Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis

Cybersecurity

IT Trends

Filter by:

Armario de red de pared con equipamiento y cableado a la vista

16 Oct 2026 6 min read

PAN-OS CVE-2026-0322: there is no single patch, there are twenty

Palo Alto published the advisory on 14 October 2026 with exploitation already observed, and CISA added it to the KEV the same day with a 17 October federal deadline and the forensic triage flag set. When you open the advisory looking for the patch, you do not find one: you find twenty fixed versions across five branches, six in 11.1 alone, because the vendor fixes on the maintenance train you are already on. What the advisory actually says, what pushes the 8.6 up and down at once, why Panorama is the piece that hurts most, and the five things we would do this week.

Cybersecurity Vulnerabilities Networking

Interior de un armario de comunicaciones con regletas de conexión, latiguillos y un equipo montado en la pared

15 Oct 2026 9 min read

The fix needs no window and no restart, which is why it may not be in place

On 14 October Cisco published a 9.8 flaw in its email gateway, exploited before the advisory went out. The striking part is not the score: it is that the fix ships as a scanning-engine package that "does not require a software upgrade or a product restart". That sounds like good news, and it is precisely what keeps it out of your patching process, which is built from tickets, windows and restarts. What to look at before that engine changes version, and why for an arbitrary file write "patched" does not mean "clean".

Cybersecurity Patching Vulnerabilities

Puestos de trabajo con monitores y teclados en una oficina diáfana

14 Oct 2026 8 min read

Mark of the Web: seven ways a file from outside stops looking like one

On Tuesday Microsoft patched a Windows Shell flaw already under exploitation, and its own entry says it let an attacker "evade Mark of the Web (MOTW) defenses". Before getting to that bug it is worth reading the Office documentation: the banner that blocks macros in an attachment depends on a tag which, by Microsoft's own account, has four ways of never being applied and three more of not deciding anything. And the policy that would make it mandatory is not available in every plan.

Windows Workplace Microsoft 365

Filas de puestos de trabajo idénticos en una sala: mismos monitores, mismos teclados, misma imagen instalada

13 Oct 2026 8 min read

Windows 11 24H2 stops getting updates today, and your fleet is on the latest build

Today, 13 October 2026, Windows 11 version 24H2 stops receiving updates on Home and Pro. Microsoft's own table lists the same cumulative update, KB5124010, in four rows with four different end dates, and two of those rows carry the identical build number: 26100.9550. One expires today; the other, the IoT Enterprise LTSC line, has extended support until 2034. The date is not in the code: it is in the edition and the channel.

Windows Patching Maintenance

Módulo de distribución eléctrica junto a racks de servidores con cableado, en la sala de un centro de datos

9 Oct 2026 9 min read

Both power cords on your server go to the same strip

A+B power does not buy you a site where the lights never go out: it buys you one where half the electrical installation can be taken out for maintenance without you noticing. That promise assumes every device in your rack has two cords, each on a different path; the second signature on that contract is yours.

Colocation Datacenter Infrastructure

Hilera de volantes de válvula industriales en un nicho de hormigón, fotografía documental en blanco y negro

9 Oct 2026 9 min read

FortiMail: patch out on the 2nd, advisory on the 7th, mitigation still on

On 1 October Fortinet published a 9.8 flaw in FortiMail, exploited and with no fixed release. The only mitigation available was to switch off IBE encryption: the channel your company uses to send confidential documents to people outside it. The fixed release notes are dated 2 October; the advisory did not say so until the 7th. If your trigger for removing the mitigation is the advisory, your clock runs five days behind. Inside: the branch table (including the branch that gets no patch), the indicators Fortinet did publish, what the public documentation does NOT answer, and a six-line record so a temporary mitigation does not last six months.

Cybersecurity Patching Vulnerabilities

Armario rack de pared con un switch de 16 puertos y cables de red

5 Oct 2026 8 min read

Your unattend.xml carries the domain password in clear text

The file you install machines with over the network contains the account that joins them to the domain, written as-is. That is not sloppiness: it is the example in Microsoft's own documentation. Inside: why PlainText false does not mean encrypted, what CVE-2026-0386 says about the channel that file travelled over, why the January 2026 update mitigated nothing until somebody touched the registry, and why switching the feature off does not rotate the credential already handed out.

Windows Maintenance Cybersecurity

Sala de servidores con racks cableados y un módulo de gestión de potencia

30 Sep 2026 9 min read

Moving to Proxmox 9.2 wasn't your call: the repository made it

Ask whoever runs your cluster who decided to go from 9.1 to 9.2, and in which meeting it was approved. In most places nobody decided: Proxmox VE ships no repository per minor version —there is nothing like a pve-9.1-security— so a routine apt dist-upgrade, the same one applying the patches you do want, leaves you on the latest published minor. The software that takes your backups does have a supported-version matrix, and it runs behind: Proxmox VE 9.2 shipped on 21 May 2026 and the Veeam plug-in covering it arrived on 29 July, 69 days later. And one detail misleads: plug-in 3.3 for the 13.0 branch shipped on 25 August, twenty-seven days AFTER 4.0, so "I am up to date" can mean up to date on the branch that does not carry the new support. Nothing turns red; what you lose is the right to open a case. The three facts that must live on the same line before you open the window, why the right order is matrix first and apt second, the ARM architecture boundary, and where this crack does not exist.

Proxmox Backup Maintenance

Fila de mesas de oficina con los monitores apagados y una silla vacía

25 Sep 2026 8 min read

Office 2021 does not stop working: it stops being tested against Microsoft 365

On 13 October 2026 nothing switches off: Word will open, Outlook will sync and nobody will notice. That day two clocks start at once and only one makes noise. The first is the ordinary end of support — Microsoft stops providing technical support, bug fixes and security updates. The second raises no alert: Microsoft stops checking that its own services still work with your Office, and the outage arrives months later without you touching a thing. The two different dates Microsoft itself publishes, the Office 2016/2019 precedent from 2023, and the finding that decides who is in a hurry: Windows 11 24H2 Home and Pro expires in the very same second, but the Enterprise edition holds on for another year.

Workplace Licensing Microsoft 365

Sala de servidores con el pasillo de racks y el cableado de red ordenado

24 Sep 2026 8 min read

Kubernetes expires every fourteen months, and you cannot skip versions

On 27 October 2026 the Kubernetes 1.34 branch stops receiving patches, and that date has been published since the version shipped. The project supports each branch for "roughly fourteen (14) months" — twelve months plus two in maintenance mode — and only the three most recent minor versions. Subtract the published end-of-life dates and you get the number that matters: a version expires every four months. What maintenance mode actually means, why the control plane cannot skip versions on upgrade, how much slack the nodes have, and why that slack makes a cluster look healthy while it drifts.

Kubernetes Infrastructure DevOps

Armario de comunicaciones con paneles de parcheo y una maraña de cables de red azules

22 Sep 2026 5 min read

The patch for your switch had been out for 97 days

On 21 September CISA added a single CVE to its catalogue of exploited vulnerabilities: a stack-based buffer overflow in the CGI program of Zyxel GS1900 switch firmware, unauthenticated and with command execution. Zyxel published the advisory and the ten fixed firmware builds on 16 June: 97 days earlier. We counted the 30 entries the catalogue has taken in so far this month and the median is 5 days, so the list mixes two different populations. Why "LAN-based" is not a mitigating factor but the attack's requirement, what the small print does not say about models out of support, and why the entry asks for forensic triage before you reflash.

Networking Patching Maintenance

Interior de un servidor de dos zócalos abierto, con los procesadores y dos bancos de módulos de memoria a la vista

18 Sep 2026 8 min read

Patching the kernel means rebooting, and the reboot erases the evidence

CISA added two Linux kernel flaws to its exploited catalogue today, due by Monday. One has sat in your scanner for eleven months rated 3.3 out of 10; the kernel project scores it 7.8 on the very same record. Both entries carry the forensic-triage flag CISA now attaches to two out of every three new additions, and its guidance says not to remediate before collecting evidence. In the kernel, remediating means rebooting. And rebooting erases a good part of what you are asked to keep.

Cybersecurity Linux Patching

Cerro con torres de comunicaciones, antenas parabólicas y radioenlaces contra el cielo

18 Sep 2026 9 min read

MikroTik shipped that port closed: the flaw is theirs, the exception is yours

On 5 September CERT Polska published six RouterOS vulnerabilities; two of them chained give full control of a MikroTik with no authentication, and Shadowserver counted 122,500 devices with SSH reachable from the internet. The vendor's own advisory says its default configuration blocks that port. So the thing to look at is not the CVE: it is who opened the exception, when, and why nobody gave it an expiry date.

Networking Cybersecurity Vulnerabilities

Armario de red de pared en una sede pequeña: switch de 16 puertos, router, ONT y cableado desordenado

17 Sep 2026 5 min read

In the branch you did not buy a firewall: you bought an SD-WAN checkbox

Arista is retiring VeloCloud Security VNFs: the Fortinet, Palo Alto or Check Point firewall running inside the Edge loses support on 28 February 2027, and 5.2.x is the last release that carries it. What expires is not a licence, it is the idea that the branch firewall was ever yours: the day branch security became a checkbox inside the transport product, its calendar stopped being yours.

SD-WAN Networking Cybersecurity

Parte trasera de un chasis de servidor con módulos de ventilador y cables de alimentación

17 Sep 2026 10 min read

Acronis Backup: "requires local access" — and that access is what you sell your customers

On 15 September Acronis published a one-sentence advisory: local privilege escalation through insecure file permissions in its backup plugin for cPanel and Plesk, CVSS 7.8, exploited in targeted attacks. A "local" 7.8 is exactly the CVE almost every patching queue pushes to next week. On a machine with a single administrator, that call is defensible. On a server where every customer gets their own system user, the requirement for "local access with low privileges" is not describing a barrier: it is describing your business model.

Cybersecurity Backup Patching

Ordenador abierto sobre el banco de trabajo de un servicio de reparación informática

12 Sep 2026 10 min read

Remote support: the file runs on the technician's machine

On 11 September, CISA added a ConnectWise ScreenConnect advisory to its catalogue of exploited vulnerabilities. The detail almost nobody highlights comes from the vendor itself: "ScreenConnect servers are not impacted". The machine that ends up running the file is the one support is given from. Three days earlier, N-able N-central had entered the same list with a 10.0. We counted the whole catalogue: fifteen entries in 2026 for software whose job is governing other people's computers. Windows, thirteen.

Maintenance RMM Cybersecurity

Sala de control con un muro de pantallas de monitorización y varias personas mirándolo de pie

8 Sep 2026 10 min read

AI now finds zero-days on its own. Your problem is the 43 days that come after

On 4 September OpenAI launched GPT-6 Astra and declared it the first model it deploys reaching the "Critical" cybersecurity capability level of its preparedness framework. Almost all the coverage went after that half. The two numbers that decide what happens to you predate Astra and neither is about finding flaws: mean time to exploit is minus seven days according to M-Trends 2026, and the median to fully remediate a KEV-listed vulnerability is 43 days according to Verizon's DBIR. The bottleneck was never finding.

Patching AI Cybersecurity

Sala de servidores de empresa de noche, con las luces apagadas, la puerta entreabierta a un pasillo iluminado, un taburete vacío junto al rack y un carro de servicio aparcado en el pasillo

5 Sep 2026 5 min read

Proxmox goes 24/7 on 19 October: what those two hours actually buy you

On 2 September 2026 Proxmox announced that its enterprise support goes 24/7 on 19 October, and opened a North American subsidiary. Until now it ran Monday to Friday, 07:00–17:00 CET/CEST, on Austrian business days. What each plan includes, what it really costs per CPU socket, the three asymmetries sitting inside the announcement itself —response is not resolution, local support stays office hours, and the scope is three products rather than your system— and the six questions for reading any 24/7 support contract, your provider's included.

Proxmox Support Virtualization

Actualizar Ceph de Squid a Tentacle en Proxmox: la ventana en la que el clúster corre en dos versiones

2 Sep 2026 9 min read

Ceph to Tentacle: during the upgrade your cluster runs two versions at once

Squid expires on 31 October and Tentacle has been in Proxmox's enterprise repository since July, so the maintenance window is no longer hypothetical. Inside it something happens that almost no plan accounts for: monitors, managers and OSDs restart separately, and the cluster spends hours — or days — split across two versions. Why "restart OSDs on one node at a time" decides your window, why calling noout "optional" is misleading, and the command most people mistake for the finish line.

Ceph Proxmox Storage

Cuarto de impresión de una oficina con una multifunción, cajas de papel y un servidor en una estantería metálica

29 Aug 2026 9 min read

PaperCut: the print server runs as SYSTEM, and nearly half the measured estate has no patch

On 27 August PaperCut confirmed active exploitation of PaperCut NG and MF. The identifiers landed the next day: CVE-2026-81578 (CVSS 8.8) and CVE-2026-82078 (CVSS 9.4), chained into unauthenticated remote code execution. Huntress watched one intrusion last under two minutes, and in their proof of concept the code executes as SYSTEM. The figure that orders everything else: 47% of the 2,500 installations Huntress tracks are on version 23 or older, for which no patch exists. What happened hour by hour, why Thursday's patch did not hold on Friday, and today's notice that turns one of the indicators into a false positive.

Vulnerabilities Patching Maintenance

1
2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

I agree to receive commercial communications from MINORISA DE SISTEMAS INFORMÁTICOS Y DE GESTIÓN, S.L., in accordance with the privacy policy, which I have read and accept without reservations, which contains additional information about the processing of my data and about the exercise of my rights of access, rectification, restriction, erasure, objection and portability.

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026

Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel

LOGIN REGISTER

Language
- ES
- CAT
- EN