Live 262 sources monitored São Paulo Washington London Frankfurt Dubai Hong Kong Sydney 7 regions
✦ RegulusGlobal regulatory broadcast network

Regulatory news and audio briefings from financial regulators worldwide — financial crime, AML, sanctions, fraud, digital assets and compliance

Regulatory heat map

Where it's moving right now · select a region to filter
Showing 24 hours 7 days 28 days 90 days 180 days Last year Everything
Global
752 all regions
North America
403 US Close
Latin America
2 US Close
United Kingdom
106 Europe Close
Europe
87 Europe Close
Middle East & Africa
9 Asia Close
Asia-Pacific
32 Asia Close
Category
All Financial Crime 167 Governance & Accountability 153 Markets & Infrastructure 130 Prudential & Capital 78 AI, Technology & Data 78 Conduct & Consumer 74 Digital Assets 57 Sustainability 15
Within
AI governance 39 Cyber security 26 Operational resilience 9 Third-party & outsourcing 2 Data protection 2
Country
United States 422 United Kingdom 107 European Union 72 Global 57 Hong Kong 29 Malaysia 11 Luxembourg 8 United Arab Emirates 7 Germany 7 Singapore 4 France 4 Austria 4 Netherlands 3 Norway 2 Japan 2 Ghana 2 Switzerland 1 Sweden 1 Russia 1 Philippines 1 New Zealand 1 India 1 Finland 1 Euro area 1 Colombia 1 Bolivia 1 ASEAN 1
Regulator
DOJ Criminal Division 99 Federal Register — SEC 56 American Bankers Association — newsroom 47 CISA Advisories 37 BIS Press Releases 36 FCA 29 European Central Bank 26 HM Revenue & Customs 20 SEC Press Releases 16 Bank of England 15 Washington State DFI 14 Regulus Weekend Edition 14 US Federal Trade Commission — press releases 14 Financial Stability Board 14 FCA Publications 12 SFC Hong Kong 11 OCC Bulletins 11 FINRA 10 Federal Register — Treasury 10 CFTC — Commodity Futures Trading Commission 10 Federal Register — State Department 9 Securities and Exchange Commission 8 ISDA 8 Federal Reserve 8 ECB Banking Supervision 8 CSSF Luxembourg 8 SEC Speeches and Statements 7 HKMA — Hong Kong Monetary Authority 7 European Commission Digital Strategy 7 Deutsche Bundesbank — speeches 7 ADGM Abu Dhabi — announcements 7 Federal Register — NCUA 6 Federal Register — CFTC 6 ESMA 6 Bank of England Publications 6 Bank Negara Malaysia 6 Single Resolution Board 5 International Criminal Court 5 UK Competition and Markets Authority 5 NIST 4 IC3 — FBI Internet Crime Complaint Center 4 FMA Austria 4 Federal Register — Federal Reserve 4 Deutsche Bundesbank 4 Brdr.Hkma 4 Bank Policy Institute 4 Amlcft.Bnm 4 AFM Netherlands 4 FCDO — sanctions announcements 3 HM Treasury 3 Financial Services and the Treasury Bureau 3 Federal Reserve Speeches 3 UK DSIT 3 CFTC Enforcement 3 ASEANAPOL 3 AMF France 3 Alliance for Financial Inclusion 3 US Treasury — press releases 2 UN — press releases 2 Department for Business and Trade — export control 2 NIST — cybersecurity and identity updates 2 National Crime Agency UK 2 Hong Kong Exchanges and Clearing Limited 2 HM Treasury Consultations 2 Federal Register — FDIC 2 Federal Register — CFPB 2 Press Releases | FDIC.gov 2 European Data Protection Board 2 CFPB 2 Bank of Ghana 2 ACPR 2 UN News — global perspective 1 UK Finance — news 1 Texas State Securities Board 1 Singapore Police Force 1 Sveriges Riksbank 1 Osaka Exchange 1 OFSI 1 NCSC UK 1 MAS — Monetary Authority of Singapore 1 Euronext 1 International Association for Trusted Blockchain Applications 1 European Commission — Migration and Home Affairs 1 Govinfo 1 GFMA — Global Financial Markets Association 1 Finanstilsynet Norway 1 Federal Register — OCC 1 Federal Register — FinCEN 1 Federal Register — Industry and Security Bureau 1 Eurex 1 European Payments Council 1 EDB Singapore — Economic Development Board 1 CSSF / Banque centrale du Luxembourg 1 Cyber Security Agency of Singapore 1 Croatian Financial Services Supervisory Agency (HANFA) 1 Companies House 1 Commerce Commission New Zealand 1 Bank for International Settlements 1 Banco de España 1 Bank of Russia 1 Banco de la República 1 Banco Central de Bolivia (BCB) 1
Showing
category: ai_tech × subcategory: op_resilience × since: all × Clear all

Filtered

Cards Wire 9 segments
0:15
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 22 claims 26 Oct 2026

CISA flags hard-coded credentials in end-of-life Johnson Controls EasyIO FG

CISA republished a Johnson Controls advisory covering two vulnerabilities in the EasyIO FG building-automation controller that could hand an attacker full control of the device. Because the product line is end-of-life, no patch is coming. For anyone running these controllers in operational-technology estates, the only remedy is network isolation now and replacement later.

  • Two vulnerabilities, CVE-2026-27872 and CVE-2026-27873, affect EasyIO FG firmware version 2.0b52 and earlier, each scored CVSS v3.1 7.7 and CVSS v4 7.2.
  • Johnson Controls will issue no firmware patch because the EasyIO FG Series is end-of-life and end-of-support and the source code is no longer available.
  • Users are advised to migrate to a supported current-generation product such as the EasyIO Neo R1 Series.
  • CISA lists extensive interim mitigations including network isolation, VLAN segmentation, no internet exposure and disabling insecure services such as Telnet.
  • CISA reports no known public exploitation targeting these vulnerabilities, which have high attack complexity and are not exploitable remotely.
Source document
play
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 23 claims 26 Oct 2026

CISA warns of critical buffer overflow in Savannah lwIP SMTP client

CISA has published an advisory for a critical vulnerability in the Savannah lwIP SMTP client used in industrial control systems across the energy and water sectors. The item covers the flaw's severity, affected version, and the patch now available for remediation.

  • CVE-2026-15340 affects Savannah lwIP SMTP client version 2.2.1 and carries a CVSS v3.1 base score of 9.8, rated critical.
  • The flaw is a classic buffer overflow (CWE-120) caused by the SMTP client not checking the size of inputs.
  • The product is deployed worldwide across the energy and water and wastewater systems sectors, per CISA's background notes.
  • A fix is available as patch_125_smtp_txbuf.diff and as git commit 614420f82c8729d070e01464c0dddb3c9525c772.
  • Reporter xchglabs disclosed the vulnerability directly to Savannah and published only after the patch was released.
Source document
play
CISA CISA Advisories Source document ↗
Global CISA Advisories AI, Technology & Data ✓ 18 claims 23 Oct 2026

Siemens RUGGEDCOM CROSSBOW controller has critical SQLite flaw, CVSS 9.8

CISA has republished a Siemens ProductCERT advisory detailing five vulnerabilities in the SQLite component embedded in RUGGEDCOM CROSSBOW Station Access Controller software used across critical infrastructure sectors. One flaw carries a CVSS v3 score of 9.8. Security and OT teams running affected versions should assess exposure and schedule the vendor update.

  • Siemens has released RUGGEDCOM CROSSBOW SAC version V6.0 to remediate all five listed vulnerabilities, and recommends updating from any version below V6.0.
  • CVE-2025-71316 is rated CVSS v3 9.8, critical, and involves insecure handling of Unicode-to-ANSI conversion in SQLite's sqldiff.exe that could allow an attacker to load an arbitrary DLL.
  • CVE-2026-11822 and CVE-2026-11824 affect SQLite versions before 3.53.2 and involve heap-based buffer overflows in the FTS5 full-text search extension triggered via crafted database files.
  • CVE-2025-6965 affects SQLite versions before 3.50.2 and can cause memory corruption when aggregate terms exceed available columns.
  • Siemens ProductCERT reported the vulnerabilities to CISA, and the advisory is a verbatim republication of Siemens advisory SSA-765416.
Source document
play
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 17 claims 23 Oct 2026

CISA republishes Siemens advisory on PSS(R)SINCAL WibuKey flaw

CISA has republished Siemens ProductCERT advisory SSA-148322 covering a high-severity vulnerability in PSS(R)SINCAL that stems from its use of the third-party WibuKey product. The flaw can cause a denial-of-service crash. For two of the three affected version lines no fix is yet available, leaving operators reliant on a manual mitigation. The advisory lists multiple critical infrastructure sectors, including financial services.

  • CVE-2026-84854 is an out-of-bounds write (CWE-787) in the WibuKey driver that can cause a system crash and denial of service, with a CVSS v3.1 base score of 7 (HIGH).
  • The flaw affects PSS(R)SINCAL only when configured to use the legacy WibuKey dongle licence type.
  • PSS(R)SINCAL V21.5 (all) and V22.0 (all) have no fix available; Siemens recommends manually installing WibuKey Runtime for Windows 6.72 or later as mitigation.
  • PSS(R)SINCAL V22.5 before V22.5 Update 5 is affected and is remediated by updating to Update 5 or later.
  • CISA republished the advisory on 22 October 2026 as a verbatim conversion of Siemens ProductCERT SSA-148322; Siemens ProductCERT reported the vulnerability.
Source document
0:15
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 19 claims 22 Oct 2026

CISA flags denial-of-service flaws in Siemens building automation controllers

CISA's advisory covers multiple remotely exploitable vulnerabilities in widely deployed Siemens building automation controllers used across critical manufacturing, energy, healthcare, financial services and government facilities worldwide. Compliance and OT security teams running APOGEE, TALON or Desigo PXC/PXM equipment should check which product lines have patches available versus those left on mitigation-only guidance.

  • CISA released advisory ICSA-26-295-08 on October 22, 2026 covering Siemens APOGEE, TALON and Desigo PXC/PXM products.
  • The highest-rated vulnerability, affecting APOGEE MBC (PPC) BACnet, carries a CVSS v3 base score of 8.2 across three CWE categories: out-of-bounds read, integer underflow and stack-based buffer overflow.
  • Siemens has issued vendor fixes for APOGEE PXC Compact/Modular and TALON TC Compact/Modular, updating to V3.5.7 (BACnet) or V2.8.21 (P2 Ethernet).
  • Siemens states no fix is planned for APOGEE MBC/MEC (PPC) variants or any of the thirteen listed Desigo PXC/PXM controller models.
  • Recommended mitigations for unpatched products include network segmentation behind gateways/firewalls and disabling the FTP/Web service, which Siemens says is off by default.
Source document
0:15
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 15 claims 22 Oct 2026

CISA and Canadian Cyber Centre issue joint guidance on AI token consumption

CISA, Canada's Cyber Centre and partners released joint guidance on managing token consumption in third-party super intelligence services. It treats unmanaged token usage not as a billing nuisance but as an availability and resilience problem for critical infrastructure, and sets out practical steps to prioritise, monitor and optimise consumption while keeping human oversight of AI-enabled defence workflows.

  • CISA, the Canadian Centre for Cyber Security and partners jointly published the guidance on 22 October 2026.
  • The guidance names token exhaustion and denial-of-tokens or denial-of-wallet attacks as risks of unmanaged consumption.
  • Recommended steps include prioritising token allocation, caching and reusable context, optimising data before submission, and monitoring consumption over time.
  • Critical infrastructure owners are told to identify mission-critical functions dependent on SI and plan for reduced availability during outages, incidents or high demand.
  • Cyber defenders are advised to run SI-enabled defence workflows while maintaining human oversight, governance and cybersecurity fundamentals.
Source document
0:15
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 26 claims 20 Oct 2026

CISA flags six flaws in HMS Networks PEAK-System PCAN Windows drivers

CISA has published an advisory covering six vulnerabilities in HMS Networks PEAK-System PCAN Windows CAN device drivers, used across transportation, healthcare, energy and critical manufacturing sectors worldwide. The flaws allow a local attacker to crash the Windows kernel. A patched version is available, and the item sets out what affected and what operators should do.

  • CISA's advisory ICSA-26-293-01, dated October 20, 2026, covers six CVEs affecting HMS Networks PEAK-System Device Driver Setup version 5.1.2.1151 and earlier and PCAN Windows CAN device drivers version 5.1.2 and earlier.
  • The highest-rated flaw, CVE-2026-103672, carries a CVSS v3.1 base score of 7.1 (high) for improper validation of an array index.
  • HMS Networks AB has addressed all six vulnerabilities in version 5.1.4 and recommends users upgrade via its software download page.
  • CISA states the vulnerabilities are not exploitable remotely and that no known public exploitation targeting them has been reported.
  • Affected critical infrastructure sectors deployed worldwide include transportation systems, healthcare and public health, energy, and critical manufacturing.
Source document
0:15
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 21 claims 18 Oct 2026

CISA flags six Eclipse Milo flaws exposing OPC UA servers to credential theft and denial of service

CISA's October 15 industrial-control advisory covers multiple vulnerabilities in Eclipse Foundation's Eclipse Milo OPC UA server software. The flaws range from authorization bypasses to a password-recovery padding oracle and several denial-of-service conditions. For operators in chemical, critical manufacturing, energy and water sectors, the practical sting is that affected 0.6.x deployments cannot be patched in place and must be migrated to 1.1.5 or later.

  • CISA advisory ICSA-26-288-01, released October 15, 2026, covers vulnerabilities in Eclipse Milo versions 0.6.0 through 1.1.4.
  • CVE-2026-60007, a padding-oracle flaw enabling password recovery, carries a CVSS v4 base score of 9.1, rated critical.
  • The Eclipse Foundation recommends upgrading to Eclipse Milo 1.1.5; there are no 0.6.x releases with the fixes, requiring migration.
  • Successful exploitation could delete protected data, recover credentials and impersonate users, or stop the server responding to all clients.
  • Affected deployments span the chemical, critical manufacturing, energy, and water and wastewater sectors worldwide.
Source document
0:15
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 17 claims 16 Oct 2026

CISA details five flaws in energy-sector tools openPDC and openHistorian

CISA has published an advisory covering five vulnerabilities in Grid Protection Alliance's openPDC and openHistorian, software deployed worldwide in the energy sector for grid data collection and storage. The advisory sets out affected versions, remediation status and mitigation steps for operators running these systems, with Docker image deployments left without a vendor fix for several of the flaws.

  • CISA's advisory lists five vulnerabilities affecting openPDC versions below 2.9.477/2.9.482 and openHistorian versions below 2.8.580/2.8.585.
  • CVE-2026-100730 and CVE-2026-105278 each carry a CVSS 3.1 base score of 9.8, rated critical.
  • Grid Protection Alliance has no fix planned for the Docker image and does not recommend its production use, per the advisory.
  • A Modbus connection feature (CVE-2026-101022) lets an authenticated user target arbitrary internal network destinations, enabling internal network mapping.
  • Shubham Raj of Causal Security reported the vulnerabilities to CISA, which released the advisory on 8 October 2026.
Source document