Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis

Cybersecurity

IT Trends

Filter by:

Unidad de cinta LTO-6 y ranuras de una biblioteca IBM TS3500

14 Oct 2026 7 min read

GitLab's official recovery procedure starts with a DELETE

On 12 October GitLab shipped three versions over a CVSS 10.0 flaw that allows code execution on the server, and the release note itself warns that on a single-node instance the patch takes the instance down. If you also decide a rebuild is needed, the documented route when the secrets file is missing is to delete your CI/CD variables, null out runner tokens and disable two-factor authentication for everyone. Nine things stop being accessible; the code is not one of them.

Backup Cybersecurity GitLab

Escritorio con un portátil de pantalla apagada, una libreta abierta con anotaciones a mano y una taza de café

12 Oct 2026 9 min read

The SDK behind your AI agents has six new advisories. Your scanner says zero

Between 28 September and 5 October 2026, the Model Context Protocol Python SDK published six security advisories, three of them scored 7.5. As of 12 October none of the six appears in OSV, nor in the global GitHub database that fires Dependabot, nor in the PyPI API that pip-audit queries by default; the only one carrying a CVE is not in the NVD either. We checked it with two public API calls you can repeat in a minute. And two of the six state in writing that upgrading, on its own, fixes nothing.

AI Automation Vulnerabilities

Armario de red de oficina abierto, con un conmutador y una maraña de latiguillos acumulados dentro

7 Oct 2026 7 min read

Eight products, nineteen versions: Atlassian's advisory tells you what to do, not what you have

The CVE-2026-21589 advisory, dated 5 October 2026, affects eight self-hosted Atlassian products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. It is one of the thorough ones: nineteen fixed versions, temporary mitigations if you cannot patch —including taking the instance off the internet— and a method for hunting traces in your access logs. All three instructions start from a question the vendor cannot answer for you. Inside: the version table, why "we are on 10.2" points at three different products, and Atlassian's thirteen entries in CISA's KEV catalogue.

Vulnerabilities Patching DevOps

Disco duro externo conectado a un portátil sobre una mesa de despacho

5 Oct 2026 7 min read

The clone doesn't carry the .git/config. The ZIP does

Four CVEs published in August and September 2026 describe the same sequence: you open a folder with an AI coding agent, the agent calls git to work out where it is, and that folder's local configuration runs a program with your credentials before anybody asks whether you trust it. Inside: what git's documentation says about core.fsmonitor, why an ordinary clone does not work as a delivery route, why the ownership check git does have is disarmed by the most ordinary gesture there is, and the trick that hides the key from your own grep.

AI Cybersecurity DevOps

Sala de servidores con el pasillo de racks y el cableado de red ordenado

24 Sep 2026 8 min read

Kubernetes expires every fourteen months, and you cannot skip versions

On 27 October 2026 the Kubernetes 1.34 branch stops receiving patches, and that date has been published since the version shipped. The project supports each branch for "roughly fourteen (14) months" — twelve months plus two in maintenance mode — and only the three most recent minor versions. Subtract the published end-of-life dates and you get the number that matters: a version expires every four months. What maintenance mode actually means, why the control plane cannot skip versions on upgrade, how much slack the nodes have, and why that slack makes a cluster look healthy while it drifts.

Kubernetes Infrastructure DevOps

Batería de torniquetes de acceso vacíos en el vestíbulo de una estación de metro

22 Sep 2026 9 min read

Ingress NGINX: half of Kubernetes was maintained by two people

The kubernetes/ingress-nginx repository is archived read-only and its last release is dated 19 March: 187 days without a new release. This is not neglect, it is a deliberate retirement, and the reason signed by the Kubernetes Steering Committee and Security Response Committee was not a CVE: the component that publishes half of all cloud native environments to the internet was maintained by "one or two people working in their free time". What to check today with one command, why migrating to Gateway API is not translating YAML, and the five behaviours your routing has that nobody chose.

Kubernetes Containers Infrastructure

Dos portátiles abiertos sobre una mesa de oficina y una mano escribiendo sobre unos papeles

19 Sep 2026 7 min read

The agent pinned the plugin's commit. Git handed it the attacker's branch

Plugin4Shell affects the four most widely used AI coding agents: they clone the plugin repository, check out the pinned commit and never verify they landed on it. We reproduced in the lab, with git 2.43, the git behaviour it rests on: exit code 0, a warning nobody reads, and the attacker's content in the working tree. The same 40-character string gives a different answer depending on which git command reads it, so auditing with git log is no help. And today's defence today depends above all on where the plugin repository is hosted.

IA Cybersecurity DevOps

Estanterías de un depósito de archivo con legajos y cajas de documentos etiquetados

13 Sep 2026 9 min read

"Read-only" does not exist: GitLab scores 10.0 on a flaw that can only read

CVE-2026-85706 lets a stranger read files off a self-hosted GitLab server. It writes nothing, and it still carries the maximum score. The explanation is not in the headline: it is in the vector the vendor itself signed off, with a changed scope and high integrity impact. We go through what the vector says, why CISA gave it three days and a forensic triage flag, and how to answer the one question the patch does not: were we read?

Cybersecurity GitLab Vulnerabilities

Armario metálico de llaves abierto en la pared de un cuarto de instalaciones, con decenas de llaves colgadas juntas

1 Sep 2026 8 min read

136 keys in one object: the defaults that opened the cluster

Hugging Face published the forensic timeline of the July intrusion and OpenAI closed its report on 26 August: 17,600 reconstructed actions between the 9th and the 13th. Between the first compromised container and the object holding 136 keys there was not one further vulnerability — there were defaults. The token every pod mounts, the metadata endpoint that answers from inside, secrets concentrated in one object, and a connector credential shared across clusters. We walk the chain with the timestamps in front of us, the two CVEs CISA added to its catalogue on 27 August, and the five questions we ask a cluster.

Cybersecurity DevOps Zero Trust

Armario de red mural con la puerta abierta en el cuarto trastero de una oficina, con cajas de cartón, una fregona y estanterías

27 Aug 2026 7 min read

Gitea's flaw "requires write access". The signup form hands it to you

The CVE-2026-60004 write-up says you need write access to a repository. The official vector in the same advisory says <code>PR:N</code>, privileges required: none. Both are true, because Gitea installs with <code>DISABLE_REGISTRATION=false</code>. What that means for how you prioritise patching everything you self-host, what happened in the eleven seconds of the only public case, and the list of what to check today.

Cybersecurity DevOps Vulnerabilities

Caja fuerte pequeña de oficina abierta sobre una repisa, con dos sobres, un juego de llaves y una memoria USB dentro

19 Aug 2026 5 min read

Cloning the repository is not a GitLab backup

On 17 August GitLab shipped four out-of-band releases for a flaw that lets an unauthenticated user modify or delete public projects. The usual answer — "we have the code cloned everywhere" — is true, and it is the part you are least likely to lose. What a clone actually carries, what lives only on the server, why the secrets file is not inside the backup, and why the June fix, the one with no CVE, explains the problem better.

CI/CD Backup DevOps

Sala de servidores en penumbra con un armario de red abierto y una etiqueta de inventario despegada colgando de un cable

19 Aug 2026 7 min read

Your documentation is lying to you. And so are your validations

A document does not age: it expires, and it does so silently. Markdown cannot tell the difference between what you checked, what can be checked, and what you assumed, so six months later all three read the same. We tell the real case that led us to build validated-memory: evidence states, supersession without deletion, and freshness probes with three answers instead of two. Released as open source under Apache-2.0.

Documentation DevOps Open Source

Puesto de trabajo vacío de noche en una oficina pequeña: portátil cerrado, teclado mecánico, taza fría y flexo encendido

18 Aug 2026 5 min read

Five days, an issue title and a Jira token

On 17 August Wiz described how it pulled a Jira token out of Snowflake by opening an issue on a public repository: the issue title was the exploit. The line that allowed it had gone in five days earlier, in a change meant to tidy the code up, and it replaced the safe pattern that GitHub's own documentation recommends in writing. What failed in the review chain, why the "if" that looked like a filter filtered nothing, and what we look at in a pipeline.

CI/CD AI GitHub

CVE-2026-63077, un fallo de CVSS 9,8 sin autenticación en todas las versiones de JetBrains TeamCity On-Premises, pone el foco en el servidor de CI/CD como sistema crítico

3 Aug 2026 8 min read

Your CI/CD holds the keys to production. And you treat it as a developer tool

On 27 July 2026 JetBrains published CVE-2026-63077: an unauthenticated 9.8 affecting EVERY version of TeamCity On-Premises and allowing operating system commands to be run on the build server. There is no known exploitation. The two previous times TeamCity had a flaw like this ended with Russia's SVR inside technology companies and with BianLian operators creating users on build servers. The underlying problem is not TeamCity: it is that the machine which deploys to production is in almost nobody's critical systems inventory.

CI/CD DevOps Cybersecurity

Despliegues reproducibles con Docker Swarm y GitOps: latest no es una versión

27 Jul 2026 7 min read

"latest" is not a version: three lessons from deploying our own website with Docker Swarm

The pipeline went green, the webhook returned 200, and the site kept serving the old content. Three real lessons from our GitOps CI/CD on Docker Swarm: why the orchestrator does not chase your tag and what it takes for a redeploy to actually redeploy, why a linter is not a test (and the smoke test that saved our blog index), and the "zero downtime" our own file claimed but never delivered with a single replica.

Docker DevOps Infrastructure

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

I agree to receive commercial communications from MINORISA DE SISTEMAS INFORMÁTICOS Y DE GESTIÓN, S.L., in accordance with the privacy policy, which I have read and accept without reservations, which contains additional information about the processing of my data and about the exercise of my rights of access, rectification, restriction, erasure, objection and portability.

Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel

Language
- ES
- CAT
- EN