by Tom Fazio | Oct 21, 2026 | Information Security, Threat Intelligence
If your website runs on PHP, and that includes most WordPress, Drupal, Joomla and Magento sites, you need to act today. On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, now...
by Tom Fazio | Aug 18, 2026 | Compliance, HIPAA
In January 2025, HHS published a proposed rule to overhaul the HIPAA Security Rule for the first time since it took effect in 2005. The proposal drew thousands of public comments. HHS has since moved the rule to its long-term agenda, and the federal regulatory agenda...
by Tom Fazio | Nov 4, 2025 | Compliance, Information Security
The New York Department of Financial Services (NYDFS) amended its cybersecurity regulation, 23 NYCRR Part 500, in November 2023 and phased the new requirements in over two years. The final phase took effect on November 1, 2025. For banks, insurers, agencies, and other...
by Tom Fazio | Oct 7, 2025 | Compliance, DD Boards, General News
Ohio’s operating budget, House Bill 96, was signed on June 30, 2025, and included a significant cybersecurity provision for local government. The new Ohio Revised Code section 9.64 took effect on September 30, 2025. It requires every Ohio political subdivision...
by Tom Fazio | Aug 12, 2025 | Compliance, HIPAA
If you read through the HIPAA settlements the HHS Office for Civil Rights (OCR) has announced in 2025, one finding shows up again and again: the organization failed to conduct an accurate and thorough risk analysis. That is not a coincidence. OCR launched its Risk...
