Compliance Pulse

CISA, leading a joint advisory with the FBI and the Department of Health and Human Services, confirmed that the Medusa ransomware gang has breached more than 500 critical infrastructure organisations in the United States since 2021 — up from 300 just over a year ago, according to Bleeping Computer. Targets include healthcare, finance, government, and education. The advisory recommends patching known vulnerabilities, segmenting networks to limit lateral movement (an attacker's ability to move from one system to others once inside), and blocking untrusted remote access.

CISA — the US Cybersecurity and Infrastructure Security Agency — has added CVE-2026-20349, a high-severity vulnerability in Cisco firewall software, to its Known Exploited Vulnerabilities catalog. The flaw is actively being used to temporarily knock Cisco firewalls offline. US civilian federal agencies were required to apply fixes by 14 August 2026. If your organisation runs Cisco firewalls and has not yet patched, treat this as urgent. Full details are available via Help Net Security.

France's Directorate General of Public Finances (DGFiP) confirmed that an attacker accessed its internal systems in late June after stealing or misusing an employee's identity, according to The Record. A hacker using the alias ZeroBytes claims to have extracted data on over 600,000 people, including tax identification numbers, family details, and financial status — the kind of data that enables highly targeted fraud. French authorities have opened a criminal complaint and will notify affected individuals. It is the latest in a string of French government breaches this year.

Seventeen draft technical standards for the EU's Cyber Resilience Act (a law requiring connected products sold in Europe to meet mandatory cybersecurity requirements) are now open for review, according to Help Net Security. The standards cover products including smart home assistants, password managers, and connected toys. Manufacturers who follow an approved standard gain a presumption of legal compliance. The comment window closes between mid-September and mid-November 2026, with the full obligation kicking in at the end of 2027. Small businesses selling any connected hardware or software into European markets should read the relevant draft now, not after the deadline.

The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-68820, the Windows WinSock privilege escalation flaw exploited by North Korea's Lazarus Group, to its Known Exploited Vulnerabilities catalogue, according to The Record. Federal agencies have until 25 August to apply the patch. For everyone else, the directive underlines what the evidence already shows: this is the only confirmed in-the-wild exploit from August's Patch Tuesday. A device restart is required and no workaround exists.

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog to confirm that ransomware groups are actively exploiting CVE-2026-45659, a high-severity SharePoint flaw that allows low-privileged attackers to execute code on unpatched servers, per Bleeping Computer. Federal agencies were ordered to patch within three days of the July 1 listing. Shadowserver currently tracks over 8,500 SharePoint servers exposed online, with more than 200 still unpatched. If you run SharePoint on-premises, apply Microsoft's latest patches now and enable Windows Antimalware Scan Interface (AMSI) integration for your SharePoint web applications.

Two Democratic senators introduced the Water Cyber Shield Act this week, proposing $300 million in annual funding to improve cybersecurity across US water and wastewater systems. The bill would give the EPA authority to conduct security assessments, mandate corrective action when vulnerabilities are found, and require incident reporting in line with the forthcoming CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act). The push follows attacks on at least 30 water systems across 12 states, attributed to groups linked to Iran's military. For everyday residents: cleaner regulation of the systems that supply your drinking water is the goal.

As of 2 August 2026, the EU's AI Office and national authorities began actively enforcing the AI Act — the world's first broad legal framework regulating artificial intelligence — according to Help Net Security.

Fines run up to €15 million or 3% of global annual turnover. The AI Office has launched a public complaints tool, a whistleblower channel for insiders, and a downstream complaints process for businesses building on top of others' AI systems. For most people and small businesses, the most important thing to know is that the mechanism now exists: if you believe an AI system has caused harm, there is a formal place to report it.

The TrueConf supply chain attack is worth flagging for organisations operating under vendor risk or software integrity policies. Kaspersky's finding that attackers replaced a signed installer with an unsigned malicious version is a direct argument for enforcing code-signing verification policies — checking that software carries a valid, unaltered digital signature before installation. If your organisation has a vendor management framework, a check on whether software update integrity is contractually required from suppliers is a reasonable next step.

The EU AI Act's transparency obligations under Article 50 are now in scope for enforcement. Organisations that deploy AI systems interacting with people must disclose that users are talking to AI. Violations carry fines of up to €15 million or 3% of global turnover.

In practice, the first year will likely bring corrective orders before large fines. The real near-term risk is being ordered to suspend or withdraw an AI process at short notice — potentially more disruptive than any financial penalty.

If your organisation uses AI-assisted customer communication or ticketing, audit it now.

Help Net Security