LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

FDA

FDA posted a pen-test validation paper, and it tells you what evidence it wants

MedDevice Cyber Staff · Jun 29 · 3 min read · Via FDA

At the end of June 2026 FDA added a Medical Device Innovation Consortium white paper on penetration-testing validation methods to its cybersecurity page. It follows two FDA-funded MITRE papers from April, one on cyber risk analysis for evolving technologies and one on the pain of normalizing SBOM data.

None of these are guidance. They are the closest FDA gets to saying out loud what good evidence looks like, which makes them scoping hints for the testing and SBOM sections of a 524B submission. The pen-test paper matters because "we did a penetration test" is not a disposition, and a reviewer wants scope, method and validation.

Align your pen-test scoping and your SBOM data quality to these papers before your next submission. It is cheaper than a deficiency letter, and FDA is telling you where it will look.

Sources

FDA ↗

Questions & Answers

What did FDA post about penetration testing?

An MDIC white paper on penetration testing validation methods, added to FDA’s cybersecurity page in late June 2026, following two FDA-funded MITRE papers on cyber risk analysis and SBOM data quality.

Are the MDIC and MITRE papers binding guidance?

No, and reading them is still the move. They are the closest FDA gets to describing what good evidence looks like for the testing and SBOM sections of a 524B submission: scope, method and validation rather than a bare statement that a pen test happened.

← Back to FDA & Regulation

FDA posted a pen-test validation paper, and it tells you what evidence it wants

Questions & Answers

What did FDA post about penetration testing?

Are the MDIC and MITRE papers binding guidance?

More FDA & Regulation