Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis

Cybersecurity

IT Trends

Filter by:

Escritorio con un portátil de pantalla apagada, una libreta abierta con anotaciones a mano y una taza de café

12 Oct 2026 9 min read

The SDK behind your AI agents has six new advisories. Your scanner says zero

Between 28 September and 5 October 2026, the Model Context Protocol Python SDK published six security advisories, three of them scored 7.5. As of 12 October none of the six appears in OSV, nor in the global GitHub database that fires Dependabot, nor in the PyPI API that pip-audit queries by default; the only one carrying a CVE is not in the NVD either. We checked it with two public API calls you can repeat in a minute. And two of the six state in writing that upgrading, on its own, fixes nothing.

AI Automation Vulnerabilities

Disco duro externo conectado a un portátil sobre una mesa de despacho

5 Oct 2026 7 min read

The clone doesn't carry the .git/config. The ZIP does

Four CVEs published in August and September 2026 describe the same sequence: you open a folder with an AI coding agent, the agent calls git to work out where it is, and that folder's local configuration runs a program with your credentials before anybody asks whether you trust it. Inside: what git's documentation says about core.fsmonitor, why an ordinary clone does not work as a delivery route, why the ownership check git does have is disarmed by the most ordinary gesture there is, and the trick that hides the key from your own grep.

AI Cybersecurity DevOps

Oficina diáfana vacía con mesas de trabajo al fondo y una zona de sofás en primer plano

27 Sep 2026 10 min read

AI speeds up what you write, not what you can deploy

Of the two things DORA said about AI in 2024, in 2025 it observed the opposite for one — delivery throughput flipped sign — and exactly the same for the other, which is the one that costs money: more AI still comes with less delivery stability. Two consecutive reports, same sign. With the METR trial that measured a 19% slowdown where participants perceived a 20% improvement — and the caveats its own authors published afterwards, including a second trial with intervals that cross zero — what the 2026 ROI report assumes in money (one point of change failure rate, $344,000) and the four things that have to take more flow before you buy anything: an environment that looks like production, small batches, a timed rollback and telemetry by symptom.

AI Automation Data

Pasillo de un archivo con estanterías compactas llenas de cajas de archivo numeradas

26 Sep 2026 9 min read

The first AI-agent breach is on file. The hard part was being able to describe it

On 14 September the Spanish data protection authority published that it had received the first notification of a personal data breach that "would have been executed by means of an artificial intelligence agent" — its own conditional. The whole attack fits in one sentence, and the authority warns the information comes from the affected organisation and is still pending analysis. We read those four phases as what they will eventually be for somebody else: a regulator's form with a 72-hour clock on it. Which record you need to write each sentence, why "autonomously" is inferred rather than logged, what the authority now expects in writing in your risk assessment, and why three of the four phases are stopped by boring things that involve no AI at all.

AI Compliance Cybersecurity

Dos portátiles abiertos sobre una mesa de oficina y una mano escribiendo sobre unos papeles

19 Sep 2026 7 min read

The agent pinned the plugin's commit. Git handed it the attacker's branch

Plugin4Shell affects the four most widely used AI coding agents: they clone the plugin repository, check out the pinned commit and never verify they landed on it. We reproduced in the lab, with git 2.43, the git behaviour it rests on: exit code 0, a warning nobody reads, and the attacker's content in the working tree. The same 40-character string gives a different answer depending on which git command reads it, so auditing with git log is no help. And today's defence today depends above all on where the plugin repository is hosted.

IA Cybersecurity DevOps

Rack de una pequeña oficina con panel de parcheo, latiguillos y equipos de red apilados

12 Sep 2026 9 min read

The AI agent will not show up in your log: whoever lent it the token will

Connecting an assistant to SharePoint or the ERP is not an integration decision, it is a delegation decision. The Model Context Protocol specification, revision 2026-07-28, forbids forwarding somebody else's token in capital letters, and spells out why: the destination system's logs will show a different identity from the one that made the request. We go through the spec, the permission fallback that asks for everything on offer, the CVE in the official SDK, and the seven questions we ask before connecting anything.

AI Automation Identity

Sala de control con un muro de pantallas de monitorización y varias personas mirándolo de pie

8 Sep 2026 10 min read

AI now finds zero-days on its own. Your problem is the 43 days that come after

On 4 September OpenAI launched GPT-6 Astra and declared it the first model it deploys reaching the "Critical" cybersecurity capability level of its preparedness framework. Almost all the coverage went after that half. The two numbers that decide what happens to you predate Astra and neither is about finding flaws: mean time to exploit is minus seven days according to M-Trends 2026, and the median to fully remediate a KEV-listed vulnerability is 43 days according to Verizon's DBIR. The bottleneck was never finding.

Patching AI Cybersecurity

Cuarto de instalaciones de una oficina con un ordenador de sobremesa y un conmutador de red pequeño en una estantería metálica, junto a una caja de cables y material de limpieza

6 Sep 2026 9 min read

Kestra, 10 out of 10: the flaw that does not need to face the internet

On 2 September 2026 CISA added seven exploited flaws to the KEV catalog. Three were perimeter appliances; another three are services your own team stood up (JFrog Artifactory, Kestra and LiteLLM), and the seventh, Starlette, nobody installed at all. The Kestra one scores 10.0 and opens because an authentication filter uses endsWith instead of an exact comparison. And the advisory says internet exposure is not required: reaching the port from inside is enough. What that changes in your patching queue.

Cybersecurity Automation AI

Sala de reuniones vacía con seis portátiles cerrados sobre la mesa y cargadores enredados

31 Aug 2026 5 min read

The warning came from Anthropic, not from your antivirus

On 30 August it emerged that Anthropic was warning Claude users that an infostealer had taken their browser session. Coverage treated it as an AI story. If somebody at your company got that email, it is something else: it is an infection report for a machine in your estate, signed by a supplier that is not yours and spotted through billing. We go through why MFA never even enters the picture, the five critical events that do cut a session in Microsoft Entra and the one missing from that list, the real arithmetic of revocation (1 hour, 28 hours, up to 15 minutes of latency, up to a day for a group change) and where the purpose-built defence against token theft stands today: in preview precisely in the browser, which is where this happened.

AI Cybersecurity Identity

Sala de reuniones pequeña y vacía, con un altavoz de conferencia sobre la mesa, sillas desordenadas y luz natural entrando por la persiana

25 Aug 2026 5 min read

Teams can now block meeting bots: it ships turned off

On 21 August Microsoft announced (MC1459141) that admins will be able to automatically block detected external bots in Teams meetings. We read the documentation for the ExternalBotAccessMode parameter: the word doing all the work is "detected", the new mode has to be assigned through policy, and it touches neither Copilot nor the assistant recording from your client's tenant. What actually decides where the transcript ends up — and when we would not switch it on.

Teams Microsoft 365 Workplace

Armario metálico de llaves abierto en la pared de una sala de máquinas, con llaves colgadas de sus ganchos y varios ganchos vacíos

23 Aug 2026 5 min read

88% of leaked AWS keys still work

On 10 August Truffle Security re-tested 10,616 AWS credential pairs that had surfaced publicly since August 2022 and 88% still authenticated. Of those traceable to a company, 768 out of 817 granted full control of the account. The median age is 1,831 days and the oldest predates IAM itself. Separately from that tally, Hugging Face holds another 8,482 live keys across 3,394 public datasets.

Cybersecurity AI Identity

Cuadro eléctrico industrial abierto en una sala técnica, con embarrado de cobre, magnetotérmicos en carril DIN y cableado de potencia

22 Aug 2026 5 min read

Colocation is no longer negotiated in U: it is negotiated in kW

In the first half of 2026, AI cloud providers signed 420 MW of colocation capacity in Europe. In the same period a year earlier they signed 89. Powered land in the big markets costs 82% more than in 2021. None of that raises your invoice tomorrow, which is exactly why it is worth looking at today: what changes is not the price of a rack unit, it is what your contract actually measures.

Colocation Datacenter Infrastructure

Sala de servidores en penumbra con un armario de red abierto y una etiqueta de inventario despegada colgando de un cable

19 Aug 2026 7 min read

Your documentation is lying to you. And so are your validations

A document does not age: it expires, and it does so silently. Markdown cannot tell the difference between what you checked, what can be checked, and what you assumed, so six months later all three read the same. We tell the real case that led us to build validated-memory: evidence states, supersession without deletion, and freshness probes with three answers instead of two. Released as open source under Apache-2.0.

Documentation DevOps Open Source

Puesto de trabajo vacío de noche en una oficina pequeña: portátil cerrado, teclado mecánico, taza fría y flexo encendido

18 Aug 2026 5 min read

Five days, an issue title and a Jira token

On 17 August Wiz described how it pulled a Jira token out of Snowflake by opening an issue on a public repository: the issue title was the exploit. The line that allowed it had gone in five days earlier, in a change meant to tidy the code up, and it replaced the safe pattern that GitHub's own documentation recommends in writing. What failed in the review chain, why the "if" that looked like a filter filtered nothing, and what we look at in a pipeline.

CI/CD AI GitHub

Paso fronterizo vacío con la barrera levantada: la frontera de datos europea sigue dibujada y el tráfico pasa igual

12 Aug 2026 5 min read

Three settings decide whether Claude processes your documents in Copilot, and one was decided by your tenant's creation date

Microsoft turned Anthropic models on by default in Microsoft 365 Copilot, but not in the EU. There are three separate settings with three different defaults, one of them depends on whether the tenant was created before or after 25 March 2026, and Microsoft's own documentation sends you to the Message Center to find out yours. What each source says, what cannot be inferred from them, and the twenty-minute review.

AI Microsoft Regulation

CVE-2026-9198 en Langflow entra en el catálogo KEV de CISA el 4 de agosto de 2026: la capa de IA y automatización autoalojada (Langflow, n8n, Open WebUI) tratada como producción

5 Aug 2026 5 min read

The AI pilot nobody switched off is already production

On 4 August, CISA added a 9.8 in Langflow to its exploited-vulnerabilities catalogue: one endpoint that hands superuser tokens to anyone who reaches the port, chained with another that runs whatever code you send it. The patch had been out for six weeks. It is not an isolated case: in Open WebUI the ENABLE_CODE_EXECUTION=false switch turned nothing off, and in n8n anyone who could edit a workflow could run commands on the host. Three products, the same starting assumption. What we do with the AI and automation layer, and when we recommend not self-hosting it at all.

AI Automation Cybersecurity

El AI Act ya aplica desde el 2 de agosto de 2026: qué obligaciones entraron de verdad, qué aplazó el Ómnibus digital sobre IA y el checklist de inventario de everyWAN

5 Aug 2026 5 min read

The AI Act already applies to you — and not for the reason the headlines gave

On 2 August the bulk of the EU AI Act became applicable. Six days earlier, the Digital Omnibus on AI (Regulation EU 2026/1744, in force since 27 July) pushed high-risk obligations to December 2027 and August 2028. What does apply from 2 August is Article 50 — transparency — with fines of up to €15M or 3% (the lower amount for SMEs) and a date almost nobody wrote down: 2 December 2026. What actually changed, where Article 25 really bites, and the inventory checklist we run on a Microsoft 365 tenant.

AI Compliance Regulation

Google corrige 1.072 fallos de seguridad de Chrome con agentes de IA y pasa a publicar un hito cada dos semanas

1 Aug 2026 5 min read

Google fixed 1,072 Chrome bugs with AI: the bottleneck is now you

Chrome 149 and 150 fixed 1,072 security bugs, more than the previous 23 releases combined, with AI agents that find, reproduce, triage and patch. But the number is not the story: Chrome is moving to a milestone every two weeks and piloting two security releases a week. What really changes in your patch cycle, why counting CVEs no longer measures anything, and which of your software will never get this treatment.

AI Maintenance Chrome

Antenas de radiotelescopio al anochecer: la adolescencia tecnológica de la humanidad según el ensayo de Dario Amodei

30 Jul 2026 12 min read

The adolescence of technology: reading Dario Amodei's essay with our hands in the mud

In January 2026 the CEO of Anthropic published a twenty-two-thousand-word essay on the five risks of powerful AI and on whether we are ready for them. His answer is no. We read the whole thing from inside a company that deploys automation and AI on real infrastructure: the five risks laid out, an honest scorecard, the four points where we do not buy his argument — including one almost nobody has reported correctly — and what a company that does not build models should be doing today.

AI Society AI Ethics

28 Jul 2026 7 min read

Proxmox joins NVIDIA's ecosystem: a logo will not migrate your infrastructure

Today Proxmox Server Solutions announced it is joining the NVIDIA Mission Control ecosystem: Proxmox VE as the virtualisation and high-availability layer beneath the management services of AI factories, with engineering work for the Grace and Vera CPUs. What the announcement actually says, where Proxmox sits in that picture and where it does not, and why an announcement changes the conversation in a boardroom but changes none of the things that decide your migration.

Proxmox NVIDIA Virtualisation

1
2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

I agree to receive commercial communications from MINORISA DE SISTEMAS INFORMÁTICOS Y DE GESTIÓN, S.L., in accordance with the privacy policy, which I have read and accept without reservations, which contains additional information about the processing of my data and about the exercise of my rights of access, rectification, restriction, erasure, objection and portability.

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026

Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel

LOGIN REGISTER

Language
- ES
- CAT
- EN