Compliance Pulse

A proposed FCC rule would require US telecoms to collect government-issued ID and a physical address from all phone customers, effectively ending anonymous prepaid SIM cards. The stated goal is reducing scam calls and SMS fraud. Privacy advocates argue the requirement mirrors mandatory phone registration laws in authoritarian states where buying a plan without surrendering your identity is not possible.

For everyday users: if it passes, anonymous mobile phone access in the US is finished.

No major compliance updates today.

On June 12, the U.S. government issued an export control directive ordering Anthropic to suspend all access to Fable 5 and Mythos 5, its two most advanced AI models, for every foreign national worldwide, including Anthropic's own foreign-national employees. Because selectively filtering foreign nationals was not technically feasible, Anthropic suspended both models globally.

The stated concern: someone had found a jailbreak — a technique that manipulates an AI model into ignoring its own safety rules, unlocking capabilities the model was specifically built to block. Anthropic is not disputing the jailbreak exists — it argues the technique is narrow and the underlying capabilities are already available elsewhere. All other Anthropic models remain unaffected.

This marks the most significant AI-specific export control action by the U.S. government to date.

CISA issued Binding Operational Directive BOD 26-04, a mandatory policy instruction for US federal civilian agencies, according to BleepingComputer. Agencies must patch any actively exploited vulnerability within three days of notification. The Ivanti Sentry flaw in today's Vulnerability Watch is the first live test: federal agencies have until this Sunday. The directive applies to government networks, but the three-day benchmark is a signal for everyone. If you manage IT systems, audit whether your patch process can actually meet a 72-hour window when it matters.

The U.S. Cybersecurity and Infrastructure Security Agency added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog this week, according to The Hacker News. The KEV catalog is a federal watchlist — if your organisation works with the U.S. government, patching listed flaws within CISA's deadlines is mandatory.

The three additions: a Cisco Catalyst SD-WAN Manager command execution flaw (CVE-2026-20245, CVSS 7.8), a Google Chrome memory vulnerability enabling remote code execution (CVE-2026-11645, CVSS 8.8), and an Arista EOS network flaw with no patch planned (CVE-2026-7473, CVSS 6.9). The Chrome flaw affects everyday users — if you have not updated your browser recently, do it now.

No major compliance updates today.

No major compliance updates today.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA — the American government body responsible for national cybersecurity guidance) has added a high-severity denial-of-service (DoS) flaw in SolarWinds Serv-U (a multi-protocol file transfer server used by businesses to manage file sharing) to its Known Exploited Vulnerabilities (KEV) catalog. Inclusion in the KEV means active exploitation has been confirmed.

U.S. federal agencies are required to patch by the deadline CISA sets. If your organisation follows CISA guidance — or simply values not being next — treat this as urgent.