Regulatory Update

Unspecified location – October 19, 2026 -- Wiz Research found a critical vulnerability, CVE-2026-3854, that let any authenticated user execute arbitrary commands on GitHub's backend servers with a single git push command, and 88% of GitHub Enterprise Server instances remained vulnerable at the time of disclosure.

Wiz Research uncovered the flaw on 20 April 2026 in GitHub's internal git infrastructure. It affects both GitHub.com and GitHub Enterprise Server (GHES). The exploit requires only a standard git client.

GitHub.com is fully mitigated; GHES versions up to 3.19.1 stay exposed

GitHub has fully mitigated the issue on GitHub.com, and users there need to take no action. GHES versions up to and including 3.19.1 are vulnerable.

Fixed versions are 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3. GitHub released patches for all supported GHES versions, and administrators are urged to upgrade immediately.

San Diego – October 19, 2026 -- The U.S. Food and Drug Administration's Cellular, Tissue, and Gene Therapies Advisory Committee (CTGTAC) will meet on July 29, 2026, to review Capricor Therapeutics' Biologics License Application (BLA) for Deramiocel, an investigational cell therapy for Duchenne muscular dystrophy (DMD), less than four weeks before the agency's August 22, 2026 PDUFA target action date.

Panel meeting precedes the August 22 PDUFA decision date

Capricor (NASDAQ: CAPR) said its BLA remains on track against the August 22 deadline. The advisory meeting will be livestreamed. The company pointed to the Federal Register and its own website for meeting details.

San Diego – October 19, 2026 -- Capricor Therapeutics (NASDAQ: CAPR) disputed the post-hoc analyses in the FDA's briefing materials, two days before an advisory committee meets on July 29 to discuss its Biologics License Application (BLA) for Deramiocel, an investigational cell therapy for Duchenne muscular dystrophy (DMD).

Capricor says FDA analyses rely on an obsolete draft analysis plan

The company said the FDA's post-hoc analyses use statistical analysis plan (SAP) version 1.1. Capricor described that version as an unsigned, incomplete internal draft that became obsolete when cohort B was added. It also said the draft lacked content the FDA had specifically requested.

Capricor said its results are governed by SAP version 3.0, which was finalized before unblinding.

SAN DIEGO – October 19, 2026 -- The FDA's Cellular, Tissue and Gene Therapies Advisory Committee voted 9-3, with no abstentions, that available evidence did not support the effectiveness of Capricor Therapeutics' Deramiocel for cardiomyopathy in patients with Duchenne muscular dystrophy (DMD), leaving the company's PDUFA target action date of August 22, 2026 as the next decision point.

Non-binding vote addresses narrower indication than Capricor proposed

The committee's vote is non-binding. Capricor (NASDAQ: CAPR) said the voting question covered a narrower indication than the one it had proposed and did not include a vote on Deramiocel's overall benefit-risk profile.

Cardiomyopathy in DMD currently has no approved treatment. Capricor said heart muscle deterioration leads to cardiomyopathy and heart failure, the leading cause of death in DMD, which affects approximately 15,000 people in the United States.

San Diego – October 19, 2026 -- The U.S. Food and Drug Administration has pushed the decision date for Capricor Therapeutics' Deramiocel Biologics License Application by three months, from August 22, 2026 to November 22, 2026, after classifying the company's latest data submission as a major amendment.

Deramiocel is an investigational cell therapy for Duchenne muscular dystrophy (DMD). Capricor (NASDAQ: CAPR) disclosed the extension of the Prescription Drug User Fee Act (PDUFA) target action date on the day of release.

Capricor files 24-month HOPE-3 extension data after July advisory committee

Following the July 2026 Advisory Committee meeting, Capricor submitted a BLA amendment containing 24-month open-label extension data from its pivotal Phase 3 HOPE-3 study. The filing also includes additional robustness analyses.

Farnborough – October 18, 2026 -- De Havilland Aircraft of Canada has received European Union Aviation Safety Agency (EASA) certification for the Twin Otter Classic 300-G, clearing deliveries to operators across Europe and other regions that recognize EASA approval.

Zimex Aviation flies first EASA-certified Classic 300-G in commercial service

The first EASA-certified aircraft has already been delivered to Switzerland-based Zimex Aviation, which is the launch customer and first operator. The aircraft is in commercial operation.

Zimex is a long-time Twin Otter operator. It uses the aircraft for global operations that include humanitarian aid, government support, cargo transport and special mission flying in remote environments.

United States – October 17, 2026 -- AdvaMed has told the U.S. Copyright Office that software built to diagnose, configure and service a medical device is a distinct product and should not be treated like the software that operates the device.

AdvaMed separates clinician-facing software from servicing tools

The trade group's comments contrast two categories. One is software clinicians use to operate an imaging system. The other is software designed specifically to diagnose, configure and service that system. AdvaMed compares the split to a vehicle's operating software versus the specialized diagnostic tools technicians use to repair it. In its framing, one enables use of the product, while the other is a standalone tool with its own functions, users, protections and market.

Selangor -- Founder Group Limited (Nasdaq: FGL) has until October 17, 2026, to submit a plan to Nasdaq's staff for regaining compliance after the exchange found the company no longer meets the minimum of 500,000 publicly held shares required for continued listing.

Nasdaq cites Listing Rule 5550(a)(4) in a September 16 letter

The Listing Qualifications Department of Nasdaq Stock Market LLC sent the notification on October 17, 2026. The letter states that FGL no longer satisfies the publicly held shares requirement under Nasdaq Listing Rule 5550(a)(4) for the Nasdaq Capital Market. As a result, the company does not comply with the Listing Rules for continued listing.

Class A ordinary shares keep trading while the deadline runs

The notification has no immediate effect on the listing or trading of FGL's Class A ordinary shares.

Irvine – October 17, 2026 -- Masimo, a Danaher company, has received FDA 510(k) clearance for atrial fibrillation (AFib) detection on its Radius VSM monitor. The feature showed 97% sensitivity and 100% specificity in clinical validation testing, according to the company.

The AFib capability joins the company's previously cleared, AI-enabled detection of opioid-induced respiratory depression (OIRD) under the smartSET platform. Masimo describes smartSET as the next evolution of its Signal Extraction Technology (SET) pulse oximetry, which draws on more than 35 years of signal-processing development.

Shanghai – October 17, 2026 -- The U.S. Food and Drug Administration has granted Orphan Drug Designation to GT801, the lead in vivo CAR-T candidate of Vivacta Biotechnology (Shanghai) Co., Ltd., for autoimmune hemolytic anemia (AIHA). Vivacta Bio was spun out of Beijing Grit Biotherapeutics' in vivo CAR-T platform on June 25, 2025.

Designation opens tax credits, fee exemption and seven-year exclusivity

Sponsors of designated products may be eligible for tax credits on qualified clinical trial expenses and an exemption from marketing application user fees. They may also receive seven years of orphan drug market exclusivity after marketing approval, subject to applicable requirements.