Practical intelligence for security, privacy and regulatory professionals in regulated health technology.
Microsoft’s fix list is now 45 percent longer than last month’s record. Four Critical SAP fixes, including one scoring 10.0, land in the same week.
eSTAR 6.2 was retired on August 3, 2026. New submissions belong on 7.1, files under review stay where they are, and one unchanged cybersecurity question still triggers technical screening holds.
FDA has proposed electronic-template standards for original PMAs and selected supplements, with mandatory use deferred until after final guidance and a transition period. Device regulatory and product-security teams should assess submission workflows without treating the draft…
FDA points device manufacturers at the same KEV Catalog and a high CVSS score is not a reason to drop everything
Three of the critical remote code execution fixes sit in the NFC module and one in Bluetooth, and no companion app can compensate for a radio stack compromised beneath it
Two Windows flaws were being exploited before the fix existed. SAP's most serious item this month runs before the system has checked who you are, and it sits under nearly every SAP product a manufacturer owns.
The final N90 document from the Software as a Medical Device Working Group names five essential principles and three mandatory elements. One line about the impact assessment pulls security risk into every planned software change
CDRH has put prompt injection, agentic tool use, and foundation model drift into a proposed premarket evidence framework. Comments close 19 October 2026, and product security teams should not leave this to regulatory affairs alone.
No clinical or medical device product is named anywhere in the release, but Fusion Middleware, Hyperion, and E-Business Suite all run underneath systems that hold patient and manufacturing quality data
Five months after the malicious packages were pulled from PyPI, CloudSEK has published the list. The credentials were taken from build systems, the machines that assemble and publish software
Microsoft’s fix list is now 45 percent longer than last month’s record. Four Critical SAP fixes, including one scoring 10.0, land in the same week.
eSTAR 6.2 was retired on August 3, 2026. New submissions belong on 7.1, files under review stay where they are, and one unchanged cybersecurity question still triggers technical screening holds.
FDA has proposed electronic-template standards for original PMAs and selected supplements, with mandatory use deferred until after final guidance and a transition period. Device regulatory and product-security teams should assess submission workflows without treating the draft…
FDA points device manufacturers at the same KEV Catalog and a high CVSS score is not a reason to drop everything
Three of the critical remote code execution fixes sit in the NFC module and one in Bluetooth, and no companion app can compensate for a radio stack compromised beneath it
Two Windows flaws were being exploited before the fix existed. SAP's most serious item this month runs before the system has checked who you are, and it sits under nearly every SAP product a manufacturer owns.
The final N90 document from the Software as a Medical Device Working Group names five essential principles and three mandatory elements. One line about the impact assessment pulls security risk into every planned software change
CDRH has put prompt injection, agentic tool use, and foundation model drift into a proposed premarket evidence framework. Comments close 19 October 2026, and product security teams should not leave this to regulatory affairs alone.
No clinical or medical device product is named anywhere in the release, but Fusion Middleware, Hyperion, and E-Business Suite all run underneath systems that hold patient and manufacturing quality data
Five months after the malicious packages were pulled from PyPI, CloudSEK has published the list. The credentials were taken from build systems, the machines that assemble and publish software
A plain-language breakdown of the February 2026 FDA final guidance, Section 524B of the FD&C Act obligations, the Secure Product Development Framework, and how cybersecurity documentation scales with risk
What the law requires, what FDA looks for in a submission, and how to keep the record accurate once the device is on the market
A plain-language breakdown of the February 2026 FDA final guidance, Section 524B of the FD&C Act obligations, the Secure Product Development Framework, and how cybersecurity documentation scales with risk
Article 15(5) of the EU AI Act requires high risk systems to resist attacks on the model itself, and FDA's draft guidance asks sponsors to submit whatever they added to the threat model for AI, but the threats, the assets and the right framework all change depending on whether your device runs a model that is fixed at release, a model that keeps changing, or a language model feature.
Who the real stakeholders are, what to read in month one, and how to earn credibility with engineering fast
Cyber insights for MedTech, AI-enabled systems, and regulated digital products.
Free. Unsubscribe anytime. Your email always stays private.
Legal Disclaimer:The content on Regulated Cyber is provided for educational and knowledge-sharing purposes only. It does not constitute cybersecurity, legal, regulatory, compliance, or professional advisory services. Any views expressed are those of the individual authors and do not represent the position of any current or former employer. Readers should seek appropriate professional advice before making decisions based on the content shared here.
