CREST publishes framework to boost financial cyber resilience
CREST released a whole‑ecosystem framework aimed at strengthening cyber‑resilience practices across banks, insurers and market infrastructure providers.
1 source · trade pressCybersecurity regulation
Cybersecurity laws and government cyber rules beyond NIST, ISO 27001 and DORA: NIS2, the Cyber Resilience Act, SEC incident disclosure, CMMC, CIRCIA and national cyber strategies.
11 stories
UK government considers liability for software cyber breaches
The 2026 UK budget signals a review of who should be held responsible when software products cause cyber incidents, moving beyond voluntary security codes.
1 source · trade pressHis Majesty’s Inspectorate finds multiple breaches of UK police data by third-party suppliers
The inspectorate reported that British police records have been accessed illegally on several occasions this decade through external IT service providers.
1 source · trade press
CISA urges federal agencies to patch PHP vulnerabilities within days
CISA added the PHP flaws to its Known Exploited Vulnerabilities list and gave agencies a short window to apply patches.
1 source · trade press
European Commission examines Booking.com safeguards against phishing scams
The European Commission announced on 22 October 2026 it will examine Booking.com’s safeguards against phishing scams targeting travelers.
1 source · trade press
ENISA says EU cyber law does not require patches for end-of-life fridge controllers
Hackers exploited end‑of‑life fridge controllers at Intermarché, Carrefour and other French supermarkets in October 2026, causing tens of millions of euros in spoilage; EU law now forces reporting of such attacks but does not require manufacturers to patch the devices.
1 source · trade press
NCSC issues post-quantum TLS configuration guidance
The UK National Cyber Security Centre released recommendations for adding post‑quantum cryptography to TLS configurations, urging organisations to start migration now.
1 source · official
CISA submits final CIRCIA rule to OMB for review
CISA sent the final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 to OIRA on 1 October 2026, beginning the inter‑agency review before publication.
1 source · trade press
CISA issues guide on cyber decoys for critical infrastructure
CISA issued a new guide on 16 September 2026 showing critical infrastructure operators how to deploy cyber decoys to detect and disrupt adversaries using legitimate credentials and living‑off‑the‑land techniques.
1 source · official
NYDFS fines Order Express $250,000 over deficient cyber risk assessment
NYDFS fined Order Express $250,000 on 5 August 2026 for a deficient risk assessment, inadequate cyber program design and weak third‑party update policies after a ransomware incident.
1 source · trade press
European Systemic Risk Board warns frontier AI models could strain financial cyber resilience
The ESRB cautions that advanced AI models may increase cyber‑risk for banks and market infrastructures, urging heightened vigilance.
1 source · official