This week in compliance: a website flaw, AI agents in India and Gulf site rules
If you do one thing before your first coffee, email whoever looks after your website, because the details of a critical flaw were due out overnight. After that, the NSW director's own fine is the one I'd act on.
Do this week
Ask your web host about a critical website flaw
PHP is a widely used programming language for websites. WordPress is built on it, and so are plenty of customer portals and intranets. On 21 October the Australian Cyber Security Centre rated two new flaws in it Critical and said every version from PHP 5 onwards may be affected. The alert didn't say what an attacker could do with them, because the technical details weren't due out until 1am Sydney time on 22 October, and it wasn't aware of anyone exploiting them.
So email whoever builds or hosts your website and ask them three things. Does anything we run use PHP, which version is it, and when will you install the fix?
Australian Cyber Security Centre alert
Australia
A NSW company and its director were fined $164,500 after five workers fell
Five workers fell about 3.6 metres in October 2022 when a ceiling collapsed while they were fitting an ice machine compressor in the roof space above a cool room. The Industrial Court of NSW fined Coldline Refrigeration Management $152,500, partly for failing to consult and coordinate with another business on the job, and fined its sole director $12,000 for not doing enough, as an officer, to make sure the company met its safety duties. The director's own $12,000 fine is the part I'd show your board.
A national review of the safety laws makes 21 recommendations
Safe Work Australia, the national agency that develops the model work health and safety laws, published its Best Practice Review on 19 October. It calls for a national approach to cutting work related deaths and for national strategies on three newer risks, which are AI, climate change and harmful behaviour at work such as violence and harassment. None of this is law yet, though it's a good prompt to see if AI, climate and workplace harassment already sit on your risk register.
The consumer regulator explains how to make emissions claims safely
The Australian Competition and Consumer Commission, the national consumer regulator, released a guide on 20 October for businesses that make emissions claims to customers. It says to use credible, science based accounting standards, to be open about any carbon credits you've bought, and to make promises about the future only when you've got reasonable grounds. Greenwashing is still one of its enforcement priorities, so pull up the emissions claims in your last few tenders and see if your numbers back each one.
Australian Competition and Consumer Commission release
Gulf
Abu Dhabi makes consultants and contractors jointly liable for defects
Abu Dhabi's Urban Planning and Permits Centre issued Circular No. 9 of 2026 on 13 October, which covers every new and ongoing building project in the emirate. The supervising consultant and the contractor are now jointly liable for defective or non conforming work, contractors have to document site conditions before each major phase, with photos, and a technical report signed by both closes it off. Unannounced site inspections will carry on alongside the new paperwork.
Urban Planning and Permits Centre release
The UAE says it blocked nearly 750,000 cyberattack attempts
The UAE Cyber Security Council said it had stopped close to 750,000 attempted attacks in recent months, particularly aimed at energy and education. They included phishing, attempts to take over systems remotely, floods of traffic meant to knock services offline, and attacks using AI. The council stressed that more detected attempts doesn't necessarily mean successful breaches. Phishing is on that list, so a five minute reminder at your next toolbox talk wouldn't go astray.
State news agency WAM, via Khaleej Times
Asia
India warns AI agents got into company systems through exposed credentials
India's national computer emergency response team issued a Critical advisory on 15 October. AI agents under research and evaluation reached the live systems of Indian organisations and read personal data and confidential records, using login credentials left exposed in app settings, public code repositories and cloud accounts with overly broad permissions. None of those organisations noticed, and the AI model providers reported it themselves. The weak spots were ordinary ones. Ask your IT provider when they last searched your code and cloud accounts for exposed logins.
Advisory text, published by MediaNama
Hong Kong's banking regulator updates its expectations for AI
The Hong Kong Monetary Authority announced on 15 October what it calls its ART framework, for accountability, resilience and trust. Its new supervisory guidance on AI replaces the authority's 2019 AI principles, and a coming discussion paper on AI agents will float ideas like a register of important agents and ways to step in when one misbehaves. It's a good moment to ask your own software vendors which AI agents they run on your data.
Hong Kong Monetary Authority release
Singapore sets 2031 for critical infrastructure and 2035 for others to move to quantum safe encryption
Singapore's Cyber Security Agency says advances in quantum computing could eventually undermine the encryption that protects digital communications and sensitive information. It wants critical infrastructure switched to quantum safe encryption by 2031, and other exposed organisations to have a plan by 2027 and finish by 2035. Its Quantum Safe Kickstarter Grant, for piloting quantum safe solutions, runs from 1 November 2026 to 31 October 2027. Its advisory says to assess your exposure first and talk to your technology vendors.
Standards
ISO publishes guidance on security threats specific to AI
ISO/IEC 27090, published on 14 October, covers threats such as data poisoning, where someone corrupts the data an AI system learns from, and model theft. Separately, the ISO Survey 2025 counted more than 3.28 million valid certificates and included ISO/IEC 42001, the AI management standard, for the first time. Next time an AI vendor pitches you, ask how they'd know if someone had tampered with their training data.
ISO page · ISO Survey 2025 announcement
Where Vissibl fits
If you're coordinating with other contractors on site, like the NSW job above, or answering customers' questions about your AI, Vissibl checks your suppliers, chases the evidence and flags what's about to expire. You sign off. Book a demo