Security Roundup Covers EU Digital Omnibus, PHP Flaws and AI Guidance

Summary

This roundup covers the EU Council’s proposed Digital Omnibus changes, ENISA’s SBOM guidance, critical PHP flaws, Canadian privacy guidance, GAO’s post-quantum readiness findings, and OECD and vendor recommendations for AI privacy and risk management.

Key points

The EU Council’s proposed Digital Omnibus would raise the GDPR breach-notification threshold to high risk and extend the deadline from 72 to 96 hours; the final changes remain subject to the legislative process.
ENISA’s SBOM advisory recommends automating inventories, signing and protecting them, maintaining historical versions, and using SBOM data to support vulnerability response.
NCSC and CISA warned that PHP CVE-2026-109618 and CVE-2026-109619 could enable unauthenticated remote code execution; they urge patching, prioritizing internet-facing systems, and using temporary mitigations if needed.
Canada’s Children’s Privacy Code and Quebec regulator guidance address privacy-protective defaults, children’s data practices, deceptive interface design, and making cookie refusal as easy as acceptance.
A GAO review found none of 24 federal agencies had fully implemented the assessed post-quantum preparation practices, and none had tested post-quantum cryptography in its own environment.
The OECD recommends more granular privacy controls and safeguards for AI training data, while noting that removing personal information from model weights can be difficult.
Microsoft and NVIDIA’s open-weight AI risk guidance calls for deployment-specific testing, model provenance checks, safeguards, monitoring, and reassessment after material changes.

Article Details

Event Type: Cybersecurity and privacy news roundup featuring critical PHP vulnerability advisories, regulatory guidance, and government cyber-readiness findings.
Impact: The PHP vulnerabilities could enable unauthenticated remote code execution on affected servers, potentially compromising applications and data; security fixes are available, and advisories urge prioritizing internet-facing systems. Other reports cover proposed EU changes to data protection and incident reporting, software supply-chain security guidance, and gaps in U.S. federal agencies’ preparation for post-quantum cryptography.