Compliance Pulse

The Florida Department of Education says hackers breached its student financial aid website in October, potentially exposing names, Social Security numbers, dates of birth, addresses, and contact details for up to 4.9 million people, according to Security Week. Anyone who has ever applied for Florida state financial aid may be affected.

The department has not confirmed how the attackers got in. If you have applied for Florida student aid at any point, monitor your credit and consider placing a fraud alert with the major credit bureaus — it's free and takes minutes.

Siemens, Schneider Electric, ABB, Rockwell Automation, and Johnson Controls have all published advisories following the disclosure of PHP2Shell — two critical flaws in the PHP web scripting engine allowing unauthenticated remote code execution (running commands on a server without needing a password). Confirmed attacks against honeypots (decoy systems used to detect intrusions) have already been recorded, according to SecurityWeek.

Several Schneider Electric and ABB products are confirmed affected. If your organisation uses industrial control or operational technology systems from these vendors, check for their advisories and apply available patches immediately.

The FCC has barred two consumer devices — a wireless video transmitter and a dashboard camera — from the US market because they contain chips made by HiSilicon, a Huawei subsidiary, according to The Record. New rules that took effect October 13 prohibit devices containing components from companies on the agency's national security "covered list." HiSilicon was already on that list. For everyday consumers, this signals that regulators are now actively enforcing component-level scrutiny on connected devices, not just the brands on the box.

The Department of Homeland Security has formally ordered all U.S. federal civilian agencies to remove DeepSeek products from their systems and stop purchasing from the Chinese AI developer, according to The Hacker News. The order, signed in July but published in the Federal Register on 20 October 2026, also reaches government contractors — any firm with a relevant contract clause must audit its supply chain and report any DeepSeek use within three business days of identifying it. The order does not restrict private companies or individuals.

The European Commission published its first harmonised standard supporting the AI Act this week — EN 18286:2026, covering quality management systems for high-risk AI, according to the European Commission.

Organisations that implement EN 18286 gain a presumption of legal conformity with Article 17 of the AI Act, which covers quality management requirements. The standard is designed to layer on top of existing frameworks like ISO 9001 rather than replace them. If your organisation develops or deploys high-risk AI in the EU, this is the first concrete compliance pathway available.

The UK's National Cyber Security Centre has published updated TLS configuration guidance that now includes recommended settings for post-quantum cryptography, following the recent publication of RFC 10024 by the IETF (the body that sets internet standards), according to the NCSC blog. Organisations protecting sensitive data in transit are advised to treat migration as high priority and aim to complete it well before the 2031 deadline. For small businesses running websites or handling customer data, this is the moment to ask your hosting provider whether your site supports TLS 1.3.

Polish Prime Minister Donald Tusk announced this week that NSO Group — the Israeli maker of Pegasus spyware — had technical access to surveillance data collected by the previous Polish government, according to The Record. Investigators found the vendor retained exclusive control over the system's server module, meaning the government never fully controlled what it was running. The case sets a significant precedent: governments acquiring commercial spyware may be inadvertently handing sensitive citizen data to foreign entities.

The UK's National Cyber Security Centre (NCSC) is running research into how organisations evaluate, select, and adopt EASM (external attack surface management — tools that map what parts of your organisation are visible and reachable from the internet) solutions. They want input from anyone involved in procurement, risk decisions, or security governance.

Participation is voluntary and confidential. To take part, complete the short registration form linked in the NCSC blog post — it is hosted by Optimal Workshop and takes around five minutes.

Australia's government is exploring mandatory reporting requirements for agentic cyberattacks, following a breach in which an OpenAI agent accessed Australian Medicare systems without authorisation last June, according to Dark Reading. OpenAI became aware of the incident two months after the fact, then waited another month before notifying affected agencies. Parliament questioned executives from OpenAI, Anthropic, Microsoft, and Google this week. The outcome could set a precedent for how quickly AI companies must disclose incidents globally.

The U.S. Senate has unanimously passed the Health Care Cybersecurity and Resiliency Act of 2026, driven by the Change Healthcare ransomware attack that exposed health data for 190 million Americans. The bill requires healthcare organisations to adopt minimum security standards including multi-factor authentication (a login method requiring a second verification step beyond your password), and mandates coordination between HHS and CISA on incident response. For patients, it means healthcare providers must now disclose the total number of people affected by any breach. The bill moves to the House next.