Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Parte trasera de un armario de servidores con los latiguillos de red saliendo de cada nodo hacia los de al lado
10 min read

The switchless Ceph mesh has four variants. Two of them break on one cable

Three nodes wired directly to each other at 25 GbE, with no switch to buy, is one of the best decisions you can make on a small budget. Proxmox documents four ways to wire it and only two survive a single link going down: in the other two, its own wiki says, "the nodes now have a different view" and Ceph reports services as down that are perfectly alive. Since Proxmox VE 9 that mesh is configured from the web interface, with four fabric protocols. And the official documentation still labels that layer tech preview.

Proxmox Ceph Networking
Read more →
Bastidor de paneles de parcheo de fibra óptica con mazos de latiguillos naranjas
9 min read

43 CVEs in your array's fibre switch, and not one is critical

On 8 October 2026 the NVD published 43 Brocade Fabric OS vulnerabilities on the same day. None critical, the highest 8.7, and 38 of the 43 require credentials. Those three numbers are precisely why nobody will patch this. Inside: the attacker the batch imagines does not come from the internet —it is another switch in your own fabric—, why the 7.1 on CVE-2026-87659 misleads, the maintenance-window excuse dismantled with the vendor's own documentation, the two version branches that do not line up, and four ownership questions instead of a checklist.

Storage Cybersecurity Datacenter
Read more →
Técnico agachado con un portátil delante de un armario de servidores abierto en una sala técnica
7 min read

Read-only in the backup console was not read-only

On 6 October 2026 Veeam published advisory KB4934 with three Backup & Replication vulnerabilities. Two of the three are triggered by the same role: Backup Viewer, the one handed out without a second thought because it is there for looking. The worst reaches 9.4 and runs code on the backup server; the other, scored 6.1, allows deleting the Enterprise Manager master key, which is the documented mechanism for decrypting a backup when the password is lost. Inside: the table of all three CVEs with their vectors, why PR:L is the part that matters, and the role assignment list no recovery plan includes.

Backup Continuity Vulnerabilities
Read more →
Panel de servicio de una librería de cintas con el testigo de aviso encendido y las llaves puestas
6 min read

Dell published the advisory on 1 October. The CVE records landed five days later

Dell advisory DSA-2026-448, carrying two CVSS 10.0 flaws in Container Storage Modules, is dated 1 October 2026. On 6 October we queried its thirteen own CVE identifiers against the public CVE Services API and watched them being published live, one every four or five minutes and in descending order of severity. When they reached NVD, they reached it without a CPE. Inside: the table of timestamps to the second, and why your scanner still cannot tell you whether you are affected.

Vulnerabilities Kubernetes Patching
Read more →
Armario de cableado de red con latiguillos de pares trenzados y paneles de parcheo
8 min read

The Azure outage: four doors and the place your plan B lived

On 30 September 2026, a five-hour-forty-five-minute incident on Azure. Of the five services Microsoft lists as impacted, four are the road to your infrastructure and the fifth is Azure VMware Solution. Inside: what the official 7Q30-010 record does and does not say, the real detection clock, why the region figure going round is not in the source, and what happens to your contingency procedure when the thing that fails is the console.

Cloud Infrastructure High availability
Read more →
Filas de bahías de disco SAS en servidores de almacenamiento montados en rack
13 min read

You set noout to upgrade Ceph and switched off re-replication

The Ceph upgrade procedure on Proxmox recommends, as its fourth step, that you run "ceph osd set noout": "optional, but recommended", says the wiki. Ceph's own OSD troubleshooting page says this is "more a thought exercise" than a suggestion that anyone "in the post-Luminous world" should run it. Both sentences are published today and both are defensible. What that flag switches off is not rebalancing: it is a "down" OSD ever reaching "out", which is precisely the step that makes CRUSH recompute and recreate the missing copy. And the flag does not tell the disk you rebooted apart from the disk that genuinely died. Inside: why mon_osd_down_out_subtree_limit already brakes the scenario that actually frightens you, the chain almost nobody spells out (degraded PGs are not flagged as clean, and what is not clean is not scrubbed, so checksum verification stops on exactly the data that just lost a copy), the arithmetic of the two warnings arriving at 10.5 and 12.25 days to a dashboard that has been amber since minute one, the table of what each flag really switches off, and the four commands that do the same job on one disk or one host without touching the rest of the cluster.

Ceph Proxmox Storage
Read more →
Subestación eléctrica de alta tensión con aisladores, embarrados y un transformador
7 min read

6,329 MW granted to data centres and none in service

The figure ran this morning in the energy press, so nobody in IT is going to read it: for the first time Spain's grid operator has published the breakdown by consumption type of the access capacity granted on the transmission network, and data centres take the largest slice —6,329 MW, 34.2% of the total— with 0 MW in service. Industry, with less capacity granted (5,838 MW), already has 4,346 energised: 74% against 0%. We do the three divisions that are not in the release, and one of them is that more than half the power Spain has promised and not yet delivered is spoken for by server rooms. But the part that made us stop is a different one: in February the network was "75% taken" and today there is margin at more than 35% of nodes, with the improvement coming not from new construction but from revising the CNMC calculation scenario —firm capacity up at 204 nodes, flat at 658, down at 75—. Of the three figures in circulation, only "in service" is physical. What that means the day you ask to go from 4 to 8 kW per rack, why the dangerous answer is not "I cannot" but "you can have them down a single feed", and the four-line annex we suggest stapling to the colocation contract —ours included—.

Colocation Datacenter Infrastructure
Read more →
Sala de servidores con racks cableados y un módulo de gestión de potencia
9 min read

Moving to Proxmox 9.2 wasn't your call: the repository made it

Ask whoever runs your cluster who decided to go from 9.1 to 9.2, and in which meeting it was approved. In most places nobody decided: Proxmox VE ships no repository per minor version —there is nothing like a pve-9.1-security— so a routine apt dist-upgrade, the same one applying the patches you do want, leaves you on the latest published minor. The software that takes your backups does have a supported-version matrix, and it runs behind: Proxmox VE 9.2 shipped on 21 May 2026 and the Veeam plug-in covering it arrived on 29 July, 69 days later. And one detail misleads: plug-in 3.3 for the 13.0 branch shipped on 25 August, twenty-seven days AFTER 4.0, so "I am up to date" can mean up to date on the branch that does not carry the new support. Nothing turns red; what you lose is the right to open a case. The three facts that must live on the same line before you open the window, why the right order is matrix first and apt second, the ARM architecture boundary, and where this crack does not exist.

Proxmox Backup Maintenance
Read more →
Armario de red mural de una pequeña empresa con un conmutador y cables sin ordenar
7 min read

Windows Server 2016 ESU is billed from 12 January, whenever you buy it

Windows Server 2016 leaves support on 12 January 2027, 104 days from now. Everyone repeats that; the Azure Arc billing page, less so: licences provisioned after that date are back-billed to 12 January, the charge appears as a separate line item, deactivating and reactivating does not avoid it, deleting and recreating does not either, and Microsoft writes that "there are no conditions under which it can be avoided". Deferring stops being free. And before the price comes eligibility, which is where many smaller companies fall out: on-premises ESU requires Software Assurance or an equivalent Server Subscription, SPLA is not available for 2016, neither is the Visual Studio benefit, and transitioning from Volume Licensing is not supported with Azure Arc. Also: why the bill is decided by how you count cores —16 physical per machine or 8 virtual per VM, with Microsoft's own 1,024-versus-506-core example—, what to ask your CSP now that no list price has been published, and the option that is not on the slide.

Windows Licensing Infrastructure
Read more →
Bahías de disco de un servidor con bandejas medio extraídas y huecos vacíos
8 min read

Your redundancy assumes the spare arrives tomorrow

A drive dies on a Tuesday and nothing happens: that is what you paid the replica for. But what you bought is not immunity, it is a window of time in which to replace the part before the next failure — and that window was calculated assuming the spare arrives tomorrow. Western Digital told its earnings call it was "pretty much sold out for calendar year 2026" and Seagate said its nearline capacity was "fully allocated" for the same period, with cloud agreements now reaching into 2027 and 2028. We run the arithmetic on Backblaze's published failure rates: with the spare in 48 hours, the probability of a second failure before the repair is 0.18%; with the spare in 20 weeks, it is 11.5%. Same design, same drives, 66 times the risk from a variable that appears in no diagram. Where it hurts most (the node, not the disk), the retention cut nobody signs off, and the six questions we ask now before approving a design.

Infrastructure Storage Continuity
Read more →
Pasillo entre armarios de servidores en penumbra, con centenares de indicadores luminosos encendidos a la vez
7 min read

Retry storms: the second outage is the one you cause

On 12 June 2025 Google Cloud went down hard. 40 minutes in, the mitigation had been rolled out and regions started to recover, the smaller ones first; us-central1 was not fully resolved until 2 h 40 min after the incident began. What stretched that region was not the bug: it was the retries. The public incident report says it plainly —"Service Control did not have the appropriate randomized exponential backoff implemented to avoid this"— and describes a herd effect on the Spanner table everything depended on. Here we cover where that same mechanism lives in an ordinary company (the cron job that takes longer than its interval, the overlapping backup, the sixty desktops booting at once when the power comes back, the monitoring that pushes hardest when it hurts), why three retries across three layers mean 64 attempts against your database, the four numbers you need written down, and when NOT to touch anything.

High availability Infrastructure Monitoring
Read more →
Nodos idénticos apilados en un rack, cada uno con su pantalla y su etiqueta
9 min read

Your three-node Ceph does not heal itself: it holds on

A dead disk in a three-node cluster fixes itself provided another disk remains on that same server: the CRUSH rule descends to another OSD on the same host. A dead HOST does not. With replica 3 and the failure domain set to "host" — what Proxmox ships by default — there is no fourth place to put the third copy, so placement groups sit at active+undersized+degraded until the node comes back. And the cluster keeps serving, which is exactly why nobody looks at it. Ceph's real timers (20 seconds, 10 minutes, 15 minutes), what you cannot touch while the degraded window lasts, why recovery can cost you corosync quorum, and why the number that matters is not how many nodes you have but how many distinct places.

Ceph Proxmox Storage
Read more →
Sala de servidores con el pasillo de racks y el cableado de red ordenado
8 min read

Kubernetes expires every fourteen months, and you cannot skip versions

On 27 October 2026 the Kubernetes 1.34 branch stops receiving patches, and that date has been published since the version shipped. The project supports each branch for "roughly fourteen (14) months" — twelve months plus two in maintenance mode — and only the three most recent minor versions. Subtract the published end-of-life dates and you get the number that matters: a version expires every four months. What maintenance mode actually means, why the control plane cannot skip versions on upgrade, how much slack the nodes have, and why that slack makes a cluster look healthy while it drifts.

Kubernetes Infrastructure DevOps
Read more →
Rack de comunicaciones con paneles de parcheo, latiguillos de red y una bandeja de fibra en la parte baja
5 min read

The DDoS that takes you down is not in the headlines

In the first half of 2026, 96.62% of the network-layer attacks Cloudflare mitigated stayed under 500 Mbps and 90.60% ended in under ten minutes. The attack that makes the press is measured in tens of terabits; the one that will take a mid-sized company offline fits inside an ordinary fibre link and is over before anyone picks up the phone. Why the metric that matters is time to activation and not terabits of capacity, what changes now that DNS floods have gone from 25.7% to 40% in a single quarter, and the five questions we ask before buying any mitigation.

Networking DDoS Cybersecurity
Read more →
Batería de torniquetes de acceso vacíos en el vestíbulo de una estación de metro
9 min read

Ingress NGINX: half of Kubernetes was maintained by two people

The kubernetes/ingress-nginx repository is archived read-only and its last release is dated 19 March: 187 days without a new release. This is not neglect, it is a deliberate retirement, and the reason signed by the Kubernetes Steering Committee and Security Response Committee was not a CVE: the component that publishes half of all cloud native environments to the internet was maintained by "one or two people working in their free time". What to check today with one command, why migrating to Gateway API is not translating YAML, and the five behaviours your routing has that nobody chose.

Kubernetes Containers Infrastructure
Read more →
Cabina de disco montada en rack, con dos filas de bandejas de disco y sus pilotos de actividad
10 min read

Moving to Proxmox and reusing your SAN: the snapshot is what does not travel

The array is paid for, so it stays: the cheapest-looking decision in the project and the one that changes your day-to-day the most. In Proxmox the snapshot is not taken by the hypervisor but by the storage plugin, and on a shared LUN with LVM-thick the documentation says «snapshots are not possible by default…». What fixes that has been labelled a technology preview since 9.0, and the vendor puts it in writing on its own roadmap. The seven real options and the decision tree we are willing to sign.

Proxmox Virtualization Storage
Read more →
Armario de red de pared en una sede pequeña: switch de 16 puertos, router, ONT y cableado desordenado
5 min read

In the branch you did not buy a firewall: you bought an SD-WAN checkbox

Arista is retiring VeloCloud Security VNFs: the Fortinet, Palo Alto or Check Point firewall running inside the Edge loses support on 28 February 2027, and 5.2.x is the last release that carries it. What expires is not a licence, it is the idea that the branch firewall was ever yours: the day branch security became a checkbox inside the transport product, its calendar stopped being yours.

SD-WAN Networking Cybersecurity
Read more →
Varios servidores de 1U apilados en un rack, con cableado de red blanco recogido y pantallas LCD de estado en el frontal
13 min read

Ceph changes cipher: rebooting the virtual machine does not refresh the key

On 9 September Proxmox published the procedure to migrate cephx keys from aes to aes256k. The hard part is not cryptographic: it is knowing what counts as "refreshing a client". The documentation says it in six words — "A guest reboot is not enough" — and the failure does not show up when you run the command, but minutes or days later, when a ticket expires. What has changed since August, the kernel 7.0 gate, and the order we follow.

Ceph Proxmox Storage
Read more →
Pasillo de un centro de datos con dos filas de armarios de rack idénticos
9 min read

The cluster picks a node by counting guests: anti-affinity in Proxmox VE 9 and the rule nobody declares

When a node goes down, the Proxmox VE scheduler decides where your HA-managed machines come back up. On a freshly installed cluster it does that by counting active guests: it has no idea that 101 is the second leg of 100. Proxmox VE 9.0 brought affinity rules so you can tell it, with an asymmetry worth knowing — the rule that pins a guest to a node is a preference, the rule that keeps two guests apart is an order — and an arithmetic that decides whether your VM comes back degraded or does not come back at all.

Proxmox High availability Virtualization
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN