Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Interior de un armario de comunicaciones con regletas de conexión, latiguillos y un equipo montado en la pared
9 min read

The fix needs no window and no restart, which is why it may not be in place

On 14 October Cisco published a 9.8 flaw in its email gateway, exploited before the advisory went out. The striking part is not the score: it is that the fix ships as a scanning-engine package that "does not require a software upgrade or a product restart". That sounds like good news, and it is precisely what keeps it out of your patching process, which is built from tickets, windows and restarts. What to look at before that engine changes version, and why for an arbitrary file write "patched" does not mean "clean".

Cybersecurity Patching Vulnerabilities
Read more →
Puestos de trabajo con monitores y teclados en una oficina diáfana
8 min read

Mark of the Web: seven ways a file from outside stops looking like one

On Tuesday Microsoft patched a Windows Shell flaw already under exploitation, and its own entry says it let an attacker "evade Mark of the Web (MOTW) defenses". Before getting to that bug it is worth reading the Office documentation: the banner that blocks macros in an attachment depends on a tag which, by Microsoft's own account, has four ways of never being applied and three more of not deciding anything. And the policy that would make it mandatory is not available in every plan.

Windows Workplace Microsoft 365
Read more →
Bahías de disco de una cabina montada en rack, con unidades etiquetadas y varios huecos vacíos
6 min read

The last Ceph Squid patch is not in your Proxmox repository

On 12 October 2026 Ceph shipped 19.2.7, the seventh backport in the Squid series, with the usual line: "we recommend that all deployments update to this release". Today we checked what the Proxmox repository actually serves, and the answer is 19.2.6-pve4, with an index dated 9 September. The branch dies on 31 October. Two different calendars, and the one that governs you is not the one on ceph.io.

Ceph Proxmox Storage
Read more →
Frontales de servidores montados en un chasis de rack, con latiguillos etiquetados a mano y pilotos verdes encendidos
9 min read

HyperArmor does not patch ESX: it buys you time

Broadcom introduced VMware HyperArmor today: a separately sold layer that mitigates ESX hypervisor flaws with "no host reboots or software upgrades". The most honest sentence of the launch came from one of its own engineers: "this basically buys you time". The free route to avoiding the reboot has existed since vSphere 8.0 Update 3, and it ships with a written exclusion list: TPMs, DPUs and virtual machines without Fast Suspend and Resume. Of the three pieces HyperArmor sells, one is already sitting on your host, switched off.

VMware Virtualization Patching
Read more →
Filas de puestos de trabajo idénticos en una sala: mismos monitores, mismos teclados, misma imagen instalada
8 min read

Windows 11 24H2 stops getting updates today, and your fleet is on the latest build

Today, 13 October 2026, Windows 11 version 24H2 stops receiving updates on Home and Pro. Microsoft's own table lists the same cumulative update, KB5124010, in four rows with four different end dates, and two of those rows carry the identical build number: 26100.9550. One expires today; the other, the IoT Enterprise LTSC line, has extended support until 2034. The date is not in the code: it is in the edition and the channel.

Windows Patching Maintenance
Read more →
Cuarto de cableado de un edificio con un conmutador sobre una balda, bloques de conexión antiguos y latiguillos sueltos
9 min read

Only one of the eight exploited flaws is in a network appliance

Joint advisory AA26-281A, signed in Spain by the CNI, lists eight CVEs successfully exploited by Flax Typhoon. One is in a network appliance, a Pulse Connect Secure; the other seven are software on servers: Bash and BIND ship with the OS, Struts travels inside a Java application, and ProFTPD, GitLab, ONLYOFFICE Docs and Strapi were stood up by someone on a specific day. Three were already in CISA's catalogue, two since November 2021 with the ransomware flag set. The counts done on the catalogue JSON, with the commands, and the three questions that actually build that inventory.

Cybersecurity Vulnerabilities Inventory
Read more →
Hilera de volantes de válvula industriales en un nicho de hormigón, fotografía documental en blanco y negro
9 min read

FortiMail: patch out on the 2nd, advisory on the 7th, mitigation still on

On 1 October Fortinet published a 9.8 flaw in FortiMail, exploited and with no fixed release. The only mitigation available was to switch off IBE encryption: the channel your company uses to send confidential documents to people outside it. The fixed release notes are dated 2 October; the advisory did not say so until the 7th. If your trigger for removing the mitigation is the advisory, your clock runs five days behind. Inside: the branch table (including the branch that gets no patch), the indicators Fortinet did publish, what the public documentation does NOT answer, and a six-line record so a temporary mitigation does not last six months.

Cybersecurity Patching Vulnerabilities
Read more →
Armario de red de oficina abierto, con un conmutador y una maraña de latiguillos acumulados dentro
7 min read

Eight products, nineteen versions: Atlassian's advisory tells you what to do, not what you have

The CVE-2026-21589 advisory, dated 5 October 2026, affects eight self-hosted Atlassian products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. It is one of the thorough ones: nineteen fixed versions, temporary mitigations if you cannot patch —including taking the instance off the internet— and a method for hunting traces in your access logs. All three instructions start from a question the vendor cannot answer for you. Inside: the version table, why "we are on 10.2" points at three different products, and Atlassian's thirteen entries in CISA's KEV catalogue.

Vulnerabilities Patching DevOps
Read more →
Panel de servicio de una librería de cintas con el testigo de aviso encendido y las llaves puestas
6 min read

Dell published the advisory on 1 October. The CVE records landed five days later

Dell advisory DSA-2026-448, carrying two CVSS 10.0 flaws in Container Storage Modules, is dated 1 October 2026. On 6 October we queried its thirteen own CVE identifiers against the public CVE Services API and watched them being published live, one every four or five minutes and in descending order of severity. When they reached NVD, they reached it without a CPE. Inside: the table of timestamps to the second, and why your scanner still cannot tell you whether you are affected.

Vulnerabilities Kubernetes Patching
Read more →
Interior de un portátil abierto: placa base, módulo de memoria, ventilador y disipador
7 min read

Windows' blocked driver list is 1,702 hashes

We downloaded Microsoft's official vulnerable driver blocklist on 6 October 2026 and counted the rules: 1,713 blocks, of which 1,702 identify the file by hash and 11 by name. Inside: what Microsoft's own documentation admits its list does not cover, why only 50 of the 218 certificate blocks burn a whole publisher, how many samples in the public catalogue of abusable drivers load anyway with memory integrity on, and the two possible readings of the contrast between 45% and 18%.

Windows EDR/MDR Cybersecurity
Read more →
Armario rack de pared con un switch de 16 puertos y cables de red
8 min read

Your unattend.xml carries the domain password in clear text

The file you install machines with over the network contains the account that joins them to the domain, written as-is. That is not sloppiness: it is the example in Microsoft's own documentation. Inside: why PlainText false does not mean encrypted, what CVE-2026-0386 says about the channel that file travelled over, why the January 2026 update mitigated nothing until somebody touched the registry, and why switching the feature off does not rotate the credential already handed out.

Windows Maintenance Cybersecurity
Read more →
Sala de reuniones vacía con dos pizarras blancas y sillas alrededor de una mesa larga
9 min read

Your patching policy has no entry for "there is no patch"

On 21 September someone broke into the Dutch Institute for Vulnerability Disclosure, the people whose job is telling everyone else to patch. Eleven days later, the second of the two chained flaws still has no published fix. Inside: the timeline the victim published under its own name; why the headline —"an AI agent did it"— is not what decides the outcome, and what the logs actually say ("loud and very messy"); the advisory field reading "Patch status: Available" two sections above the paragraph saying the vendor "are working on a fix", and why your vulnerability process reads the field and not the paragraph; the two public documents that do not agree and are both true; what is left when the patch does not exist —break the chain at the other link, remove exposure, cut the blast radius, raise detection—; and the paragraph missing from your security policy, written out in full so you can copy it, with the two clauses that make it work: it expires by itself, and it carries a name and a job title.

Patching Cybersecurity Continuity
Read more →
Aula de informática con filas de equipos de sobremesa idénticos y pantallas apagadas
8 min read

Memory integrity turns itself on in October, and only where nobody decided anything

Microsoft announced on 1 September that the October 2026 quality updates will start enabling memory integrity on more eligible Windows devices. The press read the sentence «existing administrator and user choices and policies will remain in effect» as reassurance. Read it as a census: if the existing decision is respected, the change lands precisely where no decision was ever written down, and there the administrator becomes Windows Update. Inside: what actually gets switched on (HVCI on top of VBS) and why «eligible» is not a list you can query; the three Win32_DeviceGuard fields that answer where you stand today and why «configured» is not the same as «running» —the manual documents a case where they diverge—; why the symptom will not arrive as «a security failure» but as «the accounts scanner has stopped appearing», one at a time over a period Microsoft does not specify; the UEFI lock trap that turns undoing the policy into a physical trip to the machine; the counter-intuitive detail that the stricter value of RequirePlatformSecurityFeatures protects FEWER machines; the seven-day plan with a dated census, a pilot ring and a rollback prepared in advance; and the other two clocks expiring on that same 13 October, of different natures and with no shared rollback plan.

Windows Workplace Cybersecurity
Read more →
Sala de servidores con racks cableados y un módulo de gestión de potencia
9 min read

Moving to Proxmox 9.2 wasn't your call: the repository made it

Ask whoever runs your cluster who decided to go from 9.1 to 9.2, and in which meeting it was approved. In most places nobody decided: Proxmox VE ships no repository per minor version —there is nothing like a pve-9.1-security— so a routine apt dist-upgrade, the same one applying the patches you do want, leaves you on the latest published minor. The software that takes your backups does have a supported-version matrix, and it runs behind: Proxmox VE 9.2 shipped on 21 May 2026 and the Veeam plug-in covering it arrived on 29 July, 69 days later. And one detail misleads: plug-in 3.3 for the 13.0 branch shipped on 25 August, twenty-seven days AFTER 4.0, so "I am up to date" can mean up to date on the branch that does not carry the new support. Nothing turns red; what you lose is the right to open a case. The three facts that must live on the same line before you open the window, why the right order is matrix first and apt second, the ARM architecture boundary, and where this crack does not exist.

Proxmox Backup Maintenance
Read more →
Sala con filas de puestos de trabajo y ordenadores bajo luz fluorescente
8 min read

CVE-2026-32996: the backup agent left the administrator ticket written in a log file

The exploit overflows no stack and corrupts no memory: it opens a text file any user on the machine can read, finds a session identifier inside, presents it over a named pipe and runs whatever you want as SYSTEM. With the vendor advisory in front of us, three things being reported wrong about CVE-2026-32996 in Veeam Agent for Windows: the version the headlines quote (13.0.1.2067) is the server build, not the agent one —the number to check is 13.0.3.1220—; the patch for two hundred laptops hangs off the change window of the backup server, the machine nobody wants to touch; and the phrase "active exploitation" was only ever in the headline of a bulletin whose body said something else, and which was then pulled. Why AT:P in the vector changes which machines you look at first, and the four things we would do this week.

Backup Vulnerabilities Patching
Read more →
Armario de comunicaciones montado en la pared de una pequeña empresa, con un router, un módem y un switch, y los cables recogidos sin orden dentro
8 min read

The flaw is WordPress's; your php.ini decides the exposure

CVE-2026-87902 entered CISA's Known Exploited Vulnerabilities catalogue on 25 September, three days after the advisory and a proof of concept went public. It is a 9.2 and it is WordPress core, patched across 25 branches down to 4.7.37 (December 2016). But 9.2 measures the damage, not your exposure: the CVSS 4.0 vector itself carries AT:P — "conditions are required" — and none of the deciding conditions belong to WordPress. A PHP directive, a PEAR file and a directory inside your active theme. What each one checks, why the obvious command for looking at it from a shell returns a false answer — we measured it on a box running PHP 8.3.6 — and what NOT to do if you suspect it already happened.

Cybersecurity WordPress PHP
Read more →
Vista aérea de un enlace de autopista en trébol, con varias rutas posibles entre los mismos dos puntos
8 min read

Your SD-WAN orchestrator is the key to every one of your sites

On 22 September CISA added CVE-2026-93952 to the known exploited vulnerabilities catalogue: a 10.0 out of 10 in VeloCloud Orchestrator, the system that configures every site in an SD-WAN network. The second exploited 10.0 in that same orchestrator in eight weeks. And the exploitation condition the vendor itself publishes is an uncomfortable line: it requires access to the PUBLIC portion of the certificate the branch device authenticates with. Why that points at the trust model and not just at an input validation bug, what to do if your version train has no patch yet, the three traces to look for in the filesystem today, and the question we ask before centralising a control plane.

SD-WAN Networking Cybersecurity
Read more →
Pasillo frío de un centro de datos con una silla vacía y un carro de consola aparcado junto a un armario abierto
7 min read

The Proxmox CVE your scanner cannot evaluate

CVE-2023-54391 is a 9.8: you get in as root@pam with no password. We queried its record through the NVD API and the GitHub Advisories API, and here is what comes back: NVD publishes no CPE configuration at all and flags the record as Deferred; GitHub returns an empty list of affected packages; and the only range that exists stops at "7.4" while your nodes call themselves 7.4-17. A scanner that decides by version matching has nothing to decide with. Meanwhile a provider published its post mortem: twelve hypervisors mining from 31 August to 17 September, logs wiped and the sentence "we cannot prove it".

Proxmox Vulnerabilities Virtualization
Read more →
Armario de comunicaciones con paneles de parcheo y una maraña de cables de red azules
5 min read

The patch for your switch had been out for 97 days

On 21 September CISA added a single CVE to its catalogue of exploited vulnerabilities: a stack-based buffer overflow in the CGI program of Zyxel GS1900 switch firmware, unauthenticated and with command execution. Zyxel published the advisory and the ten fixed firmware builds on 16 June: 97 days earlier. We counted the 30 entries the catalogue has taken in so far this month and the median is 5 days, so the list mixes two different populations. Why "LAN-based" is not a mitigating factor but the attack's requirement, what the small print does not say about models out of support, and why the entry asks for forensic triage before you reflash.

Networking Patching Maintenance
Read more →
Interior de un servidor de dos zócalos abierto, con los procesadores y dos bancos de módulos de memoria a la vista
8 min read

Patching the kernel means rebooting, and the reboot erases the evidence

CISA added two Linux kernel flaws to its exploited catalogue today, due by Monday. One has sat in your scanner for eleven months rated 3.3 out of 10; the kernel project scores it 7.8 on the very same record. Both entries carry the forensic-triage flag CISA now attaches to two out of every three new additions, and its guidance says not to remediate before collecting evidence. In the kernel, remediating means rebooting. And rebooting erases a good part of what you are asked to keep.

Cybersecurity Linux Patching
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN