An Israeli commission reviewing allegations that NSO Group’s Pegasus spyware was misused by its customers to target journalists and human rights activists will examine whether rules on Israel’s export of cyberweapons such as Pegasus should be tightened, a senior MP has said.

The move came as the French president, Emmanuel Macron, convened an emergency cybersecurity meeting after reports his mobile phone and those of government ministers appeared in the leaked list. An official in Macron’s Elysee Palace said that the president’s phone and phone numbers had been changed.

NSO has said Macron was not a “target” of any of its customers, meaning the company denies he was selected for surveillance using its spyware, saying in multiple statements that it requires its government clients to use its powerful spying tools only for legitimate investigations into terrorism or crime.

The German chancellor, Angela Merkel, added her voice to the escalating controversy on Thursday, telling reporters in Berlin that spyware such as NSO’s should be denied to countries where there was no judicial oversight, after it emerged 14 heads of state were on the list.

Asked whether she regretted that technology sold by NSO Group had helped to undermine freedom of expression in countries governed by autocratic regimes, Merkel said: “I believe it is important that software developed for certain situations does not fall into the wrong hands. There have to be restrictive conditions and such software should not be sold to countries where judicial oversight over such attacks cannot be guaranteed.”

The growing fallout from the revelations of the Pegasus project, a collaboration of 17 media organisations including the Guardian, which launched on Sunday with a series of claims about misuse of the software, has continued to resonate.

In Israel the prospect of tighter controls on the export of spyware such as Pegasus was raised by Ram Ben-Barak, the head of parliament’s foreign affairs and defence committee – and a former deputy head of the Mossad spy agency – on Army Radio as he disclosed that Israel’s “defence establishment [has] appointed a review commission made up of a number of groups”.

“We certainly have to look anew at this whole subject of licenses granted by DECA [Israel’s Defence Exports Control Agency],” he said. “When they finish their review, we’ll demand to see the results and assess whether we need to make corrections.”

DECA is within Israel’s defence ministry and oversees NSO exports. The ministry and the company have said Pegasus is meant to be used to track terrorists and criminals only, and that all foreign clients are vetted governments.

NSO Group says it only sells spyware to vetted government bodies