Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Tornos de acceso de cristal en el vestíbulo de un edificio de oficinas
7 min read

The connectors that do not exist yet are already approved in your Microsoft 365

On 30 October the Copilot Connectors page starts honouring the publisher-type setting, and the documentation says new connectors of an allowed type "follow the default rollout and are available to everyone included in User access". User access ships set to "All users". What changes with notice MC1454973, who it does not apply to, why the setting is no longer called what the notice calls it, what this is NOT, and six checks.

Microsoft 365 IA Automation
Read more →
Servidor de torre y documentación en el cuarto técnico de una pequeña oficina
9 min read

The software only your sector uses is the door nobody audits

In April 2026 a group got into US law firms through a signing key hard-coded into a time-and-billing application. CrowdStrike reports it in a 28 October publication, and it carries no CVE: we looked, and there is no public record. What an ASP.NET machine key is, the four times the same mistake has shown up in niche products since 2020, why your scanner cannot see it, and six questions to put to your vendor this week.

Cybersecurity EDR/MDR Suppliers
Read more →
Jaula de colocation con la puerta de malla abierta en una sala de datacenter
10 min read

They came in through the portal login and left with the hypervisor

The final report from a Japanese cloud provider describes the whole chain: a vulnerability in an open-source component of the authentication system behind its customer portal, from there the management console, and from the console administrator rights over the virtualisation platform. 495 companies and public bodies downstream. Three weeks on, retrievable backup data exists for 206 of those 495, and the provider's own advice is to stand up a separate environment and rebuild from whatever backup each customer holds. The four jumps in the chain, why a restore point cannot share a credential with the machine it protects, the victim's own prevention plan read as a list of questions, and why the answer is not signing a second provider.

Disaster recovery Cloud Ransomware
Read more →
Pasillo de un archivo con estanterías llenas de cajas y archivadores etiquetados
9 min read

Your inventory has no line for Brotli

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder: eight bytes of internal buffer from which Node.js, Bun, Python, Envoy, Istio, .NET, FFmpeg, ClickHouse and Apache Arrow all hang. In four days it had five names — Node2Shell, Python2Shell, HTTP2Shell, Brotli2Shell and Broccoli2Shell — and each one was somebody discovering the blast radius was wider than they thought. The fix had been public upstream since 27 February. The word that repeats across every advisory is "bundled": Arrow carries Brotli 1.0.9 inside it, .NET carries its own copy and ClickHouse maintains a fork. Why "is it patched?" has no single answer but eight separate clocks, why you are the one making the request rather than your perimeter, and the five-question census with the exact commands.

Cybersecurity Vulnerabilities Inventory
Read more →
Banco de trabajo de reparación con estación de soldadura, multímetro y bobinas de cable
9 min read

Branch protection worked. It lasted five seconds

On 21 October 2026, at 10:08:29 UTC, GitHub branch protection rejected a change to LiteLLM's release workflow. At 10:08:34 a privileged credential overrode it and applied the change anyway. Ninety minutes later there were seven poisoned litellm 1.107.0 wheels on PyPI. No control failed: all three were satisfied, because all three asked the same question. With the minute-by-minute timeline from the official report, why the blast radius is not the applications that use the library but any virtualenv where it is installed, the real 2-hour-40-minute window, and seven checks with the exact commands.

Cybersecurity DevOps Suppliers
Read more →
Armario de comunicaciones abierto en una pared, con paneles de parcheo, un conmutador de red y manojos de cables de colores
9 min read

Your secondary DNS only covers silence

On 11 October 2026 a paid DNS provider stopped answering at every location at once for about 54 minutes: its API was storing a setting as an integer where the software expected a string. We look at the other half of the problem, the half no post-mortem covers: what your own network does during those minutes. Microsoft's documentation says the client only switches servers if the previous one is unreachable — an incorrect answer does not trigger failover — that it stays pinned to the alternate for up to 15 minutes, and that on Linux the default cost of a silent resolver is 5 seconds per attempt. With the fifteen-minute check to measure it at home.

DNS Networking Continuity
Read more →
Antenas de telefonía móvil instaladas sobre la azotea de un edificio de ladrillo, con los mástiles y el cableado a la vista
9 min read

Two carriers on the invoice, one core on the network

On 21 October 2026 Orange went nearly ten hours without mobile service across France after a failure in its mobile core; fibre, by contrast, held up. If the plan B for your eight sites is a SIM card, that day you did not have eight backups: you had one. We explain why physical route diversity does not cover this failure, how to read each router's PLMN code in ten minutes to find out which network it is really registered on — and what that code does NOT answer — why Spain has fewer independent cores than the invoices suggest (Orange and Yoigo are one group on a single Ericsson core; Digi has its own core but shares radio with Movistar), and why failover that watches whether the link is "up" never notices a core outage.

Networking SD-WAN Continuity
Read more →
Centro de operaciones de red real: puestos curvos con monitores y técnicos atendiendo, iluminación tenue
7 min read

Three of the seven lines DOCOMO signed with VMware are not software

On 20 October 2026 Broadcom announced its first comprehensive ten-year agreement in Japan: NTT DOCOMO keeps its private cloud on VMware Cloud Foundation. The reading that will circulate in this week's renewal meetings — "not everyone is leaving" — is the wrong one, and the reason sits in the release itself: of the seven lines listed in the product annex, three cannot be installed. They are a Support Account Manager, a Technical Account Manager and VCF Forte Support; people with your name on their list. We explain why that column is not in your catalogue, why the product list read backwards is the dependency inventory that decides how long a migration takes, when we DO tell clients to stay, and we leave you the seven-line exercise to run against your own contract.

VMware Migration Suppliers
Read more →
Bastidores de servidores vacíos, con los montantes y los raíles a la vista y sin ningún equipo montado
7 min read

The control plane fails first, and your plan B needs it

A year ago, on Monday 20 October 2025 at 08:48 Spanish time, a DNS record went empty and took half the internet with it. AWS's own post-event summary leaves an uncomfortable reading for any recovery plan: instances already running stayed healthy. What you could not do was launch another one, update a function, start a container, request temporary credentials, sign in to the console or open a support case. The headline was 2 h 52 min; the last thing AWS declared restored came 28 h 17 min later. We go through the document on local time, the six questions we ask of a continuity plan, and why building it on your own hardware does not get you out of the problem: it brings it home.

Cloud Disaster Recovery Infrastructure
Read more →
Repartidor de fibra óptica con conectores verdes y latiguillos amarillos, y la mano de un técnico alcanzando un puerto
9 min read

The circuit was fine and the video call dropped anyway

Your carrier closes the ticket as "within contracted parameters" and your SD-WAN has the graph of the drop. Both figures are correct: what differs is the measurement point, the window and the traffic class, and all three sit in the standards underneath the contract. ITU-T Recommendation Y.1541 asks that any minute observed should meet the objectives; an availability contract averages the whole month, and 129 twenty-second drops fit inside a monthly 99.9% without breaching it. The seven lines of annex to write before you sign.

Networking SD-WAN Monitoring
Read more →
Armario de cableado de red con latiguillos de pares trenzados y paneles de parcheo
8 min read

The Azure outage: four doors and the place your plan B lived

On 30 September 2026, a five-hour-forty-five-minute incident on Azure. Of the five services Microsoft lists as impacted, four are the road to your infrastructure and the fifth is Azure VMware Solution. Inside: what the official 7Q30-010 record does and does not say, the real detection clock, why the region figure going round is not in the source, and what happens to your contingency procedure when the thing that fails is the console.

Cloud Infrastructure High availability
Read more →
Seta de parada de emergencia sobre una pared, con el pulsador rojo sin accionar
8 min read

The email asked for six hours; the press release said nine: who signs off a shutdown like that?

On 25 September, Kiteworks asked customers for something almost no advisory asks: not to patch, but to switch off. No CVE, no patch and no indicators of compromise, on credible intelligence about an "imminent" attack that weekend. The email customers received, first published by Heise, said six hours; the company's public press release said nine. And the advisory asked them to switch off even systems not reachable from the internet, so there was no way to scope it by exposure. Two days later the advisory was lifted, and during the window an unknown critical flaw turned up, "confined to a capability that is enabled for less than 1% of the customer base". We rebuild the case from the six original sources and get to what it leaves behind: who in your company signs off a stoppage like that and on what evidence (with the words of the CISO who did sign it), which channel your users will use during those hours if you do not give them one, and the three things that bite during an unrehearsed stoppage —the HA manager bringing back what you shut down from inside the guest, the weekend of backups that pushes good restore points out of retention, and monitoring with no maintenance window declared—.

Continuity Disaster recovery Suppliers
Read more →
Nave industrial vacía con el suelo de hormigón, un palé en primer plano y la puerta abierta al fondo
8 min read

Data Act: in January 2027 leaving the cloud becomes free; moving does not

On 12 January 2027 your cloud provider loses the right to charge you for leaving: Article 29(1) of the EU Data Act forbids it. But the big three already dropped that fee back in 2024, so what changes is not the amount — it is that this stops being a conditional credit programme and starts reaching the small providers too. The exit invoice disappears; the cost of leaving stays exactly where it was. The definition of "functional equivalence" speaks of "a minimum level of functionality", binds infrastructure services only, and covers only the features both source and destination offer alike. What you actually get back, what the trade-secret carve-out hides, why multicloud traffic still gets billed, the exact deadlines you can already enforce (two months, thirty days, seven months) and the exit drill that reveals the number no contract contains.

Cloud Regulation Data
Read more →
Vista aérea de un corredor de centros de datos: naves industriales bajas y anchas repartidas a lo largo de una autopista
13 min read

Your cloud can lose one zone. AWS just lost a Region

On 15 September AWS wrote on its health dashboard that it cannot restore resources and data hosted "exclusively" in the Bahrain Region or in the mec1-az2 zone in the UAE. That one word separates the customers who lost data from the ones who did not. The perimeter of that redundancy was published all along: S3 is designed to survive the loss of ONE zone, and zones sit within 100 km of each other. What the documentation says, what the contract says, and the four questions we write down before touching anything.

Cloud Disaster recovery Continuity
Read more →
Nave de un centro de distribución: estanterías metálicas con palés embalados y pasillo de preparación de pedidos
8 min read

Cutting you off takes 101 minutes; reconnecting you, nine days

Boston Scientific disclosed its incident on a Wednesday. That same day, 101 minutes after the first notice, the platform its customers use to send it orders cut every one of its global connections. It took nine days to give them back. The full timeline sits on a public status page and teaches three things that are in almost no continuity plan: who decides to disconnect you, which degraded channel keeps you alive meanwhile, and why your status system stops telling the truth.

Continuity Disaster recovery Compliance
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN