Editorial

Two stories in this issue are the same story, and I want to put them next to each other.

WEBA could reopen four stores in two days and still could not say exactly which customer records had left. The NinjaOne change we shipped this week exists so that one failed patch in fifteen hundred cannot quietly hide…

WEBA customer data stolen?

August is the season of lists. The trouble starts when somebody else reads yours out loud.

Belgian furniture chain WEBA was hit on 10 August. It shut its four stores and its webshop as a precaution and had everything running again by 12 August. On…

• WEBA said early what an honest company says. Names, addresses, e-mail addresses and phone numbers may be involved, and the exact scope was not yet clear. The stores in Gent, Deinze, Mons and Tongeren were taken offline on purpose, examined, re-secured with IT partners, and reopened. That part worked.
• Listed is not the same as published. A leak-site entry is the pressure step: pay, or the files go up. At the time of writing the data has not been posted. The listing is recorded by leak-site trackers (ransomware.live logs the victim page at 16 August, 15:58 UTC). It is the crew's claim, not a WEBA statement.
• Getting the shop open is the easy half. Restoring systems is a job with a finish line. Working out exactly which records left the building is slow forensic work, and it is the half that decides what you have to tell your customers, and when.

ITdaily: furniture chain WEBA hit by cyberattack, customer data stolen → https://itdaily.be/nieuws/beveiliging/meubelketen-weba-getroffen-door-cyberaanval-klantgegevens-gestolen/

Nobody can audit CyFun Essential

The other kind of list: the official one, with a line on it that cannot be ticked.

On 18 August the cyber inspectors at the CCB published a letter telling those organisations what to do if they cannot reach the top CyFun level by 18 April 2027: file a catch-up plan instead.

• If you are a supplier, this arrives as paperwork. An organisation that has to evidence Important-level compliance by next April evidences part of it through the companies it buys from. The questionnaire is the delivery mechanism, and it does not care how small you are.
• Here is the part nobody is saying out loud. The CCB's own list of authorised bodies, in its current version, names four organisations allowed to verify CyFun. All four are approved for Basic through Important. None is approved for Essential. The certificate meant to be held next April cannot be bought today, from anyone, at any price.
• So read April 2027 as an Important-level deadline with paperwork attached, and April 2028 as the real Essential one. No legal deadline moved: this is a request for information under Article 48 of the NIS2 law, not a change to it. What is new is the 2028 date.
• A risk analysis can justify aiming lower. Then you owe nobody a catch-up plan, you simply demonstrate the level you chose. That escape hatch is in Article 7 of the royal decree and it is unchanged.

CCB: new communication for NIS2 essential entities → https://ccb.belgium.be/news/new-communication-nis2-essential-entities

Update your SharePoint server now

The line on the supply list that turns out to be for the other class.

On 11 August, security firm Rapid7 published its analysis of CVE-2026-55040 together with a working proof-of-concept. By 12 August, honeypots were logging…

• Microsoft fixed it in the July updates. Anyone current was never exposed. The whole window belonged to servers that had not applied a month-old patch, which is the ordinary case, not the unlucky one.
• Affected: SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016. SharePoint Online is not affected.
• The gap between a published write-up and mass attacks is now a day. That is the part worth carrying away, more than the number. "We patch monthly" was a sound policy when that gap was measured in weeks.

Help Net Security: attackers exploit critical SharePoint flaw after PoC goes public → https://www.helpnetsecurity.com/2026/08/13/microsoft-sharepoint-cve-2026-55040-poc-exploit/

We now show which updates failed

A folder with tabs and your name on it, instead of one envelope with everything shaken into it.

If you sync NinjaOne, the patch and antivirus evidence we collect no longer lands as a single unreadable blob. It lands as a folder:

• Failures are sampled first, deliberately. Big fleets overflow the row cap on patch tables. Failed patches rank ahead of pending, pending ahead of merely high-severity, and degraded antivirus endpoints ahead of healthy ones. A fleet with 1,500 clean patches and one failure used to be able to produce a file showing nothing wrong. Evidence that hides the one bad row is worse than none, because it reads like proof.
• This is the whole point of collecting it. Evidence exists to be handed to someone who did not build your systems and does not trust you yet. If they cannot navigate it, you have a backup, not evidence.
• Nothing to switch on. The next sync writes the new shape.

Open your evidence folder → https://easycyberprotection.com/app