Regulated Cyber | MedTech security, privacy & regulatory intelligence

MedTech Security, Privacy & Regulatory Intelligence

Alerts

ENISA releases technical guidance on Software Bills of Materials for SMEs and software stewards

Oct 22, 2026Informational

ENISA’s new advisory gives SMEs and software stewards a practical route to generating, validating and maintaining SBOMs. For regulated health-tech teams, its value is faster vulnerability assessment tied to the software actually deployed.

PHP urges immediate updates for two critical remote code execution flaws

Oct 21, 2026Critical

The PHP project says all installations serving web requests are at risk and only updating provides a complete fix. MedTech and healthcare teams should prioritise exposed runtimes and coordinate deployment with a risk-based approach.

Oracle’s October update delivers 1,295 security patches, including healthcare fixes

Oct 20, 2026Critical

Healthcare applications, databases and middleware are in scope. MedTech teams should confirm affected versions and prioritise fixes by exposure and patient-safety impact.

German Bundestag approves CRA implementation law ahead of December 2027 requirements

Oct 16, 2026Informational

Germany’s Bundestag has approved legislation assigning national CRA enforcement responsibilities to the BSI. Health-tech teams should prepare in-scope products for the December 2027 requirements without assuming every medical device with digital components is covered.

October 2026 Patch Tuesday: Microsoft Fixes a Record 1,413 Flaws as AI-Assisted Research Adds to Discovery

Oct 13, 2026Critical

Microsoft’s fix list is now 45 percent longer than last month’s record. Four Critical SAP fixes, including one scoring 10.0, land in the same week.

FDA's updated eSTAR Template: Which Version to Use, What Changed, and What to Do If You Already Have an AI Letter

Oct 11, 2026Informational

eSTAR 6.2 was retired on August 3, 2026. New submissions belong on 7.1, files under review stay where they are, and one unchanged cybersecurity question still triggers technical screening holds.

FDA issues draft guidance on its electronic submission template for medical device PMA applications

Oct 2, 2026Informational

FDA has proposed electronic-template standards for original PMAs and selected supplements, with mandatory use deferred until after final guidance and a transition period. Device regulatory and product-security teams should assess submission workflows without treating the draft…

CISA Retires the Weekly Vulnerability Bulletin on 28 September. Your Postmarket Triage Should Already Be Risk Based

Sep 19, 2026Informational

FDA points device manufacturers at the same KEV Catalog and a high CVSS score is not a reason to drop everything

Android Security Bulletin September 2026 Patches 180 Flaws, Three Critical Remote Code Execution Bugs in NFC and One in Bluetooth

Sep 11, 2026Critical

Three of the critical remote code execution fixes sit in the NFC module and one in Bluetooth, and no companion app can compensate for a radio stack compromised beneath it

Patch Tuesday, September 2026: Microsoft's Largest Release on Record, and a Flaw at the Bottom of the SAP Stack

Sep 9, 2026Critical

Two Windows flaws were being exploited before the fix existed. SAP's most serious item this month runs before the system has checked who you are, and it sits under nearly every SAP product a manufacturer owns.

View all alerts

Regulated Cyber Brief

Cyber insights for MedTech, AI-enabled systems, and regulated digital products.

Free. Unsubscribe anytime. Your email always stays private.

Legal Disclaimer:The content on Regulated Cyber is provided for educational and knowledge-sharing purposes only. It does not constitute cybersecurity, legal, regulatory, compliance, or professional advisory services. Any views expressed are those of the individual authors and do not represent the position of any current or former employer. Readers should seek appropriate professional advice before making decisions based on the content shared here.

Regulated Cyber — MedTech security, privacy & regulatory intelligence