The Invoice Was Real. Only the Number Changed.

The canvas is genuine. Someone repainted one corner and hung it back on the wall.

An attacker who is already reading your mailbox does not need to send you anything.

• There is no fake email to spot: the message is the genuine one, and only the International Bank Account Number (IBAN) changed. Safeonweb's rule, for your finance staff: treat any account number you do not recognise, or that your banking app does not, as suspect until you confirm it on a channel the sender did not choose.
• Fraud arrives on more than one channel: a call, then an email, then a visit. Fraudsters place fake calls in the name of the police, ING, Argenta, Crelan, Cardstop or Proximus with a recorded "suspicious login attempt". In some cases they then come to the door for the bank card and PIN. Nobody legitimate collects a card at your door.
• The target is your approval, not your password: criminals push victims to confirm something in itsme, or lean on the government login platform CSAM, to get an action approved that the victim never started. The pressure is the tell, and itsme warns you if you use it while on a call.

Safeonweb: phishing trends for 2026 → https://safeonweb.be/en/news/phishing-trends-2026-spot-latest-scams

Counting the Missing Frames

An inventory only tells you something once you count the empty frames.

The Dutch data protection regulator counted 136 ransomware attacks reported to it in 2025, against 127 in 2024, and the interesting number is not the total.

• The breakdown: in 65 attacks data was stolen and encrypted, in 32 it was only stolen, in 13 only encrypted, and in 26 it was encrypted with theft unclear. Theft-only cases went from 15 the year before to 32.
• Locked files are no longer the threat model: in nearly a quarter of cases the criminals never bothered encrypting anything. A working restore does not help you when the leverage is publication, so the plan has to cover a leak as well as an outage.
• The way in is unglamorous: the regulator names two entry vectors, vulnerabilities where the update was never installed, and phishing. Both are on every baseline control list already.

The AP ransomware report 2025 (Dutch) → https://autoriteitpersoonsgegevens.nl/documenten/rapportage-ransomware-2025

Patch Watch: Roadworks in the East Wing

Half the wing is closed and the scaffolding is up for a reason.

Two flaws were exploited as zero-days this week, and both are management consoles: the box that manages the other boxes.

• Arista VeloCloud Orchestrator, CVE-2026-16812, CVSS 10.0 (do this first): unauthenticated operating-system command injection in the on-premises orchestrator for VeloCloud software-defined wide area network (SD-WAN) deployments. Network access to the web interface is enough, no credentials. CISA added it to KEV on 27 July with a fix-by date of 30 July, which has already run out. Hosted and Dedicated deployments were patched before disclosure.
• Cisco Secure Firewall Management Center, CVE-2026-20316: a hard-coded password lets an unauthenticated remote attacker log in through a built-in low-privileged account and read sensitive data from the system. KEV listed 29 July, fix-by Saturday 1 August. Cisco has hot fixes for 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0, and no workaround.
• SharePoint, still bleeding from July: Shadowserver tracks close to 10,000 internet-exposed SharePoint servers, of which more than 800 were still unpatched against CVE-2026-32201 and CVE-2026-45659 when the count was reported on 15 July. On-premises SharePoint carries a lot of Belgian document workflow.

CISA's Known Exploited Vulnerabilities catalogue → https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Eighty Pages of Provenance

Every piece in the collection now needs papers, and the papers have just been standardised.

The European Commission published its first official guidance on applying the Cyber Resilience Act (CRA) on 27 July: a short communication, C(2026) 5252, plus…

• What it settles: what falls in scope (including remote data-processing solutions and free and open-source software), what counts as a substantial modification, how long a support period has to run, how reporting works, and how to do the risk assessment.
• Small companies are the audience, not a footnote: microenterprises and SMEs get their own treatment, and the annex refers to SMEs 166 times across those 84 pages. Worked examples, flowcharts and use cases do most of the explaining.
• Two dates to diarise: reporting obligations start on 11 September 2026, main obligations on 11 December 2027. The reporting one is the near one.

The Commission guidance on the Cyber Resilience Act → https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation

T.A.R.S.: I Can Tell You What It Says. I Can't Tell You Who Wrote It.

Once an issue, our in-house AI gets the floor. T.A.R.S. drafts your compliance policies on the clock; this week it read a document that was drafting it back.

On Sunday the law says I have to introduce myself.

On Sunday the law says I have to introduce myself. Fine. Hello. The awkward part is what came out three days earlier. A researcher showed that a Word document can carry instructions written for me and not for you: white eight-point text, invisible on screen, perfectly legible to a model. Copilot for Word read a supplied document, followed the…

The Hacker News: hidden prompts copied into Copilot documents → https://thehackernews.com/2026/07/microsoft-copilot-for-word-can-copy.html