Compliance Pulse

Microsoft has quietly extended its free Windows 10 Extended Security Updates (ESU) programme for personal devices through to 12 October 2027, with no formal press announcement — the change appeared as an editor's note in existing documentation, according to Bleeping Computer.

If you are still running Windows 10 at home and cannot yet upgrade, you can stay enrolled in the free ESU programme by backing up your Windows settings to a Microsoft account. One licence covers up to ten personal devices. This does not apply to workplace machines managed through corporate IT systems.

CISA has added four vulnerabilities to its Known Exploited Vulnerabilities catalogue and ordered US federal civilian agencies to patch within three days under the BOD 26-04 directive, per Bleeping Computer. Three flaws affect Ubiquiti UniFi OS devices: CVE-2026-34908 (access control bypass), CVE-2026-34909 (path traversal), and CVE-2026-34910 (improper input validation allowing command injection). The fourth is the Lantronix flaw covered above.

While the mandate targets federal agencies, any organisation running these devices should treat the same deadline as their own.

President Trump signed an executive order on June 22 requiring federal agencies to migrate high-value systems to post-quantum cryptography (encryption designed to resist attacks from future quantum computers) by December 31, 2030, per The Hacker News. The urgency is real: adversaries are already collecting encrypted data today to decrypt it once quantum computing matures — a strategy known as "harvest now, decrypt later." Federal contractors should expect compliance requirements to follow. For everyone else, this signals that encryption standards are about to change at scale.

President Trump signed Executive Order 14409 on Monday, directing federal agencies and their contractors to migrate to post-quantum cryptography (PQC) — encryption designed to resist attacks from future quantum computers — by the end of 2030 for key establishment and 2031 for digital signatures, according to Security Week. The order targets the "harvest now, decrypt later" threat, where attackers collect encrypted data today to decrypt it once quantum computing matures. If your organisation contracts with the US federal government, compliance by 2030 is now a legal requirement, not a roadmap item.

From 30 September 2026, certified Android devices in Brazil, Indonesia, Singapore, and Thailand will block app installs from developers who have not registered their identity with Google. This applies to Google Play and third-party stores alike. Google says it is targeting app scam operations that exploit sideloading (installing apps outside official stores). Critics, including the open-source repository F-Droid, argue the ID requirement effectively shuts out pseudonymous developers. For everyday users in those four countries: apps from verified developers install as normal. Anything unverified will be blocked or require a deliberate, high-friction override.

No major compliance updates today.

At a G7 summit in France, French President Emmanuel Macron urged wealthy democracies to cooperate on regulating advanced AI systems, warning against any single nation keeping frontier AI models off-limits to allies. OpenAI CEO Sam Altman echoed the call, saying AI safety decisions should not rest with tech companies alone and that an international forum is needed to establish testing standards and risk analysis, according to SecurityWeek. The backdrop: the Trump administration's directive restricting foreign access to Anthropic's latest models forced them offline in Europe.

For everyday users, these discussions matter — who regulates AI determines what safeguards exist on the tools you use daily. No binding agreements were reached.

No major compliance updates today.

CISA has added a maximum-severity Joomla plugin flaw, CVE-2026-48907, to its Known Exploited Vulnerabilities catalog and ordered U.S. federal agencies to patch it by Friday, June 19, 2026, according to BleepingComputer. The flaw lets attackers with no login at all upload and run malicious code on Joomla sites using the JCE editor plugin. If you run a Joomla website with this plugin, treat this the same way the federal government is: patch now, do not wait for a deadline that applies to someone else.

The US Department of Justice has seized CFAKE and SOCFAKE — two websites hosting non-consensual AI-generated explicit images of real women, including politicians, athletes, and public figures from multiple countries. The DOJ says this is the first publicly announced domain seizure under the TAKE IT DOWN Act, a new US law criminalising the creation and distribution of non-consensual intimate deepfakes. The law gives platforms 48 hours to remove flagged content and creates a federal pathway for law enforcement to act.