This week in one line: Critical PHP flaws forced organisations worldwide to patch or take websites offline, UAE businesses with AED 50m+ revenue must appoint an e-invoicing provider by 30 October, and global standard-setters are putting AI accountability on boards. Plus, check out the latest senior risk and compliance roles open in the UAE.
Get SignPath Weekly in your inbox. One email a week.
Free. Unsubscribe anytime.
Interested in a daily 2-minute brief on the risk and compliance developments to act on? Find out more →
Top story
PHP2Shell: a critical flaw in the language behind much of the web
PHP is one of the oldest and most widely used languages for building websites: it has powered sites since the mid-1990s, runs WordPress and still runs a large share of the world’s websites. Because the problem sits in PHP itself, any site built on it could be exposed.
On 21 October, the PHP project released fixes for two critical flaws known as PHP2Shell. The US cyber agency CISA said they “allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests”: an attacker could take over a web server without logging in. Amazon saw an exploitation attempt four days before disclosure. PHP 8.1 and earlier are no longer supported, so older systems need upgrading or vendor support.
The UK’s National Cyber Security Centre told organisations to patch or take affected systems offline, and dozens of UK government services went down as a precaution, with no confirmed compromise.
So what? Few compliance teams run PHP themselves, but their vendors’ portals and software often do. This is a test of third-party risk management: knowing which critical services depend on which vendors, and getting evidence quickly when something breaks.
Relevant if you own third-party or outsourcing risk, or rely on vendor portals for onboarding, screening or reporting.
Sources: The National | Gulf News | The Register | Help Net Security
Also this week
1. E-invoicing: providers due by 30 October, and the rules just got lighter
On 19 October, the Ministry of Finance announced Ministerial Decision No. 197 of 2026, easing the e-invoicing rules from 1 October:
- transactions within a VAT tax group are excluded for 24 months from 1 January 2027;
- e-invoices no longer have to be stored in the UAE, if they are kept for the legal retention period and can be produced to the FTA on request;
- the duty to notify the FTA of a system failure within two business days is removed.
Deadlines are unchanged: businesses with annual revenue of AED 50 million or more must appoint an accredited service provider by 30 October and go live on 1 January 2027.
So what? With days to go, check that every in-scope entity has appointed a provider.
Relevant if your UAE entity has annual revenue of AED 50 million or more, or belongs to a VAT tax group.
Sources: Ministry of Finance | Ministerial Decision No. 197 of 2026 | Ministerial Decision No. 66 of 2026 | The National
2. AI governance: boards and firms own the outcomes
On 15 October, the Financial Stability Board (FSB) published 12 final, non-binding sound practices for responsible AI use by financial institutions, including stronger human oversight where AI agents carry higher risk. On 19 October, the UK’s FCA published good and poor practice on AI: firms remain responsible for the AI systems they build, buy or use, and incident reporting should extend to significant AI failures and near-misses.
So what? Neither binds UAE firms, but together they set the questions supervisors are likely to ask: who owns each AI tool’s risk, when a human must step in, and how failures are recorded.
Relevant if you use AI in screening, monitoring or alert review, or oversee its use as a second line of defence.
Sources: FSB | FCA | FCA speech
On the radar
- UAE-led operation identifies $39bn in fraud-linked assets. Operation Confrontation Ghost, led by the UAE Ministry of Interior with 30 countries and INTERPOL, reported more than 960 arrests and 4,126 bank accounts blocked. It follows last week’s Sharjah case. Worth a check: that your monitoring catches accounts receiving money from many unrelated senders and passing it on quickly. The National, WAM
- Saudi CMA proposes tighter fund disclosures. Draft amendments would require funds to explain the sources of their cash distributions and list their 10 largest investments in quarterly statements. The consultation closes on 17 November. Worth a check: if you invest in or distribute Saudi funds, what the new disclosures would show you. Argaam, Arab News
Coming up
Who’s hiring
- VP & Head of Audit, Financial Crime Compliance, First Abu Dhabi Bank, Abu Dhabi. Applications close 30 November. Apply on FAB’s careers page →
- Head of AML UAE (UAE Nationals Preferred), Citi, Dubai. Apply on Citi’s careers page →
Action of the week
Ask your critical web-facing vendors to confirm in writing that they have patched PHP2Shell, and record the answers in your third-party risk file.
SignPath Weekly is for general information only and is not legal, regulatory, tax, financial or compliance advice. It summarises the public sources linked in each item and may contain errors or become outdated, so check the primary source and take professional advice before acting. References to named companies report public actions as stated in the cited sources. The views expressed are the author's own and not those of any employer or organisation. To the fullest extent permitted by law, the author accepts no liability for loss arising from reliance on this newsletter. Spotted an error? Reply and I'll review and correct it.