Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Interior de una librería de cintas: paredes de cartuchos de copia a ambos lados del pasillo
9 min read

Restoring someone else's dump can create a root account

On 3 November 2026 MongoDB published four security advisories at once. None of the four is patched on the server: all of them close by moving Database Tools to 100.20.1, the package of binaries that lives on a technician's laptop, in the container image running the nightly backup and on the jump host. Inside: why excluding the admin namespace doesn't save you (the advisory says so), the four CVEs with their two contradictory scores, what the changelog tells you and the advisories don't, why your scanner will find nothing, why Ubuntu no longer ships the package, when this is NOT urgent, and the six-check inventory.

Data MongoDB Backup
Read more →
Sala de servidores con equipos de varias generaciones conviviendo en los mismos bastidores
6 min read

PostgreSQL 14 goes end-of-life on 12 November and nothing will tell your server

On 12 November PostgreSQL 14 gets its final minor release and loses support. Nothing falls over that day, and that is the trap. On a managed database the date turns into money: AWS bills extended support as a separate line item, $0.100 per vCPU-hour in its published example, and reserved instance discounts do not apply to it. On your own server the date turns into nothing at all: no bill, no alert and no security patches. The cloud charges you and, by charging you, tells you.

Data Maintenance Costs
Read more →
Tornos de acceso de cristal en el vestíbulo de un edificio de oficinas
9 min read

The connectors that do not exist yet are already approved in your Microsoft 365

On 30 October the Copilot Connectors page starts honouring the publisher-type setting, and the documentation says new connectors of an allowed type "follow the default rollout and are available to everyone included in User access". User access ships set to "All users". What changes with notice MC1454973, who it does not apply to, why the setting is no longer called what the notice calls it, what this is NOT, and six checks.

Microsoft 365 IA Automation
Read more →
Pasillo de un archivo con estanterías llenas de cajas y archivadores etiquetados
9 min read

Your inventory has no line for Brotli

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder: eight bytes of internal buffer from which Node.js, Bun, Python, Envoy, Istio, .NET, FFmpeg, ClickHouse and Apache Arrow all hang. In four days it had five names — Node2Shell, Python2Shell, HTTP2Shell, Brotli2Shell and Broccoli2Shell — and each one was somebody discovering the blast radius was wider than they thought. The fix had been public upstream since 27 February. The word that repeats across every advisory is "bundled": Arrow carries Brotli 1.0.9 inside it, .NET carries its own copy and ClickHouse maintains a fork. Why "is it patched?" has no single answer but eight separate clocks, why you are the one making the request rather than your perimeter, and the five-question census with the exact commands.

Cybersecurity Vulnerabilities Inventory
Read more →
Sala de reuniones vacía de oficina con mesa larga, sillas y una pizarra de cristal casi borrada
8 min read

The retention that covered Copilot switches off this month, and nobody touched the policy

Between late October and mid-November 2026, Microsoft converts legacy Teams retention policies into "Teams-only" policies. If one of yours also kept Copilot conversations — and many did without anyone asking, because they shared the same plumbing — it stops. The notice is MC1481313, dated 28 September, and it does not name a single one of your policies. Where there used to be one checkbox there are now eleven AI apps to configure one by one, ChatGPT, Gemini and DeepSeek among them. With an inventory of the six retention clocks in Microsoft 365 and their official deadlines, the line in the documentation where an unpaid invoice outranks a legal hold, and six checks to run before mid-November.

Microsoft 365 Backup Compliance
Read more →
Armario de comunicaciones abierto con un panel de parcheo y decenas de latiguillos azules sin ordenar
9 min read

Redis: the patch had been out for 164 days

On 16 and 17 October 2026 a set of decoys recorded the first exploitation attempts against CVE-2026-25243, the flaw in Redis's RESTORE command. The patch was published on 5 May: 164 days earlier. Throughout those 164 days the flaw carried two scores — 7.7 from the party that published it and 8.8 from the NVD — that cannot be compared because they come from two different versions of CVSS; plus a CISA record dated 6 May that to this day still says "no known exploitation". We go through why those two scores cannot be subtracted from each other, why "requires authentication" does less work than you think, the six patched branches the CVE record itself never mentions, and the five checks that close the matter.

Data Patching Vulnerabilities
Read more →
Estanterías metálicas de una sala de archivo con cajas y legajos de documentos
9 min read

Nextcloud and CVE-2026-110447: the hole opens when something goes down

On 14 October Collabora published the advisory for CVE-2026-110447: 9.2 out of 10, unauthenticated command injection in an optional Nextcloud app plenty of people installed one afternoon. And one sentence in the advisory that changes the whole job: "the attack only works while the built-in CODE server is not running". The exploitation window is your maintenance window: the restart, the upgrade, the process that died at three in the morning and nobody saw because monitoring stayed green. Why the 9.2 carries a letter almost nobody reads, why disabling the app is not enough, what to look for if it already happened, and when this is not your problem.

Cybersecurity Vulnerabilities Monitoring
Read more →
Estantería de archivo con cajas de documentos numeradas y atadas con cinta de tela
9 min read

SharePoint breaks the "Specific people" link, not the "Anyone" link

During October 2026 Microsoft is retiring SharePoint Online one-time passcode authentication in commercial tenants. You cannot pick the date, you cannot opt out, and it cannot be scoped per site. What stops opening is the named link, the one that made you type the recipient's address; the "Anyone with the link" one carries on unchanged. And the report Microsoft points you to in order to find who you are about to lock out excludes, in writing, links that were emailed and never clicked. What to check, what the EnableAzureADB2BIntegration setting no longer means, and why the right fix is not resharing in bulk.

Microsoft 365 SharePoint Identity
Read more →
Multifunción de oficina junto a una mesa con bandejas de correo entrante y formularios de fax
9 min read

Your SPF passes, your DKIM passes, and DMARC still fails

The header says spf=pass and dkim=pass, and two lines below it says dmarc=fail. That is not a bug: it is alignment, and it is what breaks the mail your applications send. Inside: what DMARC actually compares, the row in Microsoft's own table where onmicrosoft.com fails even in relaxed mode, why your aggregate reports never arrive if you have a gateway in front of the tenant, and the sender inventory to write down before touching DNS.

Microsoft 365 DNS Cybersecurity
Read more →
Interior de una librería de cintas con el mecanismo del lector a la vista y una columna de ranuras vacías al fondo
9 min read

Microsoft deleted data before the window closed, and cannot say which

In late September 2026 it emerged that Microsoft, "due to an error", deleted data from expired subscriptions under its nonprofit programme before the retention and export window had closed. It could not be recovered. And there is a second half: it is currently unable to hand over a list of which data may have been deleted. Inside: the official Microsoft 365 countdown —30 days of Expired plus 90 of Disabled— and its asterisk; the 30 days that counter lost on 9 February 2026 for anyone buying direct under a Microsoft Customer Agreement; the four documented shortcuts that zero it, including the immediate deletion of SharePoint and OneDrive; and why article 33(5) of the GDPR asks you to document facts that, without an independent copy, you cannot enumerate.

Backup Microsoft 365 Compliance
Read more →
Archivo compacto de oficina con los paneles cerrados y las manivelas de apertura alineadas
9 min read

DLP alerts leave the queue on 12 October: the table they land in may be empty

On 12 October a built-in rule turns itself on and converts Purview DLP alerts into "behaviors": they stop raising alerts and stop entering the Defender XDR incident queue. Inside: the literal quote from the Microsoft Learn box, which says "early October 2026" and gives no day —the day comes from notice MC1465771, published on 1 September—; what "Set as behavior" means exactly and why the three words that matter are "or trigger incidents"; the finding that made us write this: the BehaviorInfo table reference says it is populated by Defender for Cloud Apps and UEBA and that without those services queries return nothing, and the second door, CloudAppEvents, closes with the same key; the way out that is safe and almost nobody mentions; why we are not telling you to disable the rule; the line that leaves a third route open —built-in rules do not apply to custom detections— with its full price; and four checks, two of them queries you can paste today.

Microsoft 365 Data Compliance
Read more →
Oficina diáfana vacía con mesas de trabajo al fondo y una zona de sofás en primer plano
10 min read

AI speeds up what you write, not what you can deploy

Of the two things DORA said about AI in 2024, in 2025 it observed the opposite for one — delivery throughput flipped sign — and exactly the same for the other, which is the one that costs money: more AI still comes with less delivery stability. Two consecutive reports, same sign. With the METR trial that measured a 19% slowdown where participants perceived a 20% improvement — and the caveats its own authors published afterwards, including a second trial with intervals that cross zero — what the 2026 ROI report assumes in money (one point of change failure rate, $344,000) and the four things that have to take more flow before you buy anything: an environment that looks like production, small batches, a timed rollback and telemetry by symptom.

AI Automation Data
Read more →
Nave industrial vacía con el suelo de hormigón, un palé en primer plano y la puerta abierta al fondo
8 min read

Data Act: in January 2027 leaving the cloud becomes free; moving does not

On 12 January 2027 your cloud provider loses the right to charge you for leaving: Article 29(1) of the EU Data Act forbids it. But the big three already dropped that fee back in 2024, so what changes is not the amount — it is that this stops being a conditional credit programme and starts reaching the small providers too. The exit invoice disappears; the cost of leaving stays exactly where it was. The definition of "functional equivalence" speaks of "a minimum level of functionality", binds infrastructure services only, and covers only the features both source and destination offer alike. What you actually get back, what the trade-secret carve-out hides, why multicloud traffic still gets billed, the exact deadlines you can already enforce (two months, thirty days, seven months) and the exit drill that reveals the number no contract contains.

Cloud Regulation Data
Read more →
Pasillo de un depósito de archivo con estanterías móviles cerradas y cajas de documentación
8 min read

Project Online shuts down on 30 September: no licence, no export

Microsoft switches Project Online off on 30 September and PWA sites stop being available. But what decides whether you make it in time is not in the announcement: it is in the service description, which requires a live Plan 3 or Plan 5 subscription in the tenant for ANY interaction. Which means the licence you were going to drop to save money during the migration is the one you need in order to export. There is also a second 120-day clock written somewhere else, the PWA is a SharePoint site and not a calendar, and the destination's published limits explicitly exclude your plan.

Microsoft 365 Data SaaS
Read more →
Rack de una pequeña oficina con panel de parcheo, latiguillos y equipos de red apilados
9 min read

The AI agent will not show up in your log: whoever lent it the token will

Connecting an assistant to SharePoint or the ERP is not an integration decision, it is a delegation decision. The Model Context Protocol specification, revision 2026-07-28, forbids forwarding somebody else's token in capital letters, and spells out why: the destination system's logs will show a different identity from the one that made the request. We go through the spec, the permission fallback that asks for everything on offer, the CVE in the official SDK, and the seven questions we ask before connecting anything.

AI Automation Identity
Read more →
Técnico agachado con un portátil trabajando en la parte trasera de un rack de servidores
5 min read

REPLICATION was never a read-only privilege: PostgreSQL closed a twelve-year dlopen()

On 13 August PostgreSQL shipped 18.6, 17.11, 16.15, 15.19 and 14.24. Among the CVEs they close there is one that is not about buffer overflows: any account holding the REPLICATION attribute could name as its logical decoding plugin any file visible to the system, and the server would load it and run its code as the operating system user. The patch adds a whitelist with two entries by default: if your change data capture uses decoderbufs or wal2json, it stops your replication until somebody edits postgresql.conf.

PostgreSQL Zero Trust Data
Read more →
Servidor de dos alturas con la tapa quitada sobre una estantería metálica, en el trastero de una oficina, con cartones apoyados en la pared
5 min read

Artifactory's "medium" CVE hit the catalog before the critical one

CISA confirmed exploitation of a 5.3 JFrog Artifactory flaw on 27 August; of the 9.8 that lets anyone forge admin tokens, on 2 September. Six days apart, and in the opposite order to the scores. Look at the full vector of the "medium" one and you see why: two of the three impact dimensions are zero and the one left at maximum is integrity. In an artifact repository, integrity is exactly what you are buying.

Cybersecurity Containers Vulnerabilities
Read more →
Cartel de «se busca» con el alias CyberLeek sobre una ciudad nocturna y las etiquetas de los datos reclamados: IP, identificador de dispositivo, cuenta de Microsoft, OneDrive y Discord
5 min read

GTA 6, CyberLeek and MachineGuid: the digital trail your company leaves too

To find whoever is leaking GTA 6 material, on 20 August 2026 Take-Two filed two DMCA subpoenas asking Microsoft and Discord for the MachineGuid, MSA device identifiers, IP addresses, phone numbers, linked connections and OneDrive contents of every account in three servers. What MachineGuid is, why it identifies the device rather than the account, and why your company generates exactly the same trail every working day.

Cybersecurity Identity Zero Trust
Read more →
Priority Cleanup de Microsoft Purview: borrar por encima de la retención en Microsoft 365
9 min read

Deleting above retention: three approvals in Exchange, one in SharePoint

Microsoft Purview Priority Cleanup deletes Microsoft 365 content by overriding retention policies, labels and eDiscovery holds, and the documentation says what it deletes cannot be restored by users, by admins, or by Microsoft. Mailboxes always demand three approvals; SharePoint and OneDrive, one — and none from the retention owner. What stops it, what to switch off beforehand, and what it asks of your backup.

Microsoft 365 Backup Compliance
Read more →
Sala de archivo de una oficina con estanterías metálicas llenas de cajas de cartón y carpetas, y una caja abierta sobre una mesa de trabajo
9 min read

"The column was encrypted": pgcrypto was storing cleartext and nobody noticed

On 13 August PostgreSQL closed 28 CVEs in one go. One of them is not a buffer overflow: when OpenSSL rejected the requested cipher, pgcrypto never checked the answer and wrote the value into your "encrypted" column with a trivial XOR. Neither the INSERT nor the SELECT failed. What triggers it, why the day it broke was not the day the code was written, and which version you are really running if you install from Debian rather than PGDG.

PostgreSQL Encryption Data
Read more →
  • 1
  • 2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN