Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Sala de archivo de una oficina con estanterías metálicas llenas de cajas de cartón y carpetas, y una caja abierta sobre una mesa de trabajo
7 min read

"The column was encrypted": pgcrypto was storing cleartext and nobody noticed

On 13 August PostgreSQL closed 28 CVEs in one go. One of them is not a buffer overflow: when OpenSSL rejected the requested cipher, pgcrypto never checked the answer and wrote the value into your "encrypted" column with a trivial XOR. Neither the INSERT nor the SELECT failed. What triggers it, why the day it broke was not the day the code was written, and which version you are really running if you install from Debian rather than PGDG.

PostgreSQL Encryption Data
Read more →
Chasis de servidor de almacenamiento extraído sobre sus guías en un pasillo de datacenter, con dos filas de discos de 3,5 pulgadas en bandejas metálicas y un destornillador apoyado en el borde
7 min read

Ceph patches four CVEs: the package closes three, the fourth is on you

On 19 August Ceph shipped Squid 19.2.6 and Tentacle 20.2.4 tagged [URGENT]. One of the four flaws is not fixed by installing anything: it forces you to rotate every CephX key in the cluster, ten manual steps, and it leaves the cluster in HEALTH_ERR in the meantime. What is inside each CVE, why anyone holding a "mon allow r" key could read your OSD LUKS passphrases, and what we found today in Proxmox's Ceph repository.

Ceph Proxmox Storage
Read more →
Percha de pared en la entrada de personal de una oficina con decenas de tarjetas de acceso colgadas de cordones y varios ganchos vacíos
8 min read

The directory holds more records than the company has employees

McDonald's reports just over 150,000 employees in its annual filing. The batch of its corporate directory put up for sale this week holds 1.7 million records. We placed the leaked counts next to the declared headcounts of seven companies, and the result is not a story about carelessness: it is about what a Microsoft Entra ID directory actually contains, who can read all of it with any ordinary password, and why the switch that closes it is one the vendor itself advises against touching.

Microsoft 365 Identity Security
Read more →
Puesto de trabajo vacío de noche en una oficina pequeña: portátil cerrado, teclado mecánico, taza fría y flexo encendido
10 min read

Five days, an issue title and a Jira token

On 17 August Wiz described how it pulled a Jira token out of Snowflake by opening an issue on a public repository: the issue title was the exploit. The line that allowed it had gone in five days earlier, in a change meant to tidy the code up, and it replaced the safe pattern that GitHub's own documentation recommends in writing. What failed in the review chain, why the "if" that looked like a filter filtered nothing, and what we look at in a pipeline.

CI/CD AI GitHub
Read more →
Varios miniordenadores en una bandeja de rack conectados a un panel de parcheo: máquinas pequeñas alojadas y accesibles desde la red
8 min read

They came in on port 5900 and left with root: the miner was the least of it

In mid-August the Dutch cyber security centre warned that the macOS Screen Sharing flaw is being exploited on Macs with port 5900 open to the internet, and that in every reported case the attacker got root and left a Monero miner behind. Apple had already shipped the patch on 6 August. What exactly breaks in CVE-2026-65400, why classic hardening did not cover this hole, and the list almost no company has: what listens from outside.

macOS EDR/MDR Security
Read more →
Sala de centralita telefónica con operadoras conectando llamadas: el servicio que resuelve nombres y por el que pasa todo el mundo
8 min read

The DNS server you have to patch is your domain controller

CVE-2026-62878 scores 9.8: a stack-based buffer overflow in Windows DNS, no authentication and no user interaction. Microsoft's bulletin lists sixteen affected products and all sixteen require a reboot. In many of the networks we come across, that machine is also the one validating everybody's passwords, which is why it hasn't been rebooted in months — sometimes years. What the bulletin actually says, what goes down while it boots, and the checks we run before the window.

Windows Active Directory Patching
Read more →
Torres de telecomunicaciones entre la niebla: la red móvil privada que comparten empresas que no se conocen
9 min read

They crossed from a wind farm to a power plant turbine through the grid operator's private APN

On 8 August CERT Polska published its analysis of the 29 December 2025 attack on a Polish combined heat and power plant. The attacker got in through a FortiGate with no multi-factor authentication, hopped to a cellular router, crossed the distribution operator's private APN and put three families of Siemens PLCs into STOP mode. The report does not cite a single CVE in the whole chain: what it describes is a mobile network we all call private in which any device could talk to any other.

Networks OT Security
Read more →
Sala llena de ordenadores encendidos y funcionando con normalidad: los certificados de Secure Boot caducaron en junio y ningún equipo dejó de arrancar
7 min read

Secure Boot expired in June and nothing broke. That is the problem

On 24 and 27 June, two of the certificates Microsoft has used to sign the boot chain since 2011 expired. Not a single machine went down: Microsoft states plainly that the device keeps starting and updating normally. What stops is something else — revocations, the boot manager, early-boot mitigations — and it raises no alert at all. A third date is still open: 19 October. How to check in two minutes whether your Windows estate, your Linux servers and — this is the one nobody looks at — your virtual machines already carry the 2023 certificates.

Windows Firmware Security
Read more →
Primer plano de papel triturado con restos de texto: el recall en la nube borra el mensaje del buzón del destinatario, y ahora podrá ordenarlo otra empresa
10 min read

Cross-tenant recall: Exchange Online lets another company delete mail from your mailboxes

In mid-August Microsoft starts rolling out cross-tenant message recall in Exchange Online (MC1423106). It ships switched off, and you do not turn it on to recover your own emails: you turn it on so senders in another tenant can delete messages already delivered to your people's mailboxes. What cloud recall does today (hard delete, read messages included, retrying for up to 24 hours), why the allow list looks far too much like the list of domains invoice fraud uses, what actually protects you (retention, not the checkbox), and the logging gap almost nobody has read.

Exchange Microsoft Compliance
Read more →
Sección de un tronco con sus anillos de crecimiento: capas acumuladas durante años, como el código del kernel donde se escondían Zapscape y SCTPhantom
8 min read

Zapscape and SCTPhantom: your Proxmox does not run Debian's kernel

Two Linux kernel flaws published this week break the two boundaries we take for granted: the virtual machine (Zapscape, CVE-2026-64561) and the container (SCTPhantom, CVE-2026-64564). Understanding them is the easy part. The hard part is answering whether the kernel your node actually boots already carries the fixes, because the versions in the advisory — 6.12.101, 7.1.6 — do not exist on your server: Proxmox does not use Debian's kernel. The exact proxmox-kernel versions that do close them (and why 7.0.14-9 is not enough), how to check in four commands, and who genuinely needs to hurry.

Virtualisation Proxmox Security
Read more →
Fachada de un edificio residencial con balcones: en el hosting compartido, tu superficie de ataque incluye a los vecinos que no elegiste
8 min read

cPanel CVE-2026-58048: in shared hosting, your neighbour sets the risk

Any ordinary customer on a cPanel server could execute SQL as database root simply by renaming a database. The headline is the 9.4, but the figure almost nobody reads sits at the end of the vector: SC:H/SI:H/SA:H, CVSS 4.0's way of stating in writing that the damage leaves the vulnerable system. On a shared server, "the subsequent system" has a name: everybody else. What the flaw does, why its 5.6 sibling says it more plainly, what to check this week, and the honest question of whether you should flee shared hosting (not always).

Hosting Cybersecurity Applications
Read more →
WireGuard o IPsec: comparativa honesta entre los dos protocolos de túnel, con el criterio de everyWAN sobre cuál usar en cada caso y el calendario post-cuántico europeo
8 min read

WireGuard or IPsec: what we deploy where

WireGuard is about 4,000 lines of code, it landed in the Linux kernel in 2020 and it fits on one page of config. IPsec drags along thirty years of RFCs and proposals that never quite match. And we still deploy IPsec in a good share of the places we work, for three reasons that show up in no comparison table: who is on the other end of the tunnel, who authenticates the people, and what happens when the cryptography has to change. An honest comparison, no fanboyism, with Europe's post-quantum calendar on the table.

WireGuard IPsec VPN
Read more →
Pass-ta-key: tres técnicas de Unit 42 contra las passkeys sincronizadas de Google Password Manager en Chrome sobre Windows, incluida la extracción del secreto de 32 bytes que las descifra todas
8 min read

Your passkey isn't broken — the master key gets copied

On 3 August, Unit 42 published three ways into passkey-protected accounts without breaking a single line of cryptography. The worst of them lifts a 32-byte secret out of Chrome's memory that decrypts every passkey synced to the account — and in Google's current implementation that secret cannot be rotated or revoked. All three start the same way: with malware already running on a Windows machine, with no administrator rights and no privilege escalation. We still recommend passkeys, and this post explains why that is not a contradiction.

Passkeys Identity EDR/MDR
Read more →
CVE-2026-18577 en N-able N-central: un salto de autenticación en la consola desde la que los proveedores de IT gestionan los equipos de sus clientes, explotado con el control remoto del propio producto
10 min read

The agent we install on your machines is also a door

On 3 August, CISA added CVE-2026-18577 to its exploited-vulnerabilities catalogue with a deadline of the 6th. It is a flaw in the console many IT providers use to manage their customers' machines, and it arrived as the incomplete patch for another flaw published two days earlier. The vendor found out through a rise in licensing issues, not a security alert. Access was not granted by malware: the attackers used the product's own remote-control feature and left a tunnel behind so they would still be inside after the console was cut off. We are a managed services provider, and this post is about what that means for the people who hire us.

RMM Maintenance Security
Read more →
CVE-2026-66066, un fallo de CVSS 9,5 en Active Storage de Ruby on Rails, permite leer ficheros del servidor subiendo una imagen cuando la aplicación procesa variantes con libvips
10 min read

A 9.5 in Rails: the flaw is not in your application, it is in the library nobody chose

On 29 July 2026 Rails published CVE-2026-66066: a 9.5 in Active Storage letting an unauthenticated attacker read files from the server — including the process environment with secret_key_base and the database credentials — by uploading an image. The flaw is not in the code you commissioned, nor exactly in Rails: it is in which formats libvips considers safe to read, a C library nobody at your company chose. And libvips has published since 2022 which of its operations it has not verified, with a switch to block them. The label was there; what was missing was flipping it.

Applications Development Cybersecurity
Read more →
CVE-2026-63077, un fallo de CVSS 9,8 sin autenticación en todas las versiones de JetBrains TeamCity On-Premises, pone el foco en el servidor de CI/CD como sistema crítico
11 min read

Your CI/CD holds the keys to production. And you treat it as a developer tool

On 27 July 2026 JetBrains published CVE-2026-63077: an unauthenticated 9.8 affecting EVERY version of TeamCity On-Premises and allowing operating system commands to be run on the build server. There is no known exploitation. The two previous times TeamCity had a flaw like this ended with Russia's SVR inside technology companies and with BianLian operators creating users on build servers. The underlying problem is not TeamCity: it is that the machine which deploys to production is in almost nobody's critical systems inventory.

CI/CD DevOps Cybersecurity
Read more →
Google corrige 1.072 fallos de seguridad de Chrome con agentes de IA y pasa a publicar un hito cada dos semanas
8 min read

Google fixed 1,072 Chrome bugs with AI: the bottleneck is now you

Chrome 149 and 150 fixed 1,072 security bugs, more than the previous 23 releases combined, with AI agents that find, reproduce, triage and patch. But the number is not the story: Chrome is moving to a milestone every two weeks and piloting two security releases a week. What really changes in your patch cycle, why counting CVEs no longer measures anything, and which of your software will never get this treatment.

AI Maintenance Chrome
Read more →
Nueve entradas del catálogo KEV de CISA en 2026 apuntan al plano de gestión de una red SD-WAN
8 min read

Your SD-WAN doesn't go down: it gets reconfigured

Of the 172 vulnerabilities CISA has flagged as exploited so far in 2026, nine point at the same place: the management plane of an SD-WAN. And the attacker Mandiant documented inside a Catalyst SD-WAN Manager took nothing down: they registered as a peer, copied the fabric's configuration templates through the product's own API and wiped their tracks. The numbers are our own count over the KEV catalogue, including the only two entries all year with a 48-hour deadline. What to look at when the attack looks like a legitimate configuration change and your monitoring stays green.

SD-WAN Networks Security
Read more →
  • 1
  • 2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN