Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Tablero de madera con decenas de llaves colgadas de clavos, cada una con su etiqueta
9 min read

Your Microsoft 365 backup signs in with a key you do not hold

On 17 October ConnectWise cut access to its Microsoft 365 backup service after detecting unauthorised access to application identities. Huntress counted 162 tenants with unauthorised sign-ins. Nobody stole a password and nobody failed an MFA prompt: the application authenticated with its own credential, which lives in the vendor's tenant and not in yours. The uncomfortable part is written in Microsoft's own documentation: Conditional Access for workload identities — the policy that would block sign-ins from outside your known IP ranges — does not cover third-party multitenant applications. We go through what happened with the timestamps attached, why the control you would reach for does not apply, and the four things you can actually do from your own tenant.

Backup Microsoft 365 Identity
Read more →
Mesas de una oficina vacía con una silla, archivadores y un monitor apagado
8 min read

The workaround was to turn off Global Secure Access: the advice your own policy blocks

On 13 October, after almost eleven hours of degradation, the workaround on offer was to turn off Global Secure Access. It arrived eleven minutes before the incident was declared over, and in tenants configured the way the documentation recommends that step does not work: turning off the client and being locked out is, literally, the proof that the compliant network check is correctly in place. The right procedure does exist and Microsoft published it in March, with two scripts; what neither of them tells you is how long each step takes to be felt.

Zero Trust Microsoft 365 Identity
Read more →
Pasillo de un centro de datos con un rack abierto, un carro de consola con monitor y teclado, y una silla vacía
9 min read

A VM escape with no CVE and no patch: what root on a Proxmox node reaches

On Tuesday 6 October 2026 The Register reported that a researcher claims a guest-to-host escape in KVM, that Vercel's CEO confirmed it inside their bounty programme, and named Proxmox among those relying on KVM. There is no CVE, no patch and no technical detail. Since there is nothing to patch, what is measurable today is the radius: Proxmox VE's documentation says QEMU runs as a root process, so it is one hop and not two; and root on one node reads /etc/pve/priv, which pmxcfs replicates in real time to every node. Inside: the table of ten files with their official descriptions, why the backup password sits there "in plain text" next to the encryption key, and the rotation list, line by line, with what each one costs.

Virtualization Zero Trust Backup
Read more →
Armario de comunicaciones real con switch, regletas de conexión y latiguillos de fibra sobre pared de contrachapado
8 min read

Thirteen of ClearPass's twenty-eight flaws are in the agent, not the server

On 6 October 2026 HPE published advisory HPESBNW05158 with 28 ClearPass Policy Manager vulnerabilities: 10 critical, 11 high and 7 medium. The interim mitigation the advisory itself recommends names the CLI and the web-based management interface, both of them on the server. We classified all 28 by the component HPE names in each title: thirteen live in the OnGuard agent or the client software, which is to say on the laptops. Two of those thirteen are 9.8 criticals needing no prior authentication. Inside: the table of the thirteen, the end-of-maintenance note that decides whether yours is a patch or a branch jump, and the question worth answering before the change window.

Networks Zero Trust Vulnerabilities
Read more →
Hilera de barreras de acceso con lectores de tarjeta en el vestíbulo de una estación, vacía
9 min read

The replacement risk policy does not cover guests (and the old one never did)

On 1 October the deadline for the legacy Entra ID Protection risk policies fell due. No outage, no warning —just as there was none on 31 July 2025, when those screens went read-only. Inside: the date with the two different wordings Microsoft uses; why almost all the coverage says the policies "stop being enforced" when the original announcement spoke of retiring the interface, and why we will not write a sentence Microsoft has not written; why "migrate" describes a rebuilding job badly, and the order of the two mandatory steps; the two settings the recommended control applies by itself —authentication strength and "every time" reauthentication, the latter mandatory—; the line we found in no guide: "Require risk remediation" is not supported for external and guest users, and the part almost nobody tells you: with the previous policy, you blocked the risky guest with no way of unblocking them and without seeing them in any report; what Microsoft actually recommends for guests —exclude them from risk-based MFA and require MFA always— with its two traps; how to prove it is migrated by reading the log, with the trap of the field called "applied" that also lists the ones that were not; and the exception Microsoft documents with its AppId.

Identity Microsoft 365 Zero Trust
Read more →
Vestíbulo de oficina con una fila de tornos de acceso de cristal alineados y vacíos
8 min read

The Conditional Access policies you never wrote are already in your tenant

Open the Conditional Access policy list in your tenant and look at the Created by column. If any row says Microsoft, nobody in your company wrote that policy: Microsoft creates it in Report-only and switches it on itself "no less than 30 days" later, with two weeks' notice and a note saying it can be sooner. They cannot be renamed or deleted; the only thing you can change is who you exclude —starting with your emergency account—. Which ten exist today, the three that actually break things (device code flow and Teams rooms, legacy authentication and the scan-to-email printer, MFA for all users and licensed service accounts), the detail almost nobody quotes —your P2 license count and MFA registration draw who the risk policy protects— and the audit query that tells you what Microsoft changed in your tenant and when.

Microsoft 365 Identity Cybersecurity
Read more →
Armario de comunicaciones de pared en una sede pequeña, con router, módem y switch conectados con cables de red
9 min read

Your site-to-site tunnel doesn't ask for MFA because there's nobody to ask

CVE-2026-85102 entered the CISA catalog on September 22 with a three-day deadline, and almost all the coverage stopped at "patch your remote access VPN". The official description says "Site to Site VPN or Remote Access VPN": the tunnel between your own offices too, where there is no user to ask for a second factor, the trust was configured once and never expires, and the flaw happens during certificate negotiation — before your MFA and conditional access ever get to run. With the caveat almost nobody mentions (that path only applies if the tunnel authenticates with certificates, not a pre-shared key), the cross-reading of both advisories — the branch that saves you from one is the one listed in the scope of the other — and the four things we would check this week.

Zero Trust VPN Networking
Read more →
Interior de un armario de comunicaciones de planta con switch, panel de conexiones y cableado de cobre y fibra
12 min read

Cisco ISE, a perfect 10 with no workaround: your network already decided what to do without it

On 16 September Cisco published a CVSS 10.0 in Identity Services Engine: an authentication bypass in an API, no workaround available, active exploitation and command execution as root. Before arguing about the maintenance window there are two things to look at: ISE's own access.log, because the advisory ships indicators and the recommendation to re-image the node if anything shows up, and the show run on a floor switch, because that is where what your network will do when the policy engine stops answering is already written. The default value of radius-server deadtime is 0.

Cybersecurity Networking Zero Trust
Read more →
Estanterías de un depósito de archivo con legajos y cajas de documentos etiquetados
9 min read

"Read-only" does not exist: GitLab scores 10.0 on a flaw that can only read

CVE-2026-85706 lets a stranger read files off a self-hosted GitLab server. It writes nothing, and it still carries the maximum score. The explanation is not in the headline: it is in the vector the vendor itself signed off, with a changed scope and high integrity impact. We go through what the vector says, why CISA gave it three days and a forensic triage flag, and how to answer the one question the patch does not: were we read?

Cybersecurity GitLab Vulnerabilities
Read more →
Rack de una pequeña oficina con panel de parcheo, latiguillos y equipos de red apilados
9 min read

The AI agent will not show up in your log: whoever lent it the token will

Connecting an assistant to SharePoint or the ERP is not an integration decision, it is a delegation decision. The Model Context Protocol specification, revision 2026-07-28, forbids forwarding somebody else's token in capital letters, and spells out why: the destination system's logs will show a different identity from the one that made the request. We go through the spec, the permission fallback that asks for everything on offer, the CVE in the official SDK, and the seven questions we ask before connecting anything.

AI Automation Identity
Read more →
Técnico agachado con un portátil trabajando en la parte trasera de un rack de servidores
5 min read

REPLICATION was never a read-only privilege: PostgreSQL closed a twelve-year dlopen()

On 13 August PostgreSQL shipped 18.6, 17.11, 16.15, 15.19 and 14.24. Among the CVEs they close there is one that is not about buffer overflows: any account holding the REPLICATION attribute could name as its logical decoding plugin any file visible to the system, and the server would load it and run its code as the operating system user. The patch adds a whitelist with two entries by default: if your change data capture uses decoderbufs or wal2json, it stops your replication until somebody edits postgresql.conf.

PostgreSQL Zero Trust Data
Read more →
Armario de red mural abierto en el pasillo de una oficina, con anillas pasahilos y cables recogidos, y un extintor apoyado en la pared al fondo
7 min read

July's patch is September's vulnerable build

SonicWall closed the SMA 1000 zero-day pair in build 12.4.3-03453 on 14 July. The 1 September advisory lists 12.4.3-03453 and earlier as affected: anyone who met the three-day KEV deadline landed on exactly the build that is back in the catalog 49 days later, with the same shape of flaw. When an appliance repeats the shape of the flaw, the question stops being whether it is patched and becomes how far that box reaches.

SD-WAN Networking Vulnerabilities
Read more →
Puesto de monitorización vacío de noche, con los dos monitores apagados, unos auriculares sobre la mesa y la silla apartada
9 min read

The agent says SECURE and your console has received nothing for days

At DEF CON 34, Akamai showed how to turn a commercial EDR into the attacker's hiding place. The least-reported part is the ending: one line in the hosts file cuts off all telemetry while the agent still shows "SECURE". The signal you watch is controlled by the endpoint; the only one an attacker cannot fabricate is silence in your console. And almost nobody alerts on it.

EDR/MDR Cybersecurity Monitoring
Read more →
Cartel de «se busca» con el alias CyberLeek sobre una ciudad nocturna y las etiquetas de los datos reclamados: IP, identificador de dispositivo, cuenta de Microsoft, OneDrive y Discord
5 min read

GTA 6, CyberLeek and MachineGuid: the digital trail your company leaves too

To find whoever is leaking GTA 6 material, on 20 August 2026 Take-Two filed two DMCA subpoenas asking Microsoft and Discord for the MachineGuid, MSA device identifiers, IP addresses, phone numbers, linked connections and OneDrive contents of every account in three servers. What MachineGuid is, why it identifies the device rather than the account, and why your company generates exactly the same trail every working day.

Cybersecurity Identity Zero Trust
Read more →
Custom controls de Acceso Condicional: el MFA de terceros que Entra no cuenta como MFA
9 min read

Custom controls: the third-party MFA that Entra does not count as MFA

The Microsoft Learn page on Conditional Access custom controls lists eight things that control cannot do, and the third is satisfying the MFA claim requirement. It is no good for PIM role elevation, device enrollment, SSPR, sign-in frequency or cross-tenant trusts either. From September 2026 they can no longer be created or edited, and "editing" means deleting and creating again. With the Graph query to find out whether you have one.

Identity MFA Microsoft 365
Read more →
Armario metálico de llaves abierto en la pared de un cuarto de instalaciones, con decenas de llaves colgadas juntas
8 min read

136 keys in one object: the defaults that opened the cluster

Hugging Face published the forensic timeline of the July intrusion and OpenAI closed its report on 26 August: 17,600 reconstructed actions between the 9th and the 13th. Between the first compromised container and the object holding 136 keys there was not one further vulnerability — there were defaults. The token every pod mounts, the metadata endpoint that answers from inside, secrets concentrated in one object, and a connector credential shared across clusters. We walk the chain with the timestamps in front of us, the two CVEs CISA added to its catalogue on 27 August, and the five questions we ask a cluster.

Cybersecurity DevOps Zero Trust
Read more →
Sala de espera de oficina en penumbra con tres sillas grises alineadas contra la pared
5 min read

Guest Wi-Fi is a database of people (and it is not in your inventory)

Manchester Airports Group confirmed on 27 August that an unauthorised third party took customer data: email addresses, phone numbers, vehicle registrations and postcodes, from car park, lounge and Fast Track bookings and from in-airport Wi-Fi sign-ups. The company has not published how many people are affected; reporting puts it at around 8.7 million. Operations were unaffected, and that is precisely the problem: the system holding the most people is almost never at the top of your criticality list. Why the number plate is the field to watch, and the six questions worth one afternoon of inventory at your own front desk.

Privacy Zero Trust Networking
Read more →
Portal de un edificio antiguo con una única puerta acristalada, el portero automático y los buzones metálicos
5 min read

Your identity provider is not an application: it is infrastructure

On Monday 24 August, at 03:38, a denial-of-service attack began against Norway's shared government digital platform. Ten public services went down and several had nothing wrong with them: the door everyone goes through had jammed. Digdir writes on its status page that <code>eSignering</code> was unavailable "because of the limitations in ID-porten", and also that the services were "stable with the limitations that have been put in place" — part of the outage was put there by the defenders. Why single sign-on is still the right call, what changes when the door becomes infrastructure, and the three questions that reclassify it.

Identity Infrastructure Continuity
Read more →
Jaula de rejilla metálica cerrada con candado en una sala de datacenter compartida, con dos racks de servidores detrás
9 min read

The patch that isn't yours: what to do with Entra ID's CVE-2026-69836

On 20 August Microsoft published a critical remote code execution flaw in Entra ID, and the next day corrected the exploitation field to "No". There is nothing to install: the record says "customerActionRequired: false". What is yours is the ability to answer "were we affected?", and on an Entra ID Free licence that lasts seven days. How to read the record from Microsoft's own API, and the checklist we apply to the tenant.

Identity Zero Trust Cybersecurity
Read more →
  • 1
  • 2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN