Compliance Pulse

CISA added two critical Fortinet FortiSandbox vulnerabilities — CVE-2026-39808 and CVE-2026-25089, both rated CVSS 9.1 — to its Known Exploited Vulnerabilities catalogue on July 16, according to Infosecurity Magazine. US federal agencies must patch by July 19 under Binding Operational Directive (BOD) 26-04. For cloud deployments without available patches, CISA says to stop using the product entirely. Private sector organisations are not legally bound by BOD deadlines, but with active exploitation confirmed, the same urgency applies.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft SharePoint (Microsoft's web-based collaboration and document management platform) privilege escalation flaw, CVE-2026-56164, to its Known Exploited Vulnerabilities list, according to Security Week. Federal agencies have three days to patch. The July 2026 Patch Tuesday update resolves this flaw along with two additional critical SharePoint bugs. If your organisation runs SharePoint on-premises, apply Microsoft's latest patches now and check whether your SharePoint servers are directly exposed to the internet.

CISA has added three actively exploited Microsoft SharePoint Server vulnerabilities to its Known Exploited Vulnerabilities catalogue and ordered US federal agencies to patch by July 17, 2026, per Bleeping Computer. Attackers are using these flaws to bypass authentication, run remote code, and deploy malware on exposed on-premises SharePoint servers. Nearly 10,000 internet-facing SharePoint servers are currently visible online, with over 800 confirmed unpatched. If your organisation runs SharePoint on its own servers rather than in the cloud, apply Microsoft's latest patches now and avoid exposing SharePoint directly to the internet.

The EU and UK jointly sanctioned dozens of Russian individuals and entities this week, citing coordinated cyberattacks against European critical infrastructure, government networks, and public services, according to Help Net Security. The EU called it its largest-ever cyber sanctions package. The UK separately sanctioned individuals linked to Lumma Stealer — credential-theft malware with at least 2,100 confirmed UK victims in the last six months. For everyday users, the practical note is this: credential theft is an active, state-linked operation, not just opportunistic crime.

Australia's cybersecurity authority has issued an alert warning of a global campaign actively exploiting unpatched content management system platforms. While full details were unavailable at time of writing, the advisory signals that exploitation is confirmed and ongoing rather than theoretical, according to Bleeping Computer. For small businesses and organisations running public-facing websites, this is a prompt to check your CMS version and update today. Regulatory exposure from a compromised website can compound the technical damage significantly.

The European Parliament has voted to extend a law permitting major technology companies to voluntarily scan users' messages for child sexual abuse material (CSAM), according to The Record. The measure, which does not apply to end-to-end encrypted platforms like Signal, runs until 2028. Critics raised concerns about the procedural mechanism used — an absolute majority vote, held the day before summer recess, where absent members effectively count as votes in favour. A broader and more contested permanent framework, informally called Chat Control 2.0, remains under negotiation and could eventually extend scanning to encrypted communications.

The European Commission has filed legal proceedings against Ireland, Spain, France, and the Netherlands for failing to implement the NIS2 Directive — the EU's baseline cybersecurity law for hospitals, energy networks, and public services — more than 20 months past the October 2024 deadline, according to The Record.

Daily financial penalties are being sought until each country fully transposes the law. For businesses operating in these countries: NIS2 compliance obligations apply to you regardless of where government proceedings stand. Do not wait for the fine to land before checking your incident reporting obligations.

Industry body CREST launched its AI Charter on July 9, with 73 founding signatories committing to nine principles for responsible AI use in cybersecurity, according to Infosecurity Magazine. The principles cover transparency with clients, human oversight of AI decisions, and strict data handling rules. For everyday users, this means security firms that signed up must tell you when AI is involved in their services and how it affects your data. CREST reports that 69% of cybersecurity providers already use AI daily — this charter is the industry trying to get ahead of regulation before regulation gets ahead of them.

The US Supreme Court has allowed Texas's App Store Accountability Act (TASAA) to take effect while lower courts continue debating its constitutionality, according to The Record. The law requires app stores and developers to verify that users under 18 have parental consent before downloading apps. For app developers and platform operators, this means age-gating is no longer a future concern — it is a current legal requirement in Texas. The Fifth Circuit hears full arguments in August, but enforcement is live now.

The UK government has launched a Cyber Resilience Pledge, with over 60 organisations including Marks & Spencer, Nationwide, and Microsoft UK committing to board-level cybersecurity accountability, per Infosecurity Magazine. Signatories must register for the NCSC's free Early Warning alert service and push Cyber Essentials certification (a government-backed security baseline standard) down their supply chains.

For smaller suppliers, this creates real pressure to meet a minimum security standard to retain contracts with larger partners. Businesses with under £20m turnover that achieve Cyber Essentials certification are eligible for free cyber-liability insurance.