Compliance Watch, week ending 29 October 2026
The Fortinet alert goes first because it's rated Critical and the check is one question to your IT provider. There's more from overseas this week, so I've kept each item short.
Do this week
Fortinet alert rated Critical on 23 October
The Australian Cyber Security Centre (ACSC) rated its 23 October 2026 alert on Fortinet products Critical, covering FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. If updates must wait, Fortinet says to limit admin interfaces to trusted IP addresses and use multi factor authentication. The ACSC isn't aware of active exploitation in Australia. Ask your IT provider whether you run Fortinet and whether it's updated.
Australia
Data breach notifications reach 667 for January to June 2026
Australia, 26 Oct 2026. The Office of the Australian Information Commissioner (OAIC) received 667 data breach notifications from January to June 2026, up from 662. Breaches reported to the OAIC affecting over 1,000,000 people rose to 11 from 4, and malicious or criminal attacks remain the leading cause.
This week: Delete copies of ID documents you no longer need.
A 74 year old worker died on 25 October, the 42nd in Victoria this year
Victoria, 26 Oct 2026. WorkSafe Victoria said a 74 year old worker died on 25 October 2026 after becoming trapped under a loading ramp at a farm in Waggarandall, near Shepparton. WorkSafe is investigating, and it is the 42nd confirmed workplace fatality in Victoria this year.
This week: Are loading ramps locked or chocked before anyone works beneath them?
Around the region and the world
Singapore warns of two PHP flaws scoring 9.2 out of 10
Singapore, Updated 23 Oct 2026. Singapore's Cyber Security Agency (CSA) says two critical PHP vulnerabilities, nicknamed PHP2Shell, affect all versions and allow unauthenticated remote code execution. It reports widespread exploitation attempts and says to update immediately, prioritising internet facing systems.
This week: Check whether PHP is on your web servers, including through third party applications.
WhatsApp accounts are spreading malware as business documents
Singapore, 27 Oct 2026. A CSA advisory says malware is spreading as files through compromised WhatsApp accounts, disguised as business documents. Victims found the same files sent to their contacts without their knowledge.
This week: Verify unexpected attachments with the sender by phone, even from known contacts, and be cautious with .exe, .iso and .zip files.
United Arab Emirates counters nearly 750,000 cyberattack attempts
United Arab Emirates, 21 Oct 2026. The United Arab Emirates (UAE) Government Cyber Security Council says it detected and countered nearly 750,000 cyberattack attempts on critical sectors, led by energy and education. It says detected attempts don't necessarily mean successful breaches.
This week: Check that staff know how to report a suspicious email.
Saudi Arabia consults on draft personal data rule changes
Saudi Arabia, Closes 5 Nov 2026. The Saudi Data and Artificial Intelligence Authority is consulting on draft changes to its Personal Data Protection Law Implementing Regulation, including 72 hour breach notification. It's a draft only, so current rules still apply.
This week: If you handle personal data in Saudi Arabia, check you could notify a breach within 72 hours.
US securities regulator sets Fiscal Year 2027 examination priorities
United States, 23 Oct 2026. The Securities and Exchange Commission (SEC) announced its Fiscal Year 2027 examination priorities, which include cybersecurity and protection of customer information. This applies only if the SEC regulates you or you supply firms it regulates.
This week: Ask clients the SEC regulates what cybersecurity evidence they expect from you.
US agency adds two actively exploited flaws to its catalog
United States, 27 Oct 2026. The Cybersecurity and Infrastructure Security Agency (CISA) added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, one in Adobe Commerce and Magento and one in Google Brotli. It encourages all organisations to prioritise KEV fixes.
This week: If your online store runs Adobe Commerce or Magento, ask whoever hosts it whether it's patched.
Where Vissibl fits
If you're tracking alerts like these in a spreadsheet and chasing evidence by email, Vissibl keeps the checks, owners and evidence in one place. Book a demo