Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Parte trasera de un servidor montado en bastidor, con el haz de cables de red y de consola conectados y las etiquetas de aviso del fabricante
8 min read

Exchange fails 24 hours after the October patch, and the mitigation undoes the patch

The Windows Server updates of 13 October 2026 introduced a cap of 512 saved contexts in the RPC Endpoint Mapper. Exchange burns through them at roughly 23.7 an hour, so the server holds for a little over twenty hours and falls over the next day, when nobody connects it to the patch any more. Microsoft's mitigation is a registry value that multiplies the cap by 128 and, in doing so, undoes most of the hardening that cap was there to provide. What you will see in the event log, what to do this week, and why a failure that takes twenty-one hours to show up is never caught by a two-hour change window.

Exchange Microsoft 365 Patching
Read more →
Puestos de trabajo con monitores y teclados en una oficina diáfana
8 min read

Mark of the Web: seven ways a file from outside stops looking like one

On Tuesday Microsoft patched a Windows Shell flaw already under exploitation, and its own entry says it let an attacker "evade Mark of the Web (MOTW) defenses". Before getting to that bug it is worth reading the Office documentation: the banner that blocks macros in an attachment depends on a tag which, by Microsoft's own account, has four ways of never being applied and three more of not deciding anything. And the policy that would make it mandatory is not available in every plan.

Windows Workplace Microsoft 365
Read more →
Filas de puestos de trabajo idénticos en una sala: mismos monitores, mismos teclados, misma imagen instalada
8 min read

Windows 11 24H2 stops getting updates today, and your fleet is on the latest build

Today, 13 October 2026, Windows 11 version 24H2 stops receiving updates on Home and Pro. Microsoft's own table lists the same cumulative update, KB5124010, in four rows with four different end dates, and two of those rows carry the identical build number: 26100.9550. One expires today; the other, the IoT Enterprise LTSC line, has extended support until 2034. The date is not in the code: it is in the edition and the channel.

Windows Patching Maintenance
Read more →
Interior de un portátil abierto: placa base, módulo de memoria, ventilador y disipador
7 min read

Windows' blocked driver list is 1,702 hashes

We downloaded Microsoft's official vulnerable driver blocklist on 6 October 2026 and counted the rules: 1,713 blocks, of which 1,702 identify the file by hash and 11 by name. Inside: what Microsoft's own documentation admits its list does not cover, why only 50 of the 218 certificate blocks burn a whole publisher, how many samples in the public catalogue of abusable drivers load anyway with memory integrity on, and the two possible readings of the contrast between 45% and 18%.

Windows EDR/MDR Cybersecurity
Read more →
Armario rack de pared con un switch de 16 puertos y cables de red
8 min read

Your unattend.xml carries the domain password in clear text

The file you install machines with over the network contains the account that joins them to the domain, written as-is. That is not sloppiness: it is the example in Microsoft's own documentation. Inside: why PlainText false does not mean encrypted, what CVE-2026-0386 says about the channel that file travelled over, why the January 2026 update mitigated nothing until somebody touched the registry, and why switching the feature off does not rotate the credential already handed out.

Windows Maintenance Cybersecurity
Read more →
Aula de informática con filas de equipos de sobremesa idénticos y pantallas apagadas
8 min read

Memory integrity turns itself on in October, and only where nobody decided anything

Microsoft announced on 1 September that the October 2026 quality updates will start enabling memory integrity on more eligible Windows devices. The press read the sentence «existing administrator and user choices and policies will remain in effect» as reassurance. Read it as a census: if the existing decision is respected, the change lands precisely where no decision was ever written down, and there the administrator becomes Windows Update. Inside: what actually gets switched on (HVCI on top of VBS) and why «eligible» is not a list you can query; the three Win32_DeviceGuard fields that answer where you stand today and why «configured» is not the same as «running» —the manual documents a case where they diverge—; why the symptom will not arrive as «a security failure» but as «the accounts scanner has stopped appearing», one at a time over a period Microsoft does not specify; the UEFI lock trap that turns undoing the policy into a physical trip to the machine; the counter-intuitive detail that the stricter value of RequirePlatformSecurityFeatures protects FEWER machines; the seven-day plan with a dated census, a pilot ring and a rollback prepared in advance; and the other two clocks expiring on that same 13 October, of different natures and with no shared rollback plan.

Windows Workplace Cybersecurity
Read more →
Armario de red mural de una pequeña empresa con un conmutador y cables sin ordenar
7 min read

Windows Server 2016 ESU is billed from 12 January, whenever you buy it

Windows Server 2016 leaves support on 12 January 2027, 104 days from now. Everyone repeats that; the Azure Arc billing page, less so: licences provisioned after that date are back-billed to 12 January, the charge appears as a separate line item, deactivating and reactivating does not avoid it, deleting and recreating does not either, and Microsoft writes that "there are no conditions under which it can be avoided". Deferring stops being free. And before the price comes eligibility, which is where many smaller companies fall out: on-premises ESU requires Software Assurance or an equivalent Server Subscription, SPLA is not available for 2016, neither is the Visual Studio benefit, and transitioning from Volume Licensing is not supported with Azure Arc. Also: why the bill is decided by how you count cores —16 physical per machine or 8 virtual per VM, with Microsoft's own 1,024-versus-506-core example—, what to ask your CSP now that no list price has been published, and the option that is not on the slide.

Windows Licensing Infrastructure
Read more →
Filas de puestos con ordenadores en una sala vacía; solo una pantalla encendida
8 min read

Four EDRs and no alerts: what are you left with

On 6 July, two SensePost researchers published a code injection technique and tested it against four market-leading EDRs configured to detect, block and remediate: it worked on all four and no alerts were created. On 22 September, Flashpoint reproduced it. The technique does not write into another process's memory —the path every EDR has watched for a decade— but instead places the payload into the parameters a new process starts with. We read both publications in full, including the part the headlines skipped: in Flashpoint's lab the XDR component DID block, and only stopped once two further evasions were stacked on top; and the authors themselves warn the technique "has multiple opportunities for detection". Also: why this is post-exploitation and not a way in, why the same primitive had already been described publicly before (with no known date), the four checks you can ask your console for this week —and the catch that none of them is a button, but a query over telemetry someone has to have kept and someone has to write—.

Cybersecurity EDR/MDR Monitoring
Read more →
Sala llena de puestos de trabajo vacíos con los monitores apagados
9 min read

The RDS failure is listed as "mitigated". The mitigation is turning the machine off and on

On 11 September Microsoft opened an issue for Remote Desktop Services hanging after the September update. Eight hours later it marked it as "Mitigated". We went and read the mitigation: stop the virtual machine and start it again. The affected-platform list on that same page is not the three Windows Server versions in the headlines either: it runs to six. And the package you want to uninstall is the one closing a 9.8 unauthenticated hole in the very same service.

Workplace Windows Patching
Read more →
Armarios de rack vacíos recién instalados en el pasillo de una oficina
9 min read

VMware to Proxmox: the disk arrives intact, Windows will not boot, and the mistake was made two weeks earlier

The Proxmox VE import wizard copies the machine off ESXi without a hitch. Then Windows will not boot, and it is not the wizard's fault: the official documentation says that to boot from VirtIO SCSI, Windows "needs to see a disk requiring the driver before". That before is the problem, because the only place you can do it is the machine you have already shut down. The official way out works, but it is a per-machine, sequential procedure that lives inside the maintenance window. The alternative is not to speed it up: it is to move it to another date.

Virtualization Migration VMware
Read more →
Armario de comunicaciones de pared con switch y cables de red
10 min read

Windows DNS, an unauthenticated 9.8: what turns a bug into a worm is not the bug, it's your network

On 8 September Microsoft shipped the largest batch of patches in its history. Dustin Childs, of the Zero Day Initiative, counts twenty that could be classified as wormable, spread across thirteen components. Those thirteen are not one list: they are two. Seven of those CVEs sit in services your domain requires every machine to reach — DNS, Netlogon, Active Directory, DHCP — and eleven sit in roles Windows does not install on its own. The first half is managed with patching order; the second, by uninstalling. And hardly anyone knows which of the two they have switched on.

Cybersecurity Networking Windows
Read more →
Fotocopiadora multifunción de oficina con la puerta de tóner abierta y la bandeja de papel a medio sacar
7 min read

August's patch broke printing in WPF apps: the three ways out, with the maths done

The 11 August .NET Framework cumulative update breaks printing and PDF export in WPF applications using Calibri, Cambria, Constantia and Corbel: <code>System.IO.FileFormatException</code> on a font Windows itself installs. Microsoft acknowledged it on the 24th, thirteen days later, and the interim workaround switches off the overflow protection that same patch had just added. We looked at what exactly it turns off, why the decision should be per application rather than per fleet, and which of the three ways out costs least in each case.

Patching Maintenance Windows
Read more →
Armario de comunicaciones de pared en una sala técnica, con un servidor de rack, un pequeño cortafuegos y un panel de parcheo con latiguillos naranjas y grises
7 min read

"Exploitation Less Likely": 126 days in the queue for CVE-2026-33824

Microsoft patched the Windows IPsec VPN flaw on 14 April with the label "Exploitation Less Likely". CISA added it to its exploited catalogue on 18 August. Between those dates sit 126 days, a Unit 42 report, and a vendor page that still has not been corrected. Our own count across Microsoft's 24 KEV entries this year, and which mitigation you cannot apply if your VPN carries remote workers.

VPN Windows Patching
Read more →
Mesa de una oficina administrativa a última hora: archivadores de anillas, una calculadora de sobremesa y un archivador metálico con un cajón abierto
5 min read

5% more for paying monthly: what changes on 1 October, and when not to switch

From 1 October 2026 Microsoft will add a 5% uplift to CSP software subscriptions on annual terms billed monthly: it names Windows Server, SQL Server, CALs and System Center, and leaves the list open. The product does not change; the price of money does. The full arithmetic — that 5% works out at borrowing at roughly 11% a year — why your date is not 1 October but each line's renewal date, and the cases where moving is not worth it.

Licensing Microsoft Costs
Read more →
Sala de centralita telefónica con operadoras conectando llamadas: el servicio que resuelve nombres y por el que pasa todo el mundo
5 min read

The DNS server you have to patch is your domain controller

CVE-2026-62878 scores 9.8: a stack-based buffer overflow in Windows DNS, no authentication and no user interaction. Microsoft's bulletin lists sixteen affected products and all sixteen require a reboot. In many of the networks we come across, that machine is also the one validating everybody's passwords, which is why it hasn't been rebooted in months — sometimes years. What the bulletin actually says, what goes down while it boots, and the checks we run before the window.

Windows Active Directory Patching
Read more →
Cuadro eléctrico con filas de interruptores automáticos: apagar cosas una a una antes de que pase lo importante
5 min read

DeadLock does not break your antivirus: it stops it like any other service

On 10 August Microsoft published its breakdown of the DeadLock encryptor. The interesting part is not the cryptography: it is the list of things it switches off before encrypting anything. Defender stopped like a service, shadow copies gone, domain controller services halted and — this is the one almost nobody looks at — event log channels not cleared but disabled in the registry.

Ransomware EDR / MDR Malware
Read more →
Sala llena de ordenadores encendidos y funcionando con normalidad: los certificados de Secure Boot caducaron en junio y ningún equipo dejó de arrancar
7 min read

Secure Boot expired in June and nothing broke. That is the problem

On 24 and 27 June, two of the certificates Microsoft has used to sign the boot chain since 2011 expired. Not a single machine went down: Microsoft states plainly that the device keeps starting and updating normally. What stops is something else — revocations, the boot manager, early-boot mitigations — and it raises no alert at all. A third date is still open: 19 October. How to check in two minutes whether your Windows estate, your Linux servers and — this is the one nobody looks at — your virtual machines already carry the 2023 certificates.

Windows Firmware Security
Read more →
El peaje del ESU de Windows 10: el precio se duplica cada año y es acumulativo
5 min read

Windows 10 and the October toll: ESU doubles every year and you cannot skip year one

Microsoft charges $61 per device for the first year of Windows 10 extended security updates, and its own documentation says two things almost nobody puts together: the price doubles every consecutive year and ESUs are cumulative, so enrolling in year three means paying for all three. Delaying enrolment does not reduce the bill if you end up enrolling: it shifts the payment and leaves you without patches while you wait. The full math, the three blind spots that cost real money (the 2027 headline is not about your company, LTSC is not covered, and Office lives on until 2028 but you can no longer log a bug) and when paying for ESU really is the right call.

Windows Licensing Workplace
Read more →
CVE-2026-14266 en 7-Zip: por qué en la mayoría de los PCs de empresa el mejor parche es desinstalarlo
9 min read

The best patch for 7-Zip is uninstalling it (on most of your PCs)

CVE-2026-14266 is a heap overflow in 7-Zip's XZ decoder: it affects version 21.07 and every release up to 26.01. With no public exploit and no known exploitation, it is not an emergency. But that is two code-execution flaws in two months, the program updates by hand, and Windows 11 has opened .7z and .rar natively since 2023. Before updating two hundred machines, it is worth checking how many actually need it.

Security Windows Endpoint
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN