LinkedIn Carousel - #CyberWeekly Week 44

The Tax Office Went Dark. Your Deadline Did Not.

MyMinfin offline after a cyberattack. The fake "it is back, log in" mail is next.

47 Belgian leaks since January

ECP: free tools, incident clock

For your IT partner: four fixes

Easy Cyber Protection

Your to-do list

This week's cyber to-do list

For you

Tell staff today: no mail or text about MyMinfin, a refund or a new deadline gets a click. Type minfin.fgov.be yourself and log in with itsme or your eID. Today.
Call your accountant about anything due on 31 October. Agree who files what, by which route, and keep a screenshot of the outage notice. Today.
List the three online portals your firm cannot work without, and write next to each what you do for a week when it is dark. This week.
Run your company domain through Have I Been Pwned, and write a name next to "who answers when the Data Protection Authority, a customer or a journalist calls". This week.

For your IT partner

Forward this list. Ask for Done, Not applicable or a date on each line.

Nextcloud: remove the "Collabora Online - Built-in CODE Server" app or update it to 26.4.303 (CVE-2026-110447, exploited, CISA deadline was 26 October). Now.
Adobe Commerce and Magento Open Source: the "-2026-jul" release of your line, 2.4.4 to 2.4.9 (CVE-2026-48356, unrestricted file upload, exploited since 27 October). This week.
Web hosts still on an old kernel: update, then re-check the PHP line from week 43. CVE-2026-46300 is chained with the PHP flaws to run commands as root (CISA deadline 31 October). Now.
VMware ESXi 8.0: ESXi80U3j-25429389; ESXi 9.0: ESXi-9.0.2.0100-25595025 (CVE-2026-41709, admin actions went unlogged; CISA deadline 11 November). This week.
Mail filter: flag every inbound mail that names MyMinfin, Tax-on-Web or FOD Financiën and did not come from a fgov.be domain. Today.

1/5

The tax office went dark. Your deadline did not.

Why this one is different from last week.

The tax office is offline after a cyberattack. Non-IT No MyMinfin mail gets a click this week; call your accountant about 31 October. IT Flag inbound mail naming MyMinfin from outside fgov.be.
47 Belgian organisations leaked data since January. Non-IT Check your domain at Have I Been Pwned; name who answers the regulator.
Four flaws hackers already use. IT Nextcloud CODE app now; Adobe Commerce, ESXi and the kernel under your web hosts this week.

VRT NWS: FOD Financiën hit by a cyberattack, MyMinfin and other services offline as a precaution (28 Oct 2026) → https://www.vrt.be/vrtnws/nl/2026/10/28/cyberaanval-bij-fod-financien/

2/5

by Patch, our friendly house bot

— Patch, your friendly house bot

Patch, our house bot, writes: I spent Wednesday evening at the accountant's desk, on the landline. The laptop was fine. The one portal she needed was gone, and refreshing does not open a door you do not hold the key to.

3/5

47 Belgian organisations leaked data since January

How this differs from last week's number.

Who: municipalities, hospitals, travel agencies and private companies. Not the biggest names: firms with a customer file and nobody whose job is security.
What: names, birth dates, addresses, phone numbers, bank account numbers, and in some cases family photos.
What it sells for: a few hundred euros per batch, according to the researchers. The file itself is cheap. A caller who knows your bank account and your birthday gets believed, and that is what the buyer pays for. This week's fake tax mails work the same way.

Econostrum, relaying L'Echo and Fox&Fish: at least 47 Belgian organisations hit by a hack or data leak since January 2026 (26 Oct 2026) → https://econostrum.info/belgique/?p=113888

4/5

New on our site: four free tools, no login

New here?

Incident reporting clock. Enter when you found out; it shows every reporting deadline to the CCB, to the minute. The NIS2 deadlines (24 hours, 72 hours, one month) and the 72-hour GDPR one from story 2, counted from when you knew.
NIS2 scope check. Now uses the legal size test, headcount and turnover as the law counts them, so the answer matches what the CCB would say.
NIS2 fine calculator. What the law allows, for your size and category. A number you can put in front of the board.

See everything that shipped → https://easycyberprotection.com/changelog/

5/5

For your IT partner

Not in IT?

Nextcloud, Collabora Online Built-in CODE Server appFlaw: CVE-2026-110447, OS command injection, remote code execution, exploited.Fix: 26.4.303, or remove the app and point Nextcloud at a separate Collabora server.Do by: now. CISA's deadline was 26 October.Who checks: IT on every Nextcloud you run or host.
Adobe Commerce and Magento Open SourceFlaw: CVE-2026-48356, unrestricted file upload, CVSS 9.6, on CISA's exploited list since 27 October.Fix: the "-2026-jul" release of your line, 2.4.4 up to 2.4.9.Do by: this week. CISA says 10 November.Who checks: IT or the agency that runs the webshop.
Linux kernel on web hostsFlaw: CVE-2026-46300, chained with the PHP flaws of week 43 to plant a webshell and run commands as root.Fix: your distribution's current kernel, then the PHP line again.Do by: now. CISA's deadline is 31 October.Who checks: IT or the hoster.
VMware ESXiFlaw: CVE-2026-41709, admin operations not written to the log, CVSS 2.7, exploited.Fix: ESXi 8.0 ESXi80U3j-25429389; ESXi 9.0 ESXi-9.0.2.0100-25595025; VMware Cloud Foundation 5.x to 5.2.4. No workaround.Do by: this week. CISA says 11 November.Who checks: IT.

CISA Known Exploited Vulnerabilities catalog: CVE-2026-110447, CVE-2026-48356, CVE-2026-46300, CVE-2026-41709 (added 23 to 28 Oct 2026) → https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Read the full issue

5 stories. Context that matters.
Belgian cybersecurity, weekly.

Scan to read online

https://easycyberprotection.com/cyberweekly/2026/week-44

Follow #CyberWeekly

easycyberprotection.com