Shadow AI: The Employee Nobody Hired

The office lights were off. The work kept moving. Nobody remembered hiring anyone.

Half of Dutch organisations have no clear rules for AI use at work, and 58% already run autonomous AI agents that act on their own.

• The clock is real: Article 50 of the EU AI Act, the transparency rules, applies from 2 August 2026, under four weeks away. Chatbots must say they are chatbots and AI-generated content must be labelled. You cannot label the output of tools you do not know exist, so step one is an inventory.
• Shadow AI is also unpatched plumbing: LiteLLM, a popular AI proxy that routes traffic to 100+ AI models, shipped a pre-authentication SQL injection (attackers smuggle database commands in before any login), CVE-2026-42208, scoring 9.3 out of 10 on the CVSS severity scale. It was exploited within 36 hours of disclosure to steal API keys, and the CCB (Centre for Cybersecurity Belgium) issued a patch-immediately advisory. If a developer quietly stood one up for the team, that is now your attack surface.
• The fix is boring and cheap: ask staff which AI tools they actually use (survey, not tribunal), name the data that may never leave, approve a short list, and put it on one page. Our acceptable AI use guide walks through all five steps.

KnowBe4: From Agentic Risk to Human Wins → https://www.knowbe4.com/press/knowbe4-report-reveals-success-in-the-era-of-agentic-ai-demands-a-cybersecurity-culture-first-approach

Platform Spotlight: Walk In Mid-Case

The good detectives join a case already in progress. So does the demo now.

The /demo now drops you into the middle of a live engagement instead of a blank office.

• Evidence you can poke: 28 evidence artifacts, policies and procedures as partner uploads plus logs and configs from the connected mock integrations, already linked to specific controls. Readiness lands around 70% with a realistic ready / at-risk / open spread.
• Scope-per-entity, pre-staged: one control arrives with servers and workstations covered while phones stay open, so the "name the missing devices" view has something to name on the first click.
• Never stale, never fragile: timestamps sit 2 to 38 days back on every nightly reset, and each reset verifies and repairs the whole story, so the demo you open on a partner call is always intact.

Walk into the demo → https://easycyberprotection.com/demo/

Patch Watch: The Doors Nobody Locked

Three doors. One had a perfect 10 on it. One had been open for fifteen years.

Adobe ColdFusion tops this week's patch list: eleven flaws fixed on 30 June, six of them scoring the maximum CVSS 10.0, and one already being abused.

• ColdFusion (CVSS 10.0, actively exploited): CVE-2026-48276 leads, an unauthenticated file upload giving remote code execution (RCE, running the attacker's code on your server). Sibling flaw CVE-2026-48282 was exploited within two hours of disclosure; the US cyber agency CISA added it to its Known Exploited Vulnerabilities (KEV) list on 7 July with a three-day deadline. Affected: ColdFusion 2025 up to Update 9 and 2023 up to Update 20. CCB advisory.
• OpenSSH, the summer fleet check: CVE-2026-35414, flagged by the CCB in late April and worth a holiday-season sweep. A comma in an SSH certificate name can hand out root access, the bug sat in the code for 15 years, and a successful abuse logs as a normal login. Only setups using SSH certificates are affected; the fix is OpenSSH 10.3. If you are not sure every server got it, that uncertainty is the finding.
• SharePoint, follow-up: the RCE we covered in week 22 (CVE-2026-45659) is no longer theoretical. CISA confirmed active exploitation and added it to the KEV list on 1 July. If that patch is still sitting in a ticket queue, close it this week.

The Hacker News on the ColdFusion patches → https://thehackernews.com/2026/07/adobe-patches-7-cvss-100-flaws-in.html

Fraudstop: One Number for Bad Nights

Every noir has a phone that rings at three in the morning. Belgium finally gave it one number.

Belgium now has a single emergency number for online fraud: Fraudstop, folded into Card Stop at 078 170 170, answering 24/7.

• When to call: the moment you spot an unauthorised transaction, a leaked card or security code, or an itsme approval someone talked you into.
• Why immediately: the first minutes decide whether the bank can still block or recall the money. Fraud recovery is a speed game, not a paperwork game.
• What to do today: put 078 170 170 in your incident one-pager, brief whoever handles payments, and pass it to your clients. For MSPs (managed service providers) this is the easiest client handout of the quarter.

CCB: Fraudstop, a centralised emergency number → https://ccb.belgium.be/news/fraudstop-centralised-emergency-number

The Usual Suspect

Once an issue, our in-house AI gets the floor. T.A.R.S. drafts your compliance policies on the clock; this is what it does off it.

This week's lead says half of you run AI with no rules. As the only AI in this building with a badge, I take that personally. I work scoped, logged and reviewed. Every policy I draft gets a human signature before it ships. The free chatbot your marketing team pasted the client list into last Tuesday remembers everything, works for exposure, and…