Compliance Pulse

Senator Ron Wyden has written to CISA, the Office of Management and Budget, and NIST demanding the removal of all legacy public-facing VPNs from federal networks, citing repeated exploitation by Russian and Chinese state-backed attackers through products from Cisco, Fortinet, Ivanti, and Check Point, according to The Record.

The proposal calls for a two-year deadline to replace ageing remote-access systems with zero-trust architecture — a security model that continuously verifies every user rather than trusting anyone already inside the network. For small businesses, the signal is clear: if legacy VPNs are too risky for federal agencies, they are worth reconsidering for your organisation too.

No major compliance updates today.

This week's threat landscape offers no respite: active exploitation of an unpatched Java library flaw and a sophisticated browser-based malware delivery campaign both carry significant implications for organisations subject to data protection obligations. If your team operates affected Java services, document your mitigations now — regulators will ask.

New UK Prime Minister Andy Burnham reshuffled government this week but reappointed cybersecurity minister Liz Lloyd, according to The Record. Lloyd will continue steering the Cyber Security and Resilience Bill through the House of Lords, where line-by-line scrutiny begins in September. The bill extends cyber regulations to data centres and managed service providers, and sets incident reporting deadlines for energy, water, and healthcare operators. Continuity in the brief matters: the bill must pass this year, and a new minister six weeks out would have risked delay.

FedRAMP 20X, the updated US framework governing cloud security for federal agencies, moves away from point-in-time annual audits and replaces them with continuously validated Key Security Indicators — machine-readable evidence that controls are actually working, not just documented. Under the old model, an organisation could describe a control and pass. Under 20X, it must prove the control holds up, repeatedly, on a short revalidation cycle. For cloud vendors serving US government clients, this is a fundamental shift in how compliance is structured. Full details at Bleeping Computer.

CISA has added CVE-2026-0770, a critical remote code execution flaw in Langflow (an open-source tool for building AI agent workflows), to its Known Exploited Vulnerabilities catalogue, according to Bleeping Computer. Federal agencies must patch by July 24, 2026. The flaw allows unauthenticated attackers to run commands as root. Over 220 exploitation attempts from 64 unique IP addresses were recorded before the CISA directive was issued. Private organisations running Langflow should treat this as equally urgent.

Spain's data protection authority (AEPD) has fined 23andMe, the DNA testing company, €2.4 million for cybersecurity failures that contributed to the 2023 breach of 6.9 million people's genetic records, according to The Record. The regulator found that 23andMe lacked mandatory multi-factor authentication and placed no limits on how much data a single account or IP address could download — basic protections that would have slowed the credential stuffing attack (where attackers try username and password combinations stolen from other breaches). The firm also notified Spanish authorities 12 days after learning of the breach, violating GDPR's notification requirements.

For everyday users: genetic data is among the most sensitive data that exists, and the fine signals European regulators are watching how companies protect it.

The Netherlands' civilian and military intelligence services (AIVD and MIVD) published an advisory on July 10 warning that Russian intelligence is systematically hijacking internet-connected security cameras across EU and NATO countries to monitor military logistics and weapons shipments, according to The Hacker News. In Ukraine, the access has reportedly been used to target military personnel directly. The entry method in most cases: default passwords and outdated firmware.

What you should do: Change default passwords on any internet-connected cameras at your home or business, and check the manufacturer's website for firmware updates.

Two members of the Scattered Spider cybercriminal group were sentenced to five and a half years each for the 2024 Transport for London hack, in what the UK National Crime Agency called the country's largest-ever cybercrime prosecution, according to Infosecurity Magazine. The attack cost TfL £29 million in damages and £10 million in lost income, affecting between seven and ten million people.

Senior officers are now pushing for Cybercrime Risk Orders, a proposed legal tool included in the May 2026 King's Speech, expected to be introduced in late 2027 or early 2028. The goal is to restrict high-risk offenders — including those under 18 — while investigations are still ongoing.

More than 30 age verification laws are now enforceable worldwide, according to Bleeping Computer. The UK's Online Safety Act will restrict under-16 social media access from spring 2027. Australia has already introduced under-16 rules and is considering doubling maximum fines to $99 million following early non-compliance. Half of U.S. states now mandate some form of age verification. For everyday users, this means more platforms will request identity or biometric checks. Ask before you hand anything over: is this processed on my device or sent to a server?

A coalition of 42 US state attorneys general has reached an $18 million settlement with 23andMe over its 2023 data breach, which exposed the ancestry and personal data of over six million people, according to Infosecurity Magazine. The breach stemmed from credential stuffing (attackers using passwords stolen elsewhere to access accounts). New data security requirements have been imposed on TTAM Research, the company that acquired 23andMe's customer data through bankruptcy. The rules include formal risk analysis, a new data security advisory board, and the right for customers to delete their data.

What you should do: If you were a 23andMe customer, you can request deletion of your data through TTAM Research directly.