Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Interior de una librería de cintas: filas de ranuras y una unidad de cinta extraída sobre su guía
9 min read

Ransomware: recovering fast is not evicting the attacker

Of the organisations hit by more than one ransomware attack in the last twelve months, 30% suffered them on the same day and another 29% within the same week. That does not measure long-term recidivism: it measures access that was never actually closed. 87% of attacks went after the identity system — Active Directory, Entra ID, Okta — yet recovery plans still restore machines. We go through what each figure in the Semperis report actually measures, the Spanish data point that cuts against that reading, the recovery order Microsoft publishes and almost nobody has written down, and the eight conditions we require before calling an incident closed.

Ransomware Disaster recovery Identity
Read more →
Bastidores de servidores vacíos, con los montantes y los raíles a la vista y sin ningún equipo montado
7 min read

The control plane fails first, and your plan B needs it

A year ago, on Monday 20 October 2025 at 08:48 Spanish time, a DNS record went empty and took half the internet with it. AWS's own post-event summary leaves an uncomfortable reading for any recovery plan: instances already running stayed healthy. What you could not do was launch another one, update a function, start a container, request temporary credentials, sign in to the console or open a support case. The headline was 2 h 52 min; the last thing AWS declared restored came 28 h 17 min later. We go through the document on local time, the six questions we ask of a continuity plan, and why building it on your own hardware does not get you out of the problem: it brings it home.

Cloud Disaster Recovery Infrastructure
Read more →
Registrador de banda de papel abierto, con su rollo milimetrado y la plumilla que dibuja una línea continua
6 min read

The 99.9% does not tell you how long the outage lasts: what you are really signing in an SLA

Three nines sound like a serious figure until you do the division: 99.9% a year is 8.76 hours, and nothing in that number stops all eight of them from landing back to back on a Tuesday. The same 99.9% measured monthly is 43.8 minutes and it does not roll over: the yearly total is identical, but the ceiling on a single outage drops from 8.76 hours to 43.8 minutes. We do the exact arithmetic for all four levels of nines, explain why the percentage hides the only thing your business actually feels — how long ONE outage lasts — what usually falls outside the count, and the three questions to ask before signing. With the conflict of interest declared: we sign SLAs too.

Consulting Continuity High availability
Read more →
Torre de alta tensión y línea eléctrica cruzando un campo arado hasta el horizonte
7 min read

Barcelona has 63 MW of data centre capacity. The pipeline is 300 km away

Colliers published its snapshot of the Iberian market for April-September 2026: around 450 MW IT live, Barcelona up from 42 to 63 MW, and an Aragonese pipeline of 3,764 MW. The headline "data centres grow 17%" answers no question you ever asked. The two that matter are in the same report: how much colocation capacity is free where you actually are (14% in Barcelona) and how far away the rest is being built: Barcelona has 525 MW announced, but Aragón seven times more, three hundred kilometres away. Because the second room in your recovery plan is not decided in euros: it is decided in kilometres, and you can do the maths yourself with a map.

Colocation Datacenter Disaster recovery
Read more →
Técnico de espaldas, agachado delante de un rack abierto, con los cables de red a la altura de la cara
10 min read

Testing the live system would have prevented 26 outages out of 40; more redundancy, 9

In 2003, three Berkeley researchers went through the outage reports of three large internet services and asked what would have prevented each one. For one of them, with forty outages analysed, the answer was uncomfortable: testing the running system would have prevented 26; adding redundancy, 9. Twenty-three years on we still buy the second and skip the first. What the study actually says, why Chaos Monkey breaks things between nine and three and ships switched off, and what a rehearsal with a hypothesis, a blast radius and a stop condition looks like in a company that is not Netflix.

Continuity Disaster recovery Infrastructure
Read more →
Unidad de cinta LTO-6 y ranuras de una biblioteca IBM TS3500
7 min read

GitLab's official recovery procedure starts with a DELETE

On 12 October GitLab shipped three versions over a CVSS 10.0 flaw that allows code execution on the server, and the release note itself warns that on a single-node instance the patch takes the instance down. If you also decide a rebuild is needed, the documented route when the secrets file is missing is to delete your CI/CD variables, null out runner tokens and disable two-factor authentication for everyone. Nine things stop being accessible; the code is not one of them.

Backup Cybersecurity GitLab
Read more →
Seta de parada de emergencia sobre una pared, con el pulsador rojo sin accionar
8 min read

The email asked for six hours; the press release said nine: who signs off a shutdown like that?

On 25 September, Kiteworks asked customers for something almost no advisory asks: not to patch, but to switch off. No CVE, no patch and no indicators of compromise, on credible intelligence about an "imminent" attack that weekend. The email customers received, first published by Heise, said six hours; the company's public press release said nine. And the advisory asked them to switch off even systems not reachable from the internet, so there was no way to scope it by exposure. Two days later the advisory was lifted, and during the window an unknown critical flaw turned up, "confined to a capability that is enabled for less than 1% of the customer base". We rebuild the case from the six original sources and get to what it leaves behind: who in your company signs off a stoppage like that and on what evidence (with the words of the CISO who did sign it), which channel your users will use during those hours if you do not give them one, and the three things that bite during an unrehearsed stoppage —the HA manager bringing back what you shut down from inside the guest, the weekend of backups that pushes good restore points out of retention, and monitoring with no maintenance window declared—.

Continuity Disaster recovery Suppliers
Read more →
Bahías de disco de un servidor con bandejas medio extraídas y huecos vacíos
8 min read

Your redundancy assumes the spare arrives tomorrow

A drive dies on a Tuesday and nothing happens: that is what you paid the replica for. But what you bought is not immunity, it is a window of time in which to replace the part before the next failure — and that window was calculated assuming the spare arrives tomorrow. Western Digital told its earnings call it was "pretty much sold out for calendar year 2026" and Seagate said its nearline capacity was "fully allocated" for the same period, with cloud agreements now reaching into 2027 and 2028. We run the arithmetic on Backblaze's published failure rates: with the spare in 48 hours, the probability of a second failure before the repair is 0.18%; with the spare in 20 weeks, it is 11.5%. Same design, same drives, 66 times the risk from a variable that appears in no diagram. Where it hurts most (the node, not the disk), the retention cut nobody signs off, and the six questions we ask now before approving a design.

Infrastructure Storage Continuity
Read more →
Armario de servidores con cada máquina etiquetada a mano, una por una
8 min read

Your Proxmox backup skips disks and the job still turns green

The limitations page for the Veeam plug-in for Proxmox VE was updated on 15 September 2026, and two lines in it carry the word that really matters: skipped. There are two very different kinds of "not supported": the one that stops your job and the one that skips a disk and paints the job green. What falls outside the backup of a Proxmox platform, what does not come back when the machine comes back, why LXC containers are a separate inventory, and why the backup manual gets read before you choose your storage rather than on restore day.

Proxmox Backup Disaster Recovery
Read more →
Vista aérea de un corredor de centros de datos: naves industriales bajas y anchas repartidas a lo largo de una autopista
13 min read

Your cloud can lose one zone. AWS just lost a Region

On 15 September AWS wrote on its health dashboard that it cannot restore resources and data hosted "exclusively" in the Bahrain Region or in the mec1-az2 zone in the UAE. That one word separates the customers who lost data from the ones who did not. The perimeter of that redundancy was published all along: S3 is designed to survive the loss of ONE zone, and zones sit within 100 km of each other. What the documentation says, what the contract says, and the four questions we write down before touching anything.

Cloud Disaster recovery Continuity
Read more →
Nave de un centro de distribución: estanterías metálicas con palés embalados y pasillo de preparación de pedidos
8 min read

Cutting you off takes 101 minutes; reconnecting you, nine days

Boston Scientific disclosed its incident on a Wednesday. That same day, 101 minutes after the first notice, the platform its customers use to send it orders cut every one of its global connections. It took nine days to give them back. The full timeline sits on a public status page and teaches three things that are in almost no continuity plan: who decides to disconnect you, which degraded channel keeps you alive meanwhile, and why your status system stops telling the truth.

Continuity Disaster recovery Compliance
Read more →
Pasillo de un centro de datos con dos filas de armarios de rack idénticos
9 min read

The cluster picks a node by counting guests: anti-affinity in Proxmox VE 9 and the rule nobody declares

When a node goes down, the Proxmox VE scheduler decides where your HA-managed machines come back up. On a freshly installed cluster it does that by counting active guests: it has no idea that 101 is the second leg of 100. Proxmox VE 9.0 brought affinity rules so you can tell it, with an asymmetry worth knowing — the rule that pins a guest to a node is a preference, the rule that keeps two guests apart is an order — and an arithmetic that decides whether your VM comes back degraded or does not come back at all.

Proxmox High availability Virtualization
Read more →
Pasillo estrecho de un centro de datos, con un rack abierto de paneles de parcheo de fibra en primer plano y latiguillos aguamarina y amarillos recogidos en las guías de cable
10 min read

Redundancy does not survive the procedure

On 1 September, a scheduled capacity upgrade sequentially unplugged 100% of the fiber paths serving part of Google Cloud's us-central1-b zone, in thirteen minutes. Just before that, the report describes a correct architecture: physically separated paths, diverse power, tolerance to double and triple failures. A 2003 Berkeley study already explained why none of it helped: operator error is not more frequent than hardware failure, it is just less frequently masked.

Disaster recovery Continuity Datacenter
Read more →
Plan de continuidad sin ensayar: un servidor sacado a medias del rack con los cables de alimentación desenchufados
9 min read

A continuity plan nobody has rehearsed is a document, not a plan

Uptime Institute's May 2026 annual outage analysis says the leading driver of outages with human error behind them is still failing to follow procedures that were already established. Established: the document existed. And 87% of those who suffered an impactful outage believe it could have been prevented with better management, processes or configuration — seven points more than in 2024. What is missing, what a drill that works looks like, and when you should NOT run one.

Continuity Disaster recovery Consulting
Read more →
Mostrador de pedidos de un almacén con el monitor apagado apartado, una libreta con los pedidos apuntados a mano, albaranes en un pincho y un teléfono descolgado
5 min read

The backup was safe. And it had spent 47 hours inside the same outage

A hosting provider's official status page said two things on the same day: \"there is no risk of data loss\" and \"it is not possible to access backups or migrate affected services to another node\". Both were true, and together they describe the design flaw almost nobody has in their plan: a perfect RPO with an RTO that has no number. We rebuild the clock from the provider's own status page and propose the figure missing from almost every plan: the hour at which you stop waiting.

Disaster Recovery Backup Continuity
Read more →
Cuadro eléctrico general abierto en un cuarto de instalaciones, con filas de magnetotérmicos colgando todos de un mismo interruptor principal
5 min read

Six Microsoft 365 services went down together. For your continuity plan they are one

On Monday 31 August, incident EX1464935 on Exchange Online ended up as MO1465074, with OneDrive, SharePoint Online, Teams, Purview and Defender XDR inside it. Six names, one shared authentication configuration underneath. We go through the hours —including the ones BleepingComputer and Computerworld disagree on, which we say rather than picking one—, why nobody has confirmed the expired-certificate story, and the dependency almost nobody will look at: the security console and the audit layer were inside the thing that had gone down.

Microsoft 365 Continuity Support
Read more →
Armario de llaves metálico abierto en el pasillo de servicio de una oficina, con dos hileras de llaves colgadas de sus ganchos
7 min read

They deleted the backups at both data centres

Joint advisory AA26-222A, published on 10 August 2026 by six agencies, records that at one Gunra victim the actors deleted backup and archived data at the primary data centre <em>and</em> at the recovery one, before and after deploying the encryptor. Another section describes how they got the key cabinet: SSH to an access control server and a symmetric key that decrypted the passwords for enterprise server accounts across the company. Our reading: two sites that accept the same credential are one site with two postal addresses. What falls outside a retention lock, and six checks for this week — two of which have to be actually run.

Disaster recovery Ransomware Continuity
Read more →
Rack abierto en una sala de servidores con dos bandejas de disco a medio sacar
5 min read

10% of the VMDK is enough: the arithmetic that changes your recovery plan

The ESXi encryptor Rapid7 took apart carries a percentage parameter, and the value observed was 10: on a large VMDK it touches only a tenth of the file, and that is enough to stop it booting. Partial encryption is not new — LockFile was doing it in 2021 — but the numbers are. What it does to your response clock, why no EDR agent belongs on the hypervisor (Broadcom says in so many words that it is not supported), what the same actor does to backup services, and why swapping hypervisors is not a security control.

Ransomware Virtualization Disaster recovery
Read more →
Caja fuerte pequeña de oficina abierta sobre una repisa, con dos sobres, un juego de llaves y una memoria USB dentro
5 min read

Cloning the repository is not a GitLab backup

On 17 August GitLab shipped four out-of-band releases for a flaw that lets an unauthenticated user modify or delete public projects. The usual answer — "we have the code cloned everywhere" — is true, and it is the part you are least likely to lose. What a clone actually carries, what lives only on the server, why the secrets file is not inside the backup, and why the June fix, the one with no CVE, explains the problem better.

CI/CD Backup DevOps
Read more →
Una tormenta de verano avanzando sobre el desierto, origen del fallo de refrigeración que apagó 5.000 servidores
5 min read

Your servers can be switched off by someone you never signed anything with

On 13 August more than 5,000 servers were powered off in a building in Phoenix, taking down the websites, email and DNS of thousands of companies. The decision to shut down was the right one; what is interesting is the chain the order came down, because the end customer sits at the bottom of it with no contract with whoever decides. What to ask about the building your hardware lives in, and why DNS took down people who were not even there.

Datacenter Colocation Disaster Recovery
Read more →
  • 1
  • 2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN