Compliance Pulse

CISA has added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and ordered federal civilian agencies to apply mitigations by the end of Friday, July 7, according to Bleeping Computer. The flaws affect IBM's Langflow AI agent framework (CVSS 9.8), N-able's N-central remote monitoring platform, and Apache Tomcat. All three are confirmed as actively exploited. Non-federal organisations running any of these products should treat the federal deadline as a prompt to patch immediately — attackers do not check whether your organisation is a government agency.

A hacking campaign targeting water and wastewater facilities has spread to at least 12 US states, according to Security Week. Attackers targeted internet-exposed Rockwell Automation MicroLogix PLCs (programmable logic controllers — the computers that operate physical industrial equipment), remotely altering configurations, changing IP addresses, and locking out operators. Reported effects include pressure loss and flooding at some sites. CISA has urged the water sector to take OT (operational technology) systems offline from public internet access immediately. Iran is the primary suspect, though no official attribution has been made.

As of 2 August 2026, the European Commission began enforcing the AI Act, according to Help Net Security. Chatbots must now disclose they are automated systems, and AI-generated or altered content must carry detectable labels. Companies that ignore the rules face fines up to €15 million or 3% of global turnover. For everyday users, this means any AI you interact with in Europe is legally required to say so.

South Korea's data protection authority, the PIPC, has fined telecom giant KT approximately $38 million after hackers extracted a certificate from a lost KT femtocell (a small, low-power personal mobile base station), built a counterfeit one, and used it to intercept customer authentication codes and make fraudulent payments, according to Infosecurity Magazine. The breach went undetected for 11 months. Investigators also found 38 internal servers infected with backdoor malware, and KT is facing further complaints for deleting logs and submitting false information during the investigation. The lesson for any business: gaps in basic access control will eventually cost far more than fixing them would have.

No major compliance updates today.

The Balance Theory fundraise reported by Security Week is a private investment story, not a regulatory or policy development.

CISA, alongside 16 government agencies spanning four continents, has published updated minimum requirements for SBOMs (Software Bills of Materials — standardised ingredient lists that detail every component inside a piece of software), according to Dark Reading.

The updated guidance supersedes 2021 rules and introduces 10 new data fields, including digital signatures to verify an SBOM's authenticity and expanded dependency tracking that now requires listing not just direct components but also those components' own dependencies.

For everyday users, this matters because better software transparency means organisations can identify vulnerable components faster when the next major flaw surfaces.

CISA (the US Cybersecurity and Infrastructure Security Agency) published an urgent alert on July 30 calling on water and wastewater operators to immediately remove internet-exposed PLCs (programmable logic controllers — the hardware that automates physical processes like pumps and valves) from public access, according to Security Week.

The alert follows a coordinated attack on 30+ Minnesota water systems on July 26–27. Attackers locked operators out by changing passwords and disconnecting equipment remotely. CISA links the attack pattern to Iranian-linked threat groups. Water customers in affected regions were told drinking water remained safe.

What to do: If you work in critical infrastructure, read advisory AA26-097A.

The US Federal Communications Commission (FCC) added foreign-produced mobile robots and networked power inverters to its Covered List on July 28, according to The Hacker News. New models cannot be imported, marketed, or sold in the US without conditional approval from federal agencies. Devices already owned by consumers are unaffected. The FCC cited documented vulnerabilities including researchers gaining root-level access to household robots and remote control of autonomous quadruped units. For businesses that rely on these devices in warehouses or energy systems, new procurement decisions just got more complicated.

The UK's National Cyber Security Centre has released a new guide — What To Do When Cyber-Attacks Disrupt Your Organisation — covering the first hours of an attack through to full recovery, according to Infosecurity Magazine. The document covers immediate triage, getting back to minimum viable operations, and long-term rebuilding. The NCSC's key message is unambiguous: a written plan is not enough. Organisations need to physically rehearse shutdown, failover, and rebuild procedures before an incident — not read about them during one.

Senator Ron Wyden has written to CISA, the Office of Management and Budget, and NIST demanding the removal of all legacy public-facing VPNs from federal networks, citing repeated exploitation by Russian and Chinese state-backed attackers through products from Cisco, Fortinet, Ivanti, and Check Point, according to The Record.

The proposal calls for a two-year deadline to replace ageing remote-access systems with zero-trust architecture — a security model that continuously verifies every user rather than trusting anyone already inside the network. For small businesses, the signal is clear: if legacy VPNs are too risky for federal agencies, they are worth reconsidering for your organisation too.