Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Tres interruptores de corriente en posición de apagado, cada uno bloqueado con un candado amarillo de consignación
13 min read

Switch off the console that manages every machine, until further notice

On 9 November a vendor advised its customers to switch off the server they manage every machine from, and to leave it off. Six days earlier it had told them to upgrade as soon as possible. Inside: the timeline with the verbatim quotes, why your scanner only sees the layer that has a number, the five entries that product had already collected in the exploited-vulnerability catalogue, and a 48-hour runbook for operating with no management plane.

Continuity Suppliers RMM
Read more →
Armario de comunicaciones de pared abierto, con un conmutador de 16 puertos y una maraña de cables dentro
9 min read

257 bytes open the account you took the password away from

On 5 November 2026 OpenSSH shipped 10.6p2 to close a bug that, by its own developers' account, is not theirs. The musl maintainer says it is not musl's either. Both are right, and a root shell fits between those two sentences. Inside: how three defensible decisions taken in 2012 and 2016 end up comparing an asterisk against an asterisk; why the exploitable accounts are precisely the ones you left key-only; why OpenWrt shows up on every list and is almost never affected; and the four concrete checks for this week.

Cybersecurity Containers Patching
Read more →
Sala de máquinas pequeña: armarios con equipo encendido a la izquierda y, a la derecha, una mesa con un monitor apagado y un teclado
8 min read

A reboot won't recover the box that holds your backups

On 2 November 2026 Veeam shipped the kernel that fixes a 9.8-out-of-10 flaw in its backup appliances. Two days later it published an advisory on that same appliance recommending you disable automatic updates, because on certain AMD EPYC processors the boot stops with a kernel panic. Inside: what the "9" in the error message really says, read in the kernel source that boots the appliance; the line with an if that turns that failure into a halted machine; why the three processors on the list are really one single generation; why restarting the operating system does not recover the machine; and the four things we would check this week if your backups live inside a closed appliance.

Disaster recovery Veeam Backup
Read more →
Interior de una librería de cintas: paredes de cartuchos de copia a ambos lados del pasillo
9 min read

Restoring someone else's dump can create a root account

On 3 November 2026 MongoDB published four security advisories at once. None of the four is patched on the server: all of them close by moving Database Tools to 100.20.1, the package of binaries that lives on a technician's laptop, in the container image running the nightly backup and on the jump host. Inside: why excluding the admin namespace doesn't save you (the advisory says so), the four CVEs with their two contradictory scores, what the changelog tells you and the advisories don't, why your scanner will find nothing, why Ubuntu no longer ships the package, when this is NOT urgent, and the six-check inventory.

Data MongoDB Backup
Read more →
Dos teléfonos móviles con la pantalla apagada sobre una mesa de madera clara en una terraza
9 min read

A zero-day in December, off-the-shelf ammunition in August

For one week in August 2026, opening a Ukrainian gas producer's website on an iPhone was enough: the attacker had injected code into an analytics service loaded by thousands of pages. Sekoia published the analysis on 4 November and none of the three chains used a zero-day. One of them is DarkSword, a commercial surveillance kit whose code had been sitting on GitHub for five months. We reconstruct the campaign through the age of each piece's patch and end where it hurts: the iOS branch the oldest chain targeted was still receiving updates 108 days before the attack.

Cybersecurity Workplace Patching
Read more →
Armario mural de comunicaciones abierto con un switch de sobremesa y una maraña de cables de red sin ordenar
9 min read

You applied the switch patch and stayed exposed for 128 days

On 16 June Zyxel published ten fixed firmware releases for its GS1900 switches. On 3 November it published another advisory: all ten carried the same flaw inside. Binarly's binary diff shows why the June patch left the flaw inside — it checked the parameter counter after copying the parameters — and leaves a question no firmware answers: what to do when what left 996 switches were the configurations and the root credentials. Includes a correction to something we wrote ourselves in September.

Networking Patching Vulnerabilities
Read more →
Regletas de conexión de un repartidor de cableado con puentes de hilo azul y etiquetas de identificación
9 min read

Four CVEs in AuthPoint, and none of them touch the second factor

On 4 November WatchGuard published four vulnerabilities in AuthPoint Authentication Gateway, scoring 8.9 to 9.2 on CVSS v4, all fixed in 7.6.0. Read one after another, not one of the four is about the second factor: three are about the network stretch between the gateway and your local authentication servers, and one is about the machine the gateway runs on. We go through the four records one by one, what the CVSS vector says that the headline does not, and why the middle component you installed once is not in your patching inventory.

Zero Trust Identity MFA
Read more →
Sala de servidores pequeña con racks abiertos, servidores en bandeja y cableado estructurado
9 min read

XSA-523 has no mitigation: it has a host reboot

The Xen advisory of 3 November says a malicious guest can read and write arbitrary memory belonging to other domains, including Dom0, and its mitigation section contains five words: "There is no known mitigation". The patch requires a host reboot. We counted Xen advisories year by year over the official JSON — 47 published in 2026 against 10 in all of 2025 — and go through why the grant tables are this year's hot spot, and what gets decided before the next advisory lands, which already has a date: 10 November, 18:00 UTC.

Virtualization Patching Vulnerabilities
Read more →
Bandejas de discos con carros extraíbles en un armario de almacenamiento de centro de datos
9 min read

Synology: three accounts of the attack, and a patch your screen never shows

In two days, three incompatible explanations of the same NAS encryption campaign appeared: Synology points at a 2024 flaw, 360's anti-ransomware team points at two from September 2026, and an incident response team documents a victim already running a later build. The first two both fit, and the build numbers explain why: between 7.2.2-72806-1 and 7.2.2-72806-9 there are eight builds current on 2024 and exposed to 2026. The third needs no zero day: on 22 October Synology published two 9.8-rated flaws that do not live in DSM at all, but in the packages. A NAS has two patch inventories, and the version screen shows only one.

Backup Ransomware Storage
Read more →
Armario de comunicaciones con decenas de latiguillos de red azules y grises cruzados sobre los paneles de parcheo
8 min read

Seven fixed versions in the CVE and none of them boots your Proxmox

CVE-2026-98432 is a 9.8 in the Linux kernel: a use-after-free in the IPv4 TCP handshake, exploitable with no credentials and no interaction. The advisory lists seven fixed versions — 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10 — and not one matches the branch a Proxmox node boots. What actually triggers the bug according to the CVE's own field-by-field justification, the clocks of Debian, Ubuntu, Red Hat and Proxmox as of 31 October, what the published exploit proves and what it does not, and six checks with commands.

Cybersecurity Patching Proxmox
Read more →
Pasillo entre racks de una sala de servidores a oscuras, iluminado solo por los pilotos verdes y azules de los equipos
9 min read

ESXi: the 2.7 we ranked fifth was a zero-day

On 30 July we put CVE-2026-41709 last on a list of five: 2.7 out of 10, "insufficient logging" in VMware ESX. Ninety days later CISA adds it to the Known Exploited Vulnerabilities catalog because an adversary had been using it as a zero-day. We go back over that post and correct two things: the doubtful window does not start on the advisory date, and shipping logs off the box does not fix a non-write.

VMware Virtualization Vulnerabilities
Read more →
Imagen del post sobre la rotación de certificados de Windows Update en 2027
8 min read

Windows Update rotates its certificates in 2027, and the backup you restore will not carry them

Advisory MC1491763, dated 8 October 2026, sets two dates: on 17 May and 19 June 2027 the certificates your machines use to trust Windows Update expire, and the replacement travels inside a monthly update. The table of five families with their minimum update, the asymmetry that does not add up at first glance (the newest platform has the oldest requirement), why devices behind WSUS are out of scope, and the consequence the advisory does not mention: a restore brings a machine back with the update level it had on the day of the backup.

Patching Workplace Continuity
Read more →
Sala de servidores con racks de bastidor abierto, suelo técnico perforado y cableado estructurado
9 min read

Hotpatch promised four reboots a year. 2026 has asked for eight

Microsoft published advisory MC1527979 yesterday: the November and December 2026 security updates require a restart on hotpatch-enabled Windows Server 2022. With that, the official calendar for the year closes at eight months with a reboot and four without — the exact inverse of what the feature sells. The month-by-month count from Microsoft's own table, the unplanned-baseline clause that has been published for years, why Windows Server 2025 does keep November and December, the three things hotpatch never covered, and the question that actually matters: what a reboot costs in your infrastructure.

Patching Maintenance Infrastructure
Read more →
Filas de discos duros de 3,5 pulgadas montados en un chasis de almacenamiento abierto
8 min read

On Proxmox, the jump to Ceph Tentacle bills you for what you built in 2020

On 31 October the Squid branch of Ceph stops receiving backports, and plenty of hyper-converged Proxmox clusters have the jump to Tentacle on this week's calendar. The procedure works. What nobody writes into the maintenance window is the bill that arrives the day after: OSDs created under Octopus or earlier can grow their META until the Proxmox panel shows less space than you had, two manager modules that had been running since 2020 disappear, the MDS step asks you to give up your standby, and the specific pair of versions between source and target may never have been tested. Our own measurement of the Proxmox repositories, the four possible situations, when NOT to jump this week, and the six checks to run before touching the repository.

Ceph Proxmox Storage
Read more →
Pasillo de un archivo con estanterías llenas de cajas y archivadores etiquetados
9 min read

Your inventory has no line for Brotli

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder: eight bytes of internal buffer from which Node.js, Bun, Python, Envoy, Istio, .NET, FFmpeg, ClickHouse and Apache Arrow all hang. In four days it had five names — Node2Shell, Python2Shell, HTTP2Shell, Brotli2Shell and Broccoli2Shell — and each one was somebody discovering the blast radius was wider than they thought. The fix had been public upstream since 27 February. The word that repeats across every advisory is "bundled": Arrow carries Brotli 1.0.9 inside it, .NET carries its own copy and ClickHouse maintains a fork. Why "is it patched?" has no single answer but eight separate clocks, why you are the one making the request rather than your perimeter, and the five-question census with the exact commands.

Cybersecurity Vulnerabilities Inventory
Read more →
Armario de comunicaciones mural de una oficina, con un conmutador de red, un router y un módem conectados con cables de cobre
10 min read

Two hours from a PHP website to the domain hashes

On 21 October 2026 CISA asked for something nobody writes lightly: anyone who cannot patch PHP immediately, or who is still on 8.1 or earlier, should take their PHP-based systems off the network. These are CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 on CVSS v4.0, and the details leaked before the patch existed. But the door is not what interests us: in the case Unit 42 documents against a European government entity, two hours passed between the break-in and the password hashes, the MFA secrets and an NTLM tunnel into Active Directory. PHP did not open that path. With the branch table, the mitigations that do not mitigate, and the twenty-minute check.

Cybersecurity PHP Vulnerabilities
Read more →
Pasillo de un centro de datos con filas de armarios de servidores y bandeja de cableado en el techo
10 min read

Your scanner says zero criticals and the exploit gets root

On 21 October 2026 the Zero Day Initiative sent five Linux kernel bug reports to the security team and, by mistake, to the public development lists. Three carried full proof-of-concept code. None has a CVE, because the kernel only assigns a number once the fix is already in a stable tree. And one of them has already produced root on AlmaLinux 8, 9 and 10, Debian 12 and 13 and Ubuntu 24.04 and 26.04, bypassing the Dirty Frag fix. We explain why the 9.0 probably does not affect you and the 7.8 does, what to check on each machine and the traps in checking it, and why the number that eventually shows up in your scanner is not a warning but a receipt.

Cybersecurity Linux Vulnerabilities
Read more →
Puesto de trabajo de oficina con un portátil, dos monitores, teclado y una libreta sobre una mesa de madera clara
9 min read

The signature was valid; the DLL next to it was not

On 19 October 2026 Siemens confirmed in-the-wild exploitation of CVE-2026-110936 in its Software Center. What ran on the victims' machines was a genuine, correctly signed copy of the program: the attacker only had to drop an archive.dll in the same folder. If your application control authorises "anything signed by a known publisher", this campaign passes the filter by design, not by failure. We explain what a digital signature answers and what it does not, why the CVSS vector says "local" while your patch queue reads that as "no rush", the three behavioural signals that do leave a trail, and the three questions you can answer this afternoon.

Cybersecurity Vulnerabilities Workplace
Read more →
Pasillo entre armarios de servidores encendidos en una sala técnica real, con un taburete de madera olvidado en el pasillo
10 min read

SafePay's five doors: not one of them is from 2026

The joint advisory on SafePay published on 20 October 2026 — FBI, CISA, the Secret Service and three European police bodies, at least 600 victims since August 2024 — lists five exploited vulnerabilities. Not one is from 2026 or 2025: three sit in the firewall that lets people in and two in the backup server that was meant to save you. The detail almost nobody has covered is that NAS devices do not get their files deleted: they get reset to factory settings. We go through the five doors with their fixed versions, why patching does not close the session already taken, when NOT to patch first thing tomorrow, and the eight checks we run ourselves.

Ransomware Backup Patching
Read more →
Armario de comunicaciones abierto con un panel de parcheo y decenas de latiguillos azules sin ordenar
9 min read

Redis: the patch had been out for 164 days

On 16 and 17 October 2026 a set of decoys recorded the first exploitation attempts against CVE-2026-25243, the flaw in Redis's RESTORE command. The patch was published on 5 May: 164 days earlier. Throughout those 164 days the flaw carried two scores — 7.7 from the party that published it and 8.8 from the NVD — that cannot be compared because they come from two different versions of CVSS; plus a CISA record dated 6 May that to this day still says "no known exploitation". We go through why those two scores cannot be subtracted from each other, why "requires authentication" does less work than you think, the six patched branches the CVE record itself never mentions, and the five checks that close the matter.

Data Patching Vulnerabilities
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN