Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis

Cybersecurity

IT Trends

Filter by:

Secuestro de DNS en Wi-Fi de hoteles para robar cuentas de Microsoft 365

26 Jul 2026 7 min read

The hotel Wi-Fi works for someone else: DNS hijacked to steal Microsoft 365 accounts

Since June 2026 an active campaign has been compromising captive portals at hotels and conference centers, changing their DNS and redirecting guests to fake Microsoft 365 pages. The refined part: by abusing the device code flow they take your account without stealing your password, with MFA "satisfied". What is happening, why the padlock won't save you, and what we would do: from full-tunnel VPN to blocking the device code flow.

Zero Trust Cybersecurity Microsoft

Colocation vs cloud público: la cuenta a cinco años, con el caso 37signals

26 Jul 2026 8 min read

The cloud isn't expensive: it's expensive for the wrong workload. Colocation vs public cloud, with the math done

37signals was paying $3.2 million a year for cloud, bought $700,000 of servers and recouped them in the first year; in 2025 it announced moving its 18 PB out of S3. Meanwhile, worldwide cloud spending keeps growing at a 20% annual clip. Both things are true: the difference is who does the math. Which workloads overpay in the cloud, when the cloud still wins, and the five-year colocation math, line by line.

Colocation Cloud Datacenter

Una IA autónoma automatiza la post-explotación en un ataque real; la respuesta es detección 24/7

25 Jul 2026 8 min read

The tireless intern now works for the other side: an autonomous AI is already automating real attacks

In an intrusion at Thailand's Ministry of Finance, the attacker left an open-source AI agent running unattended to automate the boring part of the attack: enumerate, escalate privileges, find the next step. It broke nothing new —it got in through default credentials and unpatched 2021 CVEs— but it did the dirty work faster and without rest. What actually changes is speed, and the only answer to speed is 24/7 detection and response.

Cybersecurity IA EDR/MDR

Certighost (CVE-2026-54121): impersonar un Domain Controller vía AD CS

25 Jul 2026 9 min read

Certighost: any user could become your Domain Controller. The question isn't whether you patched, it's whether you've audited your AD CS

Certighost (CVE-2026-54121) let an unprivileged domain user impersonate a Domain Controller via Active Directory Certificate Services and take over the entire domain. Microsoft patched it on July 14; a working PoC has been public since July 24. The mechanism in one sentence, why AD CS is the escalation surface almost nobody audits, and the plan for today: patch, inventory your CAs, machine account quota to zero, and audit templates.

Cybersecurity Active Directory Microsoft

Microsoft retira el SMS como MFA en Entra ID: passkeys por defecto

25 Jul 2026 7 min read

Microsoft is retiring SMS for MFA: in February 2027 Entra ID stops sending them. The strange part is that it lasted this long

On July 13 Microsoft announced that Entra ID will stop providing SMS and voice calls as an authentication method: passkeys by default from September 1 and full retirement on February 1, 2027, with no opt-out. Anyone insisting on SMS will have to contract and pay their own telecom provider. The full timeline, why SMS was never a serious second factor, and the plan we would apply to any tenant.

Microsoft MFA Security

Ceph: réplica 3 vs erasure coding, la cuenta completa

24 Jul 2026 9 min read

Erasure coding promises twice the space of 3-way replication in Ceph. The full math says otherwise

Same fault tolerance and twice the usable space: pitched like that, erasure coding sounds obvious. We run Ceph in production and our VMs are still on 3-way replication. The space math, the write math, the recovery math and the node math — and where we do use erasure coding.

Ceph Storage Proxmox

Microsoft 365: caída del 23 de julio de 2026 y plan de continuidad

24 Jul 2026 7 min read

Microsoft 365 went down again: you can't DR your way out of Teams (but you can have a plan)

On July 23 a network configuration change left Teams, SharePoint and OneDrive limping for hours: the fifth major hyperscaler outage in nine months. When your entire office lives in a SaaS there is no replica to boot and no runbook that helps: the SLA is credits, not continuity. What we wouldn't do, and the two-page plan that actually works.

Continuity Microsoft Cloud

Check Point SmartConsole

Zero-day CVE-2026-16232 · exposed management

24 Jul 2026 9 min read

The Check Point zero-day wasn't after your firewall: it was after its console

CVE-2026-16232: an authentication bypass in SmartConsole allowed logging into the server that governs all your Check Point gateways as an administrator, with no credentials. It was exploited before the patch existed and CISA gave three days to remediate. Why the management plane is a bigger prize than the firewall itself, and the checklist that applies even without Check Point.

Firewall Cybersecurity Security

SharePoint 2016/2019

Unsupported since Jul 14; no ESU

23 Jul 2026 9 min read

SharePoint 2016 and 2019 just ran out of patches, and this time there's no extension you can pay for

On July 14 SharePoint Server 2016 and 2019 fell out of extended support, and Microsoft offers no ESU: there is no paid extension. A year ago ToolShell compromised over 400 organizations attacking on-prem SharePoint that was still receiving patches. The three real ways out, and the fourth one almost nobody offers you.

SharePoint Microsoft Security

31.4 Tbps DDoS

RTBH: mitigated upstream

23 Jul 2026 9 min read

Your firewall can't stop a DDoS: the latest record hit 31.4 Tbps. Real mitigation happens upstream

In December 2025 the largest DDoS on record was mitigated: 31.4 Tbps, roughly 31,000 times the capacity of a 1 Gbps fibre. By the time that traffic reaches your firewall, the battle is already lost. What RTBH is, why a local blackhole won't save your link, and what to ask your provider.

DDoS Networks Cybersecurity

FakeGit

7,600 fake repos; your AI is the target

23 Jul 2026 8 min read

Malware no longer fools you: it fools your AI. FakeGit and its 7,600 fake GitHub repositories

The FakeGit campaign seeded GitHub with 7,600 fake repositories; roughly 200 of them alone account for over 14 million malware downloads. The news isn't the volume: more than 800 posed as MCP servers and AI skills, and the assistants recommended them on their own. It has a name now: agentbaiting.

AI Cybersecurity GitHub

Romania's land registry

Wiped; saved by the out-of-reach copy

22 Jul 2026 8 min read

Romania's land registry was wiped, backups included. It was saved by the copy the attacker couldn't touch

On July 14 an attacker got into Romania's ANCPI with valid credentials, failed to extort the agency, and wiped the land registry database plus every backup within reach. A week with no property sales or mortgages nationwide. The difference between incident and catastrophe was one copy beyond his reach.

Backup Ransomware Cybersecurity

VMware + Broadcom

86% reducing, only 4% fully out

22 Jul 2026 9 min read

Two years of Broadcom: the mass VMware exodus that never happened (and what is actually going on)

86% of VMware customers are shrinking their footprint, yet only 4% have completed a full migration. Broadcom, meanwhile, signs Standard Chartered. What the data actually says two years in, and what we would do with a renewal due in 2027.

VMware Broadcom Migration

wp2shell

Patch to exploit in 48h

22 Jul 2026 8 min read

wp2shell: WordPress patched on Friday, the exploits landed by Sunday. Who maintains your website?

On July 17 WordPress shipped 6.9.5 and 7.0.2 to plug wp2shell, a no-login RCE in core. It was being exploited that same evening, and by Sunday there were more than twenty public exploits. The uncomfortable question isn't technical: who is responsible for updating your website?

WordPress Security Maintenance

AI agents

40% canceled by 2027 (Gartner)

21 Jul 2026 8 min read

AI agents in the enterprise: Gartner expects over 40% of projects to be canceled before 2028 (and it won't be the AI's fault)

Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027, and MIT measured that 95% of pilots show no return. Why AI agent projects really die, and the six questions we ask before starting one.

AI Automation Technology

SonicWall SMA 1000

22 days exploited unpatched

21 Jul 2026 9 min read

22 days inside: the SonicWall SMA 1000 zero-days and why the perimeter VPN is no longer the defense — it's the target

Zero-days CVE-2026-15409 and CVE-2026-15410 were exploited from June 22, 22 days before the patch, with theft of credentials and MFA seeds. Why the VPN appliance is the perfect target and what to do beyond patching.

Security Cybersecurity Zero Trust

AWS, July 16

~8 hours of errors

21 Jul 2026 8 min read

AWS went down again on July 16: eight hours that explain what a disaster recovery plan is (actually) for

CloudFront served errors for about eight hours on July 16, 2026. It's the third major AWS outage in nine months, and none of them was an attack. What to map, what to promise and what NOT to build so your provider's incident doesn't become yours.

Disaster Recovery AWS Cloud

Patch Tuesday 07/2026

622 CVEs, 3 zero-days

20 Jul 2026 9 min read

622 patches in a single Tuesday: Microsoft's record and why prioritizing by CVSS is a mistake

Microsoft breaks its record with 622 vulnerabilities fixed in the July 2026 Patch Tuesday, three zero-days included. The one actively exploited against SharePoint scores 5.3: here's how we triage when patching everything is not an option.

Security Microsoft Patch Tuesday

Proxmox VE 9.2

Hardening in production

20 Jul 2026 8 min read

Hardening Proxmox VE 9.2 in production: the checklist we apply to every cluster

The hardening checklist we apply to every Proxmox VE 9.2 cluster in production: 2FA, least-privilege tokens, firewall, segmented Ceph, immutable backups, and what we deliberately skip.

Proxmox Security Ceph

Proxmox × Zabbix

Official monitoring

3 Jul 2026 12 min read

Proxmox integrates Zabbix: official monitoring for your virtualized infrastructure

Proxmox welcomes Zabbix as an official Solution Provider: native API-based monitoring of clusters, nodes, VMs, LXC, storage and network. What it means and how we run it in production at everyWAN.

Proxmox Zabbix Monitoring

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

I agree to receive commercial communications from MINORISA DE SISTEMAS INFORMÁTICOS Y DE GESTIÓN, S.L., in accordance with the privacy policy, which I have read and accept without reservations, which contains additional information about the processing of my data and about the exercise of my rights of access, rectification, restriction, erasure, objection and portability.

Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel

Language
- ES
- CAT
- EN