roughly 23.7 an hour, so the server holds for a little over twenty hours and falls over the next day, when nobody connects it to the patch any more. Microsoft's mitigation is a registry value that multiplies the cap by 128 and, in doing so, undoes most of the hardening that cap was there to provide. What you will see in the event log, what to do this week, and why a failure that takes twenty-one hours to show up is never caught by a two-hour change window.

Exchange Microsoft 365 Patching
Read more →
Bastidores de servidores vacíos, con los montantes y los raíles a la vista y sin ningún equipo montado
7 min read

The control plane fails first, and your plan B needs it

A year ago, on Monday 20 October 2025 at 08:48 Spanish time, a DNS record went empty and took half the internet with it. AWS's own post-event summary leaves an uncomfortable reading for any recovery plan: instances already running stayed healthy. What you could not do was launch another one, update a function, start a container, request temporary credentials, sign in to the console or open a support case. The headline was 2 h 52 min; the last thing AWS declared restored came 28 h 17 min later. We go through the document on local time, the six questions we ask of a continuity plan, and why building it on your own hardware does not get you out of the problem: it brings it home.

Cloud Disaster Recovery Infrastructure
Read more →
Pulsador de parada de emergencia rojo sobre carcasa amarilla, en el panel de control de una máquina industrial
9 min read

"One in ten outages is now AI": that figure measures something else

The 10.7% going round this week comes from a serious report — 109,000 status-page incidents, 390 companies, 2018 to 2026 — but it does not say AI causes one outage in ten: it says one published outage in ten was published by an AI company. The same report holds another number that does change a decision: a cascade triggered by a third party takes a median of 247 minutes to resolve, against 96 for an internal configuration failure. Two and a half times, because the fix is not in your hands. We go through what each figure in this week's three studies actually measures, why the 61% of failures that passed internal testing is not an AI problem but a staging one, and the switch-off test.

AI Automation Continuity
Read more →
Registrador de banda de papel abierto, con su rollo milimetrado y la plumilla que dibuja una línea continua
6 min read

The 99.9% does not tell you how long the outage lasts: what you are really signing in an SLA

Three nines sound like a serious figure until you do the division: 99.9% a year is 8.76 hours, and nothing in that number stops all eight of them from landing back to back on a Tuesday. The same 99.9% measured monthly is 43.8 minutes and it does not roll over: the yearly total is identical, but the ceiling on a single outage drops from 8.76 hours to 43.8 minutes. We do the exact arithmetic for all four levels of nines, explain why the percentage hides the only thing your business actually feels — how long ONE outage lasts — what usually falls outside the count, and the three questions to ask before signing. With the conflict of interest declared: we sign SLAs too.

Consulting Continuity High availability
Read more →
Técnico de espaldas, agachado delante de un rack abierto, con los cables de red a la altura de la cara
10 min read

Testing the live system would have prevented 26 outages out of 40; more redundancy, 9

In 2003, three Berkeley researchers went through the outage reports of three large internet services and asked what would have prevented each one. For one of them, with forty outages analysed, the answer was uncomfortable: testing the running system would have prevented 26; adding redundancy, 9. Twenty-three years on we still buy the second and skip the first. What the study actually says, why Chaos Monkey breaks things between nine and three and ships switched off, and what a rehearsal with a hypothesis, a blast radius and a stop condition looks like in a company that is not Netflix.

Continuity Disaster recovery Infrastructure
Read more →
Mesas de una oficina vacía con una silla, archivadores y un monitor apagado
8 min read

The workaround was to turn off Global Secure Access: the advice your own policy blocks

On 13 October, after almost eleven hours of degradation, the workaround on offer was to turn off Global Secure Access. It arrived eleven minutes before the incident was declared over, and in tenants configured the way the documentation recommends that step does not work: turning off the client and being locked out is, literally, the proof that the compliant network check is correctly in place. The right procedure does exist and Microsoft published it in March, with two scripts; what neither of them tells you is how long each step takes to be felt.

Zero Trust Microsoft 365 Identity
Read more →
Parte trasera de un armario con servidores y latiguillos de red azules y verdes
9 min read

They broke into a fully patched appliance and went for the recovery keys

On 13 October, Volexity published its analysis of a fully patched remote access appliance on which someone gained unauthenticated root. The interesting part is not the bug: it is that no backdoor was left behind, that the vendor's integrity checker detects nothing because it all happens in memory, and that what they went looking for inside were LAPS passwords and BitLocker recovery keys. Your continuity plan is written against deletion, and here nobody deleted anything.

Cybersecurity VPN Continuity
Read more →
Pared de buzones metálicos numerados en el vestíbulo de un edificio, con una papelera al fondo
8 min read

Your Exchange Online backup hangs on a single text field

Microsoft flipped the switch today, 10 October, in its multi-tenant cloud: a tenant with EwsEnabled set to $true and an empty allowed-application list stops letting every app through and starts letting none through. On the 8th and 9th Microsoft wrote that list for you, from whatever it saw using EWS over the previous 60 days. If you back up Microsoft 365 mailboxes, your backup now depends on a list you probably did not write, stored in a parameter the documentation declares as a text field that supports no add and no remove: only a full rewrite.

Backup Microsoft 365 Exchange
Read more →
Técnico agachado con un portátil delante de un armario de servidores abierto en una sala técnica
7 min read

Read-only in the backup console was not read-only

On 6 October 2026 Veeam published advisory KB4934 with three Backup & Replication vulnerabilities. Two of the three are triggered by the same role: Backup Viewer, the one handed out without a second thought because it is there for looking. The worst reaches 9.4 and runs code on the backup server; the other, scored 6.1, allows deleting the Enterprise Manager master key, which is the documented mechanism for decrypting a backup when the password is lost. Inside: the table of all three CVEs with their vectors, why PR:L is the part that matters, and the role assignment list no recovery plan includes.

Backup Continuity Vulnerabilities
Read more →
Pasillo entre armarios de servidores con las puertas cerradas en un centro de datos
9 min read

VCF hardening: the P0 shuts the door and the P2 leaves you the key

On 5 October 2026 VMware published its security configuration guidance for VMware Cloud Foundation. We downloaded the 9.1 spreadsheet and counted: 260 controls, 160 of them without the secure value set out of the box. Inside: why the control that shuts off host access is a P0 while the one that leaves you a recovery path is a P2, which virtual switch setting ships open on only one kind of switch, and the lines where the guide itself says what it does not do.

VMware Cybersecurity Virtualization
Read more →
Armario de cableado de red con latiguillos de pares trenzados y paneles de parcheo
8 min read

The Azure outage: four doors and the place your plan B lived

On 30 September 2026, a five-hour-forty-five-minute incident on Azure. Of the five services Microsoft lists as impacted, four are the road to your infrastructure and the fifth is Azure VMware Solution. Inside: what the official 7Q30-010 record does and does not say, the real detection clock, why the region figure going round is not in the source, and what happens to your contingency procedure when the thing that fails is the console.

Cloud Infrastructure High availability
Read more →
Escritorio doméstico de noche con un monitor, un teclado retroiluminado y un micrófono, iluminado solo por una lámpara
10 min read

$250 to get in, one million euros of damage

On 30 September, in Operation KillSwitch, authorities switched off KillSec: three arrests, eight premises searched, five servers and at least 110 TB of stolen data secured. The figure that was nobody's headline is the price list: joining that business as an affiliate cost $250 and the house kept 12 % of every ransom. Inside: Operation ROTOMA by the Guardia Civil and the Mossos, the two Alicante searches and the early-2025 cyberattack on a Catalan organisation with an estimated damage of close to one million euros; the January 2025 price change and the ESXi locker that deleted snapshots; why the suspect's age measures the barrier to entry rather than sophistication; the four doors they came in through, one of them without even touching your network; our two averages on the 110 TB with the assumptions declared; what a seizure does not delete; and the inventory of checks, run from the outside, that you can close this week.

Ransomware Cybersecurity Cloud
Read more →
Sala de reuniones vacía con dos pizarras blancas y sillas alrededor de una mesa larga
9 min read

Your patching policy has no entry for "there is no patch"

On 21 September someone broke into the Dutch Institute for Vulnerability Disclosure, the people whose job is telling everyone else to patch. Eleven days later, the second of the two chained flaws still has no published fix. Inside: the timeline the victim published under its own name; why the headline —"an AI agent did it"— is not what decides the outcome, and what the logs actually say ("loud and very messy"); the advisory field reading "Patch status: Available" two sections above the paragraph saying the vendor "are working on a fix", and why your vulnerability process reads the field and not the paragraph; the two public documents that do not agree and are both true; what is left when the patch does not exist —break the chain at the other link, remove exposure, cut the blast radius, raise detection—; and the paragraph missing from your security policy, written out in full so you can copy it, with the two clauses that make it work: it expires by itself, and it carries a name and a job title.

Patching Cybersecurity Continuity
Read more →
Subestación eléctrica de alta tensión con aisladores, embarrados y un transformador
7 min read

6,329 MW granted to data centres and none in service

The figure ran this morning in the energy press, so nobody in IT is going to read it: for the first time Spain's grid operator has published the breakdown by consumption type of the access capacity granted on the transmission network, and data centres take the largest slice —6,329 MW, 34.2% of the total— with 0 MW in service. Industry, with less capacity granted (5,838 MW), already has 4,346 energised: 74% against 0%. We do the three divisions that are not in the release, and one of them is that more than half the power Spain has promised and not yet delivered is spoken for by server rooms. But the part that made us stop is a different one: in February the network was "75% taken" and today there is margin at more than 35% of nodes, with the improvement coming not from new construction but from revising the CNMC calculation scenario —firm capacity up at 204 nodes, flat at 658, down at 75—. Of the three figures in circulation, only "in service" is physical. What that means the day you ask to go from 4 to 8 kW per rack, why the dangerous answer is not "I cannot" but "you can have them down a single feed", and the four-line annex we suggest stapling to the colocation contract —ours included—.

Colocation Datacenter Infrastructure
Read more →
Seta de parada de emergencia sobre una pared, con el pulsador rojo sin accionar
8 min read

The email asked for six hours; the press release said nine: who signs off a shutdown like that?

On 25 September, Kiteworks asked customers for something almost no advisory asks: not to patch, but to switch off. No CVE, no patch and no indicators of compromise, on credible intelligence about an "imminent" attack that weekend. The email customers received, first published by Heise, said six hours; the company's public press release said nine. And the advisory asked them to switch off even systems not reachable from the internet, so there was no way to scope it by exposure. Two days later the advisory was lifted, and during the window an unknown critical flaw turned up, "confined to a capability that is enabled for less than 1% of the customer base". We rebuild the case from the six original sources and get to what it leaves behind: who in your company signs off a stoppage like that and on what evidence (with the words of the CISO who did sign it), which channel your users will use during those hours if you do not give them one, and the three things that bite during an unrehearsed stoppage —the HA manager bringing back what you shut down from inside the guest, the weekend of backups that pushes good restore points out of retention, and monitoring with no maintenance window declared—.

Continuity Disaster recovery Suppliers
Read more →
Interior de una librería de cintas con los cartuchos alineados en sus ranuras
9 min read

Your immutable backup has a permission that deletes it

"Our backups are immutable" is an incomplete sentence, and Amazon's documentation proves it. Object Lock has two modes: in compliance mode nobody can delete anything, not even the root user, and the only documented way out is closing the AWS account; in governance mode anyone holding the s3:BypassGovernanceRetention permission can delete. Both are called immutability. And AWS adds a note almost nobody has read: the web console includes the header needed to override the lock by default, so the friction exists in the API and vanishes in the interface. Also: why the intuitive test (trying to delete an object) returns 200 OK and misleads you in both directions, why Veeam adds 30 days to the immutability you configured on S3, and what that 93% / 16% study doing the rounds in September actually says —including a sample that looks nothing like your company—. And at the end, a sentence with four blanks that whoever runs your backups has to be able to finish.

Backup Ransomware Cybersecurity
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN