LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

FDA

FDA finalized its premarket cyber guidance, and 524B now has a rulebook

MedDevice Cyber Staff · Aug 18 · 4 min read · Via Federal Register

FDA finalized "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions" in late June 2025, superseding the 2023 version. The change that matters is a new section built directly around Section 524B of the FD&C Act.

For a cyber device, the submission is now expected to carry the statutory package: a secure product development framework and risk management, a machine-readable SBOM, and a plan to monitor, identify and address postmarket vulnerabilities, including coordinated disclosure and a patching path. 524B has been law since March 2023. What changed is that the expectations read like a checklist a reviewer can hold your submission against.

Miss a piece and it comes back as a deficiency, which is weeks you did not budget. Build the submission to the 2025 structure. The guidance is the closest thing to an answer key FDA publishes.

Sources

Federal Register ↗

Questions & Answers

What changed in FDA’s 2025 final premarket cybersecurity guidance?

The June 2025 final version supersedes the 2023 guidance and adds a section built directly around Section 524B of the FD&C Act, so the statutory expectations read like a checklist a reviewer can hold a submission against.

What does a cyber device submission need under the 2025 guidance?

A secure product development framework with risk management, a machine-readable SBOM, and a plan to monitor, identify and address postmarket vulnerabilities, including coordinated disclosure and a patching path.

What happens if a 524B piece is missing from a submission?

It comes back as a deficiency, which costs review weeks. Building the submission to the 2025 structure up front is the cheaper path.

← Back to FDA & Regulation