Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Escritorio de madera vacío con un portátil abierto y un ratón, y una silla retirada
9 min read

Tailscale checked the path as text and opened it as root

Four Tailscale security bulletins dated 26 October 2026 and a fix tagged last night: the SSH server validated Unix socket paths lexically and then performed the operations as root, with the Docker socket and the tailscaled local API on the other side. What the four bulletins say, what the 42 commits in the fix tell you — including the session recording that could differ from what actually ran — why a mesh is not segmentation, and six checks for this week that do not require waiting for an upgrade.

Zero Trust Cybersecurity Networking
Read more →
Generador de emergencia en contenedor junto a un edificio de noche con la entrada iluminada
10 min read

Four of more than eight hundred recoveries came close to the RTO they had written down

The first annual report from a firm that does nothing but recover attacked companies gives an uncomfortable number: out of more than eight hundred engagements, four came close to the 24-to-48-hour objective the company itself had documented, and none reached full operational capacity until weeks later. The cause is not the backup. A fifth of the first 48 hours goes into standing up a single healthy authentication source, 99.2% of clients arrive with no written plan for that, and 38% of the backups that survived the attack intact still could not carry the recovery. The two columns — what gets declared in surveys and what gets found in the field —, why a well-written continuity plan can be measuring the wrong thing, and the six lines we ask for before discussing RTO with anybody.

Continuity Disaster recovery Identity
Read more →
Primer plano de un teclado de portátil oscuro y gastado, con polvo entre las teclas, iluminado de lado
9 min read

The same IP got into 29 companies and bounced off four

From 14 July to 22 September 2026, Huntress counted 497 valid Microsoft 365 sign-ins across 79 organisations without the attacker ever needing a password. The number that interests us is smaller: over four days one address, 193.26.115.72, logged 1,052 blocked sign-ins that all came from four organisations and got into 29 others where "nothing stood in the way". Same attacker, same stolen tokens, same week. With the mechanics of the theft, the two figures the report contradicts itself on, the Microsoft control that does address this and why its browser version is still in preview, and this afternoon's check on your tenant.

Identity Microsoft 365 Zero Trust
Read more →
Armario de comunicaciones mural de una oficina, con un conmutador de red, un router y un módem conectados con cables de cobre
10 min read

Two hours from a PHP website to the domain hashes

On 21 October 2026 CISA asked for something nobody writes lightly: anyone who cannot patch PHP immediately, or who is still on 8.1 or earlier, should take their PHP-based systems off the network. These are CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 on CVSS v4.0, and the details leaked before the patch existed. But the door is not what interests us: in the case Unit 42 documents against a European government entity, two hours passed between the break-in and the password hashes, the MFA secrets and an NTLM tunnel into Active Directory. PHP did not open that path. With the branch table, the mitigations that do not mitigate, and the twenty-minute check.

Cybersecurity PHP Vulnerabilities
Read more →
Torniquetes de control de acceso con lectores de tarjeta en el vestíbulo de un edificio de oficinas
9 min read

The 49 properties Entra is retiring from your login page are not about design

On 26 October 2026 Microsoft Entra ID starts ignoring 49 CSS properties on your organisation's sign-in page, and before the month is out it blocks any script that is not its own with a content security policy. Read end to end, that list — position, z-index, opacity, visibility, clip-path, pointer-events — is not a layout catalogue: it is the toolbox for making a page show one thing and do another. What changes on each date, why the role that can touch it is not listed as privileged in Microsoft's own documentation, and the six checks you can answer this afternoon.

Identity Zero Trust Microsoft 365
Read more →
Interior de una librería de cintas: filas de ranuras y una unidad de cinta extraída sobre su guía
9 min read

Ransomware: recovering fast is not evicting the attacker

Of the organisations hit by more than one ransomware attack in the last twelve months, 30% suffered them on the same day and another 29% within the same week. That does not measure long-term recidivism: it measures access that was never actually closed. 87% of attacks went after the identity system — Active Directory, Entra ID, Okta — yet recovery plans still restore machines. We go through what each figure in the Semperis report actually measures, the Spanish data point that cuts against that reading, the recovery order Microsoft publishes and almost nobody has written down, and the eight conditions we require before calling an incident closed.

Ransomware Disaster recovery Identity
Read more →
Pasillo de estanterías compactas de archivo, cerradas, con sus manivelas de accionamiento
9 min read

The advisory came 47 days late and your logs last 30

On 15 October BeyondTrust published CVE-2026-102764, a critical flaw in its remote support product that an espionage group had been exploiting since 29 August: 47 days of head start. CISA added it to the known exploited vulnerabilities catalogue on the 16th and gave federal agencies a deadline of today, 19 October. Patching is the easy half; the other half is the day-48 question — were we in it? — and the patch does not answer it, what answers it is what you decided months ago about log retention. With Entra ID defaults (7 days on Free, 30 on P1 and P2) and Defender XDR's 30 days of raw data, 29 August no longer exists in your identity log or your EDR. And Microsoft's own documentation says it plainly: retention is not retroactive.

Cybersecurity Compliance Monitoring
Read more →
Tablero de madera con decenas de llaves colgadas de clavos, cada una con su etiqueta
9 min read

Your Microsoft 365 backup signs in with a key you do not hold

On 17 October ConnectWise cut access to its Microsoft 365 backup service after detecting unauthorised access to application identities. Huntress counted 162 tenants with unauthorised sign-ins. Nobody stole a password and nobody failed an MFA prompt: the application authenticated with its own credential, which lives in the vendor's tenant and not in yours. The uncomfortable part is written in Microsoft's own documentation: Conditional Access for workload identities — the policy that would block sign-ins from outside your known IP ranges — does not cover third-party multitenant applications. We go through what happened with the timestamps attached, why the control you would reach for does not apply, and the four things you can actually do from your own tenant.

Backup Microsoft 365 Identity
Read more →
Una silla vacía retirada de una mesa de madera con un portátil entreabierto y un ratón encima
9 min read

You can now change a meeting organizer; in a shared mailbox, you cannot

Microsoft is rolling out right now the thing every Microsoft 365 admin has been asking for: handing a meeting over to someone else without cancelling it. It arrives enabled by default, with no tenant configuration, and it does not work in classic Outlook for Windows. The real problem is elsewhere: the case that made you want this feature — the weekly meeting of the person who left — is exactly the one Microsoft's own offboarding procedure rules out, because its step 4 converts the mailbox to shared, and meetings in a shared mailbox are not eligible. And that same step 4 still tells you to cancel them all.

Microsoft 365 Workplace Exchange
Read more →
Mesas de una oficina vacía con una silla, archivadores y un monitor apagado
8 min read

The workaround was to turn off Global Secure Access: the advice your own policy blocks

On 13 October, after almost eleven hours of degradation, the workaround on offer was to turn off Global Secure Access. It arrived eleven minutes before the incident was declared over, and in tenants configured the way the documentation recommends that step does not work: turning off the client and being locked out is, literally, the proof that the compliant network check is correctly in place. The right procedure does exist and Microsoft published it in March, with two scripts; what neither of them tells you is how long each step takes to be felt.

Zero Trust Microsoft 365 Identity
Read more →
Parte trasera de un armario con servidores y latiguillos de red azules y verdes
9 min read

They broke into a fully patched appliance and went for the recovery keys

On 13 October, Volexity published its analysis of a fully patched remote access appliance on which someone gained unauthenticated root. The interesting part is not the bug: it is that no backdoor was left behind, that the vendor's integrity checker detects nothing because it all happens in memory, and that what they went looking for inside were LAPS passwords and BitLocker recovery keys. Your continuity plan is written against deletion, and here nobody deleted anything.

Cybersecurity VPN Continuity
Read more →
Estantería de archivo con cajas de documentos numeradas y atadas con cinta de tela
9 min read

SharePoint breaks the "Specific people" link, not the "Anyone" link

During October 2026 Microsoft is retiring SharePoint Online one-time passcode authentication in commercial tenants. You cannot pick the date, you cannot opt out, and it cannot be scoped per site. What stops opening is the named link, the one that made you type the recipient's address; the "Anyone with the link" one carries on unchanged. And the report Microsoft points you to in order to find who you are about to lock out excludes, in writing, links that were emailed and never clicked. What to check, what the EnableAzureADB2BIntegration setting no longer means, and why the right fix is not resharing in bulk.

Microsoft 365 SharePoint Identity
Read more →
Parte trasera de un rack con servidores de 1U, sus puertos de consola a la vista y los mazos de cables recogidos
10 min read

Moving to Proxmox: permissions do not travel, and the role that sounds like "user" opens the console

The migration brings the disks, the configuration and the networks. It brings not one line of the permissions table, and because the two tables look alike in shape, almost nobody rebuilds theirs: they copy it from memory, going by the names of the roles. Inside: the mapping between a vCenter permission and a Proxmox ACL, with its three gaps; the literal definition of the PVEVMUser role —"view, backup, configure CD-ROM, VM console, VM power management"— and why console, CD-ROM and power together do not describe a reader; the question only your installation can answer; the inheritance rule that subtracts instead of adding and bites everyone arriving from Active Directory; the family of privileges that reads and writes files inside the guest, has no mental equivalent in vCenter and is a virtue of the model that nobody uses; root@pam, the unconfined account that cannot be deleted; and the four commands that tell you, the following Monday, who can do what on your cluster.

Proxmox Migration Virtualization
Read more →
Hilera de barreras de acceso con lectores de tarjeta en el vestíbulo de una estación, vacía
9 min read

The replacement risk policy does not cover guests (and the old one never did)

On 1 October the deadline for the legacy Entra ID Protection risk policies fell due. No outage, no warning —just as there was none on 31 July 2025, when those screens went read-only. Inside: the date with the two different wordings Microsoft uses; why almost all the coverage says the policies "stop being enforced" when the original announcement spoke of retiring the interface, and why we will not write a sentence Microsoft has not written; why "migrate" describes a rebuilding job badly, and the order of the two mandatory steps; the two settings the recommended control applies by itself —authentication strength and "every time" reauthentication, the latter mandatory—; the line we found in no guide: "Require risk remediation" is not supported for external and guest users, and the part almost nobody tells you: with the previous policy, you blocked the risky guest with no way of unblocking them and without seeing them in any report; what Microsoft actually recommends for guests —exclude them from risk-based MFA and require MFA always— with its two traps; how to prove it is migrated by reading the log, with the trap of the field called "applied" that also lists the ones that were not; and the exception Microsoft documents with its AppId.

Identity Microsoft 365 Zero Trust
Read more →
Vestíbulo de oficina con una fila de tornos de acceso de cristal alineados y vacíos
8 min read

The Conditional Access policies you never wrote are already in your tenant

Open the Conditional Access policy list in your tenant and look at the Created by column. If any row says Microsoft, nobody in your company wrote that policy: Microsoft creates it in Report-only and switches it on itself "no less than 30 days" later, with two weeks' notice and a note saying it can be sooner. They cannot be renamed or deleted; the only thing you can change is who you exclude —starting with your emergency account—. Which ten exist today, the three that actually break things (device code flow and Teams rooms, legacy authentication and the scan-to-email printer, MFA for all users and licensed service accounts), the detail almost nobody quotes —your P2 license count and MFA registration draw who the risk policy protects— and the audit query that tells you what Microsoft changed in your tenant and when.

Microsoft 365 Identity Cybersecurity
Read more →
Hilera de buzones de correo metálicos alineados junto a un camino de tierra
5 min read

onmicrosoft.com is no longer just an ugly domain: it is the slow lane

On 28 August Microsoft warned (MC1463510) that organisations using only the default domain will face external messaging limits in Teams, with rollout from mid-September. Read on its own it looks like an anti-spam tweak. Read alongside email it is something else: the limit of 100 external recipients per rolling 24 hours for onmicrosoft.com domains finished rolling out to every size band on 1 June 2026, with its own 550 5.7.236 bounce code. The case that catches companies who think they are unaffected, and why fixing it is not buying a domain but changing what people log in with.

Microsoft 365 Exchange Identity
Read more →
Interior de un armario de comunicaciones de planta con switch, panel de conexiones y cableado de cobre y fibra
12 min read

Cisco ISE, a perfect 10 with no workaround: your network already decided what to do without it

On 16 September Cisco published a CVSS 10.0 in Identity Services Engine: an authentication bypass in an API, no workaround available, active exploitation and command execution as root. Before arguing about the maintenance window there are two things to look at: ISE's own access.log, because the advisory ships indicators and the recommendation to re-image the node if anything shows up, and the show run on a floor switch, because that is where what your network will do when the policy engine stops answering is already written. The default value of radius-server deadtime is 0.

Cybersecurity Networking Zero Trust
Read more →
Rack de una pequeña oficina con panel de parcheo, latiguillos y equipos de red apilados
9 min read

The AI agent will not show up in your log: whoever lent it the token will

Connecting an assistant to SharePoint or the ERP is not an integration decision, it is a delegation decision. The Model Context Protocol specification, revision 2026-07-28, forbids forwarding somebody else's token in capital letters, and spells out why: the destination system's logs will show a different identity from the one that made the request. We go through the spec, the permission fallback that asks for everything on offer, the CVE in the official SDK, and the seven questions we ask before connecting anything.

AI Automation Identity
Read more →
Fila de puestos de trabajo vacíos en una oficina
10 min read

Entra ID retires memberOf on 3 November: after that date, membership stops being recalculated

Message centre post MC1448379, published on 5 August, has been read as a deadline. Read it the other way round: if you run a memberOf rule in production, you already have the problem it describes, and the preview documentation says so in a paragraph almost nobody reads. What happens on 3 November is not an outage or an error: memberships stay "in their last known state". That is where licences, Conditional Access and Teams membership hang from.

Identity Microsoft 365 Licensing
Read more →
Mesa de soporte de una oficina con un teléfono fijo de sobremesa, una libreta de anillas, un cordón con llaves y un teclado apartado a un lado
9 min read

The phone number on the record was a credential: Entra ID stops accepting it

Microsoft's own documentation has said it plainly for years: if you fill in a user's mobile phone or alternate email, that user can reset their password immediately "even if they haven't registered for the service". Which means a field written by a sync or by an admin worked as proof of identity. Entra ID is about to stop accepting it. What changes, why the 86% everyone quotes does not mean what it looks like, and the four different dates Microsoft gives for the same cutoff.

Identity Microsoft 365 Workplace
Read more →
  • 1
  • 2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN