The latest version of the Brave browser, 1.94, introduces a feature called ‘Email Aliases’ that allows users to generate disposable email addresses when signing up to a new service. Using an alias address keeps the user's real email address hidden from the website while still forwarding messages from the service. Brave already uses data isolation to prevent websites from inferring user identities based on cookie-based or cache correlations; however, email addresses are still stored on website servers, creating a privacy gap. Brave’s new feature addresses this risk by blocking cross-site identity matching, reducing spam, and protecting users from threats such as phishing attacks that can follow data breaches. “If a website you signed up for is hacked, your information can be leaked and end up with data brokers or worse,” explains Brave in the announcement.
Berlin ‘s government faces a Rhysida ransomware attack weeks before elections, with officials refusing to pay despite a claimed 5.79 TB data theft. Berlin’s state government confirmed this week it’s dealing with an extortion attempt following an August cyberattack on the city-state’s administrative network, and officials have already refused the requested ransom. The ransomware group Rhysida claimed responsibility on its leak site August 28, posting an entry titled simply “Berlin, Germany” and claiming 5.79 terabytes of data across roughly 1.44 million files, with personal information on 12,076 individuals allegedly included. Rhysida claims it stole 5.79 TB of data, covering around 1.44 million files. The alleged dataset includes: Personal data: 12,076 individuals, 16,389 email addresses, 11,963 phone numbers and 148 IBANs. Sensitive records: more than 5,000 personnel files, more than 5,000 administrative-offence files, payroll data and leadership information. Credentials: plaintext passwords and credentials for systems including GebäudAtlas, the ePayment PAYONE database and Z_ADMIN accounts. Government and legal material: disciplinary proceedings, court cases, supervisory documents, NDA records and Bundesrat committee protocols. Classified information: data related to classified-material handling and documents allegedly containing state secrets. Critical infrastructure: vulnerability analyses concerning Berlin’s water supply. Identity documents: passports and ID cards from personnel records. Other material: contracts, financial documents, HR records, infrastructure files, health data, password stores and SQL/PST archives. The group also claims that the material could involve violations of GDPR, German classified-information rules, criminal law and KRITIS/BSIG requirements. These are Rhysida’s claims and have not been independently verified. The timing makes this attack especially sensitive. Berlin will elect its state parliament on September 20, less than a month after the breach, so an attack on government systems just before the vote was bound to raise questions. Interior Senator Iris Spranger said the election remains secure and that, so far, the attackers haven’t taken any election-related data. Security officials support that assessment. Broadcaster RBB first reported on Thursday that Berlin had received ransom demands. “The state of Berlin will not submit to extortion,” Berlin Mayor Kai Wegner and Berlin’s interior senator, Iris Spranger, said in a joint statement on Friday, before the ransomware group claimed the attack on their Tor data leak site. That position follows long-standing advice from US federal agencies, which warn that paying a ransom doesn’t guarantee data recovery and can encourage more attacks. Saying no to the ransom is one thing; dealing with the consequences if the attackers publish the stolen data is another. Berlin first disclosed the compromise on August 17, isolating the Senate Department for Mobility, Transport, Climate Protection and Environment along with a second department from the network. Forensic investigators later found the actual data exfiltration happened earlier than the public disclosure, sometime between August 7 and August 12, with the affected department having flagged an initial outflow internally on August 7, a full week before the network got cut off. That gap between first internal detection and actual network isolation is the kind of detail that tends to get scrutinized hardest once the immediate crisis passes. Rhysida isn’t a new name to anyone tracking ransomware against government targets. The group has claimed roughly 280 victims since emerging in 2023, according to tracking services cited by Reuters, including nine in Germany alone and headline targets like the British Library and Chile’s army. Roughly half its victims sit in the US, with the UK, Canada, and Italy rounding out the next tier, a spread that suggests Rhysida isn’t picking targets based on geography so much as opportunity. A joint advisory from CISA, the FBI, and the Multi-State Information Sharing and Analysis Center, first published in November 2023, lays out exactly how Rhysida typically gets in: compromised VPN credentials at organizations without multi-factor authentication, exploitation of the Zerologon vulnerability that Microsoft patched back in 2020, and old-fashioned phishing. None of those entry points are exotic or new, which is precisely the point; Rhysida doesn’t need novel techniques when so many organizations still haven’t closed gaps that have been publicly known for years. Berlin reconnected all Senate departments to the network on August 23, but forensic teams are still checking the systems. The state’s data protection commissioner and Germany’s federal cybersecurity agency, the BSI, are following the investigation. As of publication, neither Berlin’s data protection office nor the Senate Chancellery had given specific advice to the roughly 12,000 people whose data Rhysida claims to have stolen. If you’re among them and haven’t received any official message yet, don’t assume that means you’re safe. Investigators are still working to establish exactly what the attackers accessed and took. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Rhysida Ransomware)
An alleged Chinese-speaking actor breached Philippine nuclear and naval targets by exploiting known flaws, stealing sensitive data. A suspected Chinese-speaking operator targeted a Philippine nuclear research body and a marine engineering company that supports the Philippine Navy, using well-known vulnerabilities in internet-facing ownCloud and WordPress systems. The activity was uncovered after Hunt.io found an exposed server in Amsterdam that contained attack scripts, logs, offensive tooling and data taken from the two organisations. “Hunt.io Attack Capture discovered an open directory containing tooling which documented intrusion activity against two Philippine organizations.” reads the report published by Hunt.io. “A recovered CSV references roughly 9 GB of material stolen from the nuclear agency, most absent from the current directories contents, and a compromise of a project management application, indicating a possible third victim.” Hunt.io disclosed the findings to CERT-PH under the TLP:AMBER sharing standard and delayed publication until 25 August 2026 so the national response team could notify the affected organisations. The incident arrives amid sustained tensions in the South China Sea and continuing reports of suspected Chinese cyber activity against Philippine government, defence and critical-infrastructure targets. “On August 13, 2026, Hunt.io Attack Capture identified an open directory on the host 31.58.209[.]241. The server staged custom Python scripts, per-file transfer logs, open-source offensive security tooling, and exfiltrated data from two Philippine organizations. The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV.” states the report.”A separate intrusion was observed exploiting a WordPress site operated by a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy.” The server was not a sophisticated hidden service. It exposed a Python SimpleHTTP directory on port 8000, along with SSH, a self-hosted ownCloud login page and other services. The directory contained 1,310 files in 86 folders, totaling 1.17 GB, including scripts, stolen data and tools such as Sliver, Metasploit and Mettle. Researchers gained a rare view of the attacker’s operations after finding tools, logs and stolen files left exposed on the server. The main entry point was likely the nuclear research body’s internet-facing ownCloud service, compromised by exploiting CVE-2023-49105, an authentication-bypass flaw in ownCloud versions before 10.13.1. In this condition, an attacker who knows a valid username can generate WebDAV requests that the server accepts as if they were made by that user. No password is needed. Hunt.io found five custom Python scripts implementing this technique, four focused on individual accounts and a fifth capable of enumerating directories and recording every attempted download. hunt “In vulnerable instances when no such key was configured, a default state on new installs, the signing routine still executed using an empty secret. An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials.” continues the report. “A total of five custom Python scripts saved from the directory implement this exact technique described above. Four target a single account each; the fifth moves further to include directory enumeration and logging.” The attacker used random delays to make data collection less noticeable and avoid volume-based alerts. Scripts, logs and folders consistently used Simplified Chinese, including labels for nuclear, radiation-safety, finance and IT files. This suggests a Chinese-speaking operator, but does not prove links to a specific government or threat group. The stolen data included nuclear reactor component databases, fuel inventories, radiation-safety documents, incident records and authorised-user lists. It also included strategic plans, IT documents, staff records, CVs, passport and travel data, and financial disclosures from Philippine officials. The exposed server held 176 files, about 372 MB in total. However, a CSV created by the attacker referred to roughly 9 GB of stolen data. This gap suggests the server contained only part of the haul and that the attacker may have accessed much more than researchers could recover. The material also included a KeePass database, AxCrypt-encrypted files and a BitLocker recovery key. Those artefacts matter because they can support follow-on access: a data theft operation can become a credential-theft operation, and a credential-theft operation can become a longer-term intrusion. Researchers additionally recovered a 192 MB SQL dump from a ZKTeco BioTime attendance and personnel system. Such a database can link people to badge identifiers, departments and access records, enabling an attacker to build a picture of who works where, who may have sensitive access and which people are worth targeting next. The same server also contained evidence of a breach involving a Philippine marine engineering and shipbuilding company that works with the Philippine Navy. The attacker exploited CVE-2024-28000, a privilege-escalation flaw in the LiteSpeed Cache WordPress plugin. The flaw let attackers create a WordPress admin account without authentication by exploiting a predictable security hash through the REST API. Hunt.io found the exploit code, compiled tools and logs showing that the attacker successfully gained admin access. The attacker also used WordPress XML-RPC to test passwords for the admin account with the well-known rockyou.txt list. The logs show that this method also found valid credentials. That gave the operator redundancy. Even if one access path were closed, the attacker could retain an administrator account, a valid password or data such as WordPress hashes and secret values from the stolen site database. Redundant access is not glamorous. It is, unfortunately, effective. While examining the compromised WordPress site, Hunt.io also discovered an active EtherHiding-style injection that it believes may be unrelated to the Chinese-speaking operator. The malicious JavaScript used an Ethereum smart contract as a place to retrieve content, then displayed a fake Google verification page designed to push visitors into a ClickFix-style infection flow. The campaign used a service worker for persistence and collected visitor fingerprint data. Hunt.io found 174 unique IP addresses hosting pages with the same NoChain loader strings and smart-contract reference, but said the evidence did not link that activity to the operator who attacked the nuclear and naval-linked targets. That distinction matters. A compromised website can host multiple intrusions or payloads at once, often run by unrelated actors. Analysts should resist the temptation to treat every malicious artefact on one server as evidence of a single campaign. The technical lesson is blunt: old and known weaknesses still provide access to high-value targets. Organisations using ownCloud should upgrade to version 10.13.3 or later, apply the vendor’s relevant fixes and ensure that pre-signed URLs use a strong, non-empty signing key. Teams should also examine WebDAV logs for suspicious PROPFIND directory-enumeration requests, large volumes of file retrieval across multiple accounts, or recurring requests from a single source with artificial gaps between them. Low-and-slow collection is still collection. For WordPress, organisations should update LiteSpeed Cache to version 6.4 or later, remove or restrict XML-RPC when it is not needed, enforce strong unique administrator passwords and require multi-factor authentication. The XML-RPC compromise in this case succeeded against a password from a public wordlist, which is not a vulnerability in WordPress so much as an invitation nobody should leave on the doorstep. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Philippine nuclear and naval targets)
Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below - CVE-2026-76581 (CVSS score: 9.8) - An authentication bypass flaw in
Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records.
New research reveals that AI safety refusal lives in a thin neural layer, highlighting the critical need for external, multi-layered security. The post Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety appeared first on Unit 42.
Love Electric’s alleged data breach exposes sensitive driver data and highlights the identity risks created by third-party salary sacrifice providers. A seller on an English-language data-breach forum claimed on August 26 that they had obtained the driver database of Love Electric, a UK broker that runs electric-vehicle salary sacrifice schemes. The seller, operating under the name “seraphims”, offered 877,000 records for $600 in cryptocurrency, with the price negotiable. That headline number needs a qualification. Ransomnews researchers examined a 999-row sample published with the listing and found strong evidence that the sample came from a genuine production database, but the claimed 877,000 records remain unverified. Love Electric had been contacted for comment at the time of publication. “The 999 rows split into 731 primary drivers and 268 additional named drivers. There are exactly 731 distinct quote IDs, and every quote has exactly one primary driver, 731 out of 731. All 268 additional drivers reference a quote that exists in the file, with no orphans.” reads the Ransomnews’s report. “The consent flag governing National Insurance processing is empty for precisely the 268 additional drivers and populated for every one of the 731 primary drivers. National Insurance numbers appear on primary drivers only. Those are constraints enforced by whatever application wrote the data, and they hold across all 999 rows without exception.” That matters because fabricated breach databases often fall apart when researchers examine the relationships between records. Here, the relationships hold: additional drivers point to existing quotes, the National Insurance processing flag appears where the underlying application logic would expect it, and National Insurance numbers appear only on primary drivers. Love Electric Financial Services Limited is an Edinburgh-based company that provides EV salary sacrifice administration, credit broking and related services to employers across the UK. Companies House identifies it as an active Scottish company, registered under number SC374952, while Love Electric’s own documentation confirms that it operates as a salary sacrifice administrator and FCA-regulated credit broker. The business model explains why its systems can contain information that many people would normally associate with payroll departments. Salary sacrifice arrangements require the broker to identify employees, process the scheme and support insurance and tax-related requirements, so the underlying records can include National Insurance numbers and driving licence information. Love Electric’s privacy policy also says it processes personal information under UK data protection law. “The seller published a free sample as a 999-row CSV with 24 columns, named in a way that indicates an export of a dbo.drivers table from a Microsoft SQL Server database.” continues the report. “The columns are: id, quote_id, user_id, title, first_name, last_name, email, phone_number, date_of_birth, address, address2, city, country, postcode, national_insurance_number, driving_licence_number, driving_licence_country, allow_processing_national_insurance, primary, created_at, updated_at, deleted_at, weekly_hours and occupation_id.” The fields included names, email addresses, phone numbers, dates of birth, addresses, postcodes, National Insurance numbers, driving licence numbers, quote IDs and consent-related fields. The data wasn’t uniformly populated, which is another reason the sample looks like a real production export rather than a synthetic dataset. Around 71% of the rows lacked a name, address or city, 74% had no phone number, and 85% had no National Insurance number, while 147 records contained a National Insurance number and 287 contained a driving licence number. The geography also made sense. Postcodes clustered around Edinburgh and central Scotland, with records extending into England, while dates of birth ranged from 1946 to 1999 and concentrated around people born in the 1970s and 1980s. Ransomnews then tested the driving licence numbers against the structure used by UK licences. Of the 108 full-length licence numbers in the sample, 98.1% had a surname block matching the surname in the corresponding record, 97.2% had an initial matching the first name, and 78.7% contained a date-of-birth encoding that matched the stored date of birth. The imperfections were just as interesting. Licence numbers appeared in many different lengths, only 53% of the National Insurance numbers present matched the expected HMRC format, and phone numbers appeared in three different formats. That kind of mess is exactly what you’d expect from users entering information into a live form, abandoning fields or making mistakes. “A UK driving licence number is not random. Characters one to five are the holder’s surname padded with the digit 9, characters six to eleven encode the date of birth with 50 added to the month for female holders, and character twelve is the first-name initial. Of the 108 full-length licence numbers in the sample, 98.1% have a surname block matching the record’s own surname field and 97.2% have an initial matching the first-name field. 78.7% carry an encoded date of birth matching the date_of_birth column.” state the researchers. “The roughly one in five that disagree are consistent with people mistyping a sixteen-character string into a web form, which is exactly the error rate real self-reported data carries and synthetic data does not.” The email addresses provided another useful check. Most belonged to corporate domains associated with identifiable UK employers, Love Electric itself or a European software consultancy, rather than being dominated by Gmail and other consumer providers. That fits the way workplace salary sacrifice schemes operate because employees generally enter through their employer. The database structure also looked normal. It included a soft-delete field, integer foreign keys for quotes and occupations, regional values for Scotland, England, Wales and Northern Ireland, and even a Jane Doe test record that appears to have survived from the system’s setup. Real databases leave fingerprints like these. Synthetic ones tend to be suspiciously tidy. The seller’s own history is less convincing than the database evidence. The “seraphims” account was created on July 22, 2026 and had published nine data listings by August 26, roughly two per week, but several of those listings were described by the seller as scrapes rather than breaches. The Love Electric listing had attracted no replies and only 52 views when Ransomnews checked it. The account’s reputation score of 30 came from a single positive vote posted on August 17 with the comment “keep scrapping”, which says more about the seller’s scraping activity than about a track record of selling verified breach data. That doesn’t make the Love Electric sample fake. The technical evidence points in the opposite direction. It does mean we should separate two questions: whether the sample appears genuine, and whether the seller really controls 877,000 records. The second claim is much harder to establish. Ransomnews saw only 0.11% of the alleged dataset, and the sample shows that database rows don’t map directly to individual people. The 999 rows corresponded to 731 quotes and only 58 distinct surname-and-date-of-birth combinations, with one person appearing 48 times. There’s another clue in the filename. The db2_ prefix suggests that the table may belong to one database among several, so the seller’s 877,000 figure could refer to a larger collection rather than this particular driver table. At this point, treating 877,000 as a confirmed number would go beyond the evidence. The timeline also deserves caution. The seller claimed an August 2026 attack involving a zero-day in a third-party system, but every sample row carries a created_at timestamp within a six-second window on August 14, 2022. That pattern looks like a bulk migration into a newer platform rather than 999 people signing up within six seconds. It tells us that the database contains legacy records. It doesn’t tell us when someone took them, how they obtained them or whether the seller’s claimed zero-day played any role. That last point matters for incident response. “Third-party zero-day” is a claim made by the seller, not an established fact, and attackers have plenty of reasons to make an access story sound more sophisticated than it was. Ransomnews says it has not verified that route. For the people potentially affected, the more immediate issue is the nature of the exposed information. A password can be replaced. A National Insurance number and a driving licence number can’t simply be rotated because someone has posted them for sale. That creates an obvious phishing risk. Someone who has a person’s name, date of birth, address, employer and National Insurance number can construct a much more convincing message pretending to be HMRC, a payroll team, an employer or a vehicle leasing provider. Drivers who used Love Electric should therefore treat unexpected messages about their vehicle scheme, payroll or tax affairs with suspicion. They should verify the sender through a phone number or website they already trust rather than using contact details contained in the message. Love Electric’s current public material says it works with more than 1,500 companies, which gives some sense of the scale of the service’s employer-facing footprint. That makes supplier security worth treating as an operational issue rather than a procurement checkbox. If a third-party provider holds National Insurance numbers, driving licence numbers, employment information and contact data, its security controls deserve the same level of scrutiny as any other system handling high-value identity information. The seller’s alleged third-party entry point is therefore worth investigating, but it shouldn’t become the centre of the story before someone verifies it. The useful evidence is already sitting in the sample: a production-style schema, consistent relationships, realistic user errors and identifiers that line up with real-world records. The other important detail is the price. $600 for a database containing National Insurance and driving licence numbers isn’t a serious valuation of the data. It’s a price designed to make a quick sale. And if the seller really has more than the published sample, multiple buyers could obtain the same information. That’s where the risk gets worse: the exposure doesn’t end with the first person who downloads it. Ransomnews says it did not access or probe Love Electric’s systems, purchase the full dataset, or validate the exposed identifiers against live services. It analysed the free sample, removed identifying information from its publication and notified Love Electric before publication, offering to share the listing and sample with the company’s incident-response team. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data breach)
PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial fixes. As BleepingComputer reported yesterday, PaperCut warned that hackers were exploiting a vulnerability in zero-day attacks against customer servers and released an initial emergency patch for PaperCut NG/MF versions 25 and 26. At the time, however, the company had not disclosed CVE identifiers or technical details about the vulnerabilities, saying it was withholding information while it investigated the attacks and gave customers time to apply emergency fixes. PaperCut has now shared technical details and CVE identifiers for the two vulnerabilities, tracked as CVE-2026-82078 and CVE-2026-81578. These vulnerabilities can be chained to bypass authentication and execute code on vulnerable servers.
A maximum-severity vulnerability in the GiveWP plugin for WordPress allows an unauthenticated attacker to execute arbitrary commands on the hosting server. The security issue is identified as CVE-2026-82222 and affects GiveWP through version 4.16.7.1. It was reported by bug researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform. The GiveWP plugin has more than 100,000 installs and allows collecting donations and managing fundraising campaigns. Patchstack researchers explain that exploiting the vulnerability is possible by chaining three distinct issues: Successful exploitation depends on the attacker having an account on the target site. However, Patchstack says that an exposed unauthenticated registration action allows creating an account even if registration is disabled.
Trump targets foreign-made power grid equipment, citing cyber, sabotage and supply-chain risks to U.S. national security. Executive Order 14420, signed on August 26, targets equipment and technologies that could expose the power grid to sabotage, unauthorized access, malicious remote activity or supply-chain disruption. The timing matters. The White House points to the rapid expansion of data centers, artificial intelligence, advanced manufacturing and defense production as reasons why the United States now depends even more heavily on reliable electricity. A disruption that might once have been treated primarily as an energy problem can now affect defense operations, critical infrastructure, emergency services and large parts of the economy. The order frames the problem in two ways. Foreign-made equipment can introduce a direct cybersecurity risk, including the possibility of hidden digital access mechanisms, while dependence on overseas suppliers can create a second vulnerability if geopolitical tensions or trade disruptions suddenly cut off critical components. The White House’s language is unusually broad when describing the scope of the concern. “NOW, THEREFORE, I, DONALD J. TRUMP, President of the United States of America, find that the situation with respect to the foreign supply of bulk-power system electric equipment constitutes an unusual and extraordinary threat, which has its source in whole or substantial part outside the United States, to the national security, foreign policy, and economy of the United States and hereby declare a national emergency with respect to that threat.” reads the Executive Order 14420. “This threat exists both in the case of individual transactions and when transactions are considered as a class. To deal with this threat, additional steps are required to protect the security, integrity, and reliability of bulk-power system electric equipment used in the United States.” That definition matters because the order isn’t aimed only at a specific piece of hardware from a specific country. It creates a framework under which the Energy Secretary can determine whether particular foreign entities, suppliers, countries or equipment present an unacceptable risk and then restrict transactions involving them. The restrictions apply to the acquisition, importation, transfer or installation of foreign-produced bulk-power equipment when the relevant transaction involves a designated Covered Foreign Entity and meets one of the risk conditions set out in the order. Those conditions include the possibility of sabotage, subversion, unauthorized access, malicious remote action or disruption of the power system and its supply chain. The order also reaches beyond the physical equipment itself. Its scope includes critical components, software, firmware, digital services, maintenance services and remote-access capabilities associated with covered equipment. “the transaction involves bulk-power system electric equipment — or any critical component, software, firmware, digital service, maintenance service, or remote-access capability associated with such equipment — designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a Covered Foreign Entity; and” continues the order. In practical terms, the government isn’t treating a transformer, an industrial controller and the software that manages it as completely separate security questions. That is particularly relevant to industrial control systems. The definition of covered equipment includes remote terminal units, programmable logic controllers, intelligent electronic devices, distributed control systems and safety instrumented systems, alongside transformers, generators, inverters, battery storage systems, protective relays, metering equipment and high-voltage circuit breakers. The order also allows agencies to consider software, firmware, remote access, update mechanisms and other supply-chain dependencies when deciding whether equipment falls within its security concerns. The geographical scope is also worth noting. The order defines the bulk-power system around interconnected transmission infrastructure and generation resources needed for grid reliability, including transmission lines rated at 69 kV or higher. Local electricity distribution facilities fall outside that definition. This isn’t only about equipment that companies might buy tomorrow. The Energy Secretary can also impose conditions on foreign-manufactured or foreign-operated equipment already installed before the order took effect. Depending on the risk, those measures could require operators to identify, isolate, monitor, secure, disconnect, replace or remove equipment. The order specifically requires officials to consider reliability, safety, the availability of secure replacements and continuity of essential services before demanding isolation or replacement. That last point is important because securing a power grid isn’t as simple as unplugging a suspicious device. Removing a component without a suitable replacement can itself create an operational problem. The order therefore leaves room for phased compliance and negotiated mitigation measures rather than assuming that every risky component can disappear overnight. The government also wants to avoid turning security screening into a permanent procurement bottleneck. The Energy Secretary can establish criteria for pre-qualified equipment and vendors, creating a list of products and suppliers that can receive exemptions from the baseline restrictions. At the same time, the order makes clear that pre-qualification doesn’t prevent the government from scrutinizing or restricting a transaction later if circumstances warrant it. The order doesn’t name a specific country as the target. Instead, it defines a Covered Foreign Entity broadly enough to include governments under certain U.S. arms embargoes or sanctions regimes, as well as entities that the relevant U.S. authorities determine are engaged in conduct detrimental to national security or foreign policy. SecurityWeek also noted that the structure resembles earlier Trump-era restrictions on foreign bulk-power equipment, including measures that previously focused on entities associated with China. The order does not mention any country by name. However, its structure is very similar to a 2020 Trump-era order on the U.S. power grid, which later led the Department of Energy to ban companies linked to China. The next phase will be regulatory rather than rhetorical. Within 120 days, the Energy Secretary is expected to issue rules or regulations needed to implement the order, including procedures for identifying covered entities, equipment and countries and for licensing transactions that would otherwise be prohibited. The administration also wants recommendations for changes to federal procurement rules that would give greater weight to national security risks and favor U.S.-manufactured energy infrastructure. Those procurement changes have their own timetable. The Energy Secretary has 180 days to develop recommendations for revisions to the Federal Acquisition Regulation, while the FAR Council would then have 90 days to consider proposing corresponding amendments for public comment. The policy fits into a wider push by the administration to reduce dependence on foreign supply chains for strategically important infrastructure. The Department of Energy said earlier this month that it is working to increase domestic production and availability of critical grid components, pointing to rapid growth in electricity demand and the need to strengthen the grid supply chain. For cybersecurity professionals, however, the most interesting part of the order isn’t the preference for domestic manufacturing. It’s the decision to treat supply-chain exposure, remote access and embedded technology as part of the attack surface of the power grid. That changes the question organizations need to ask about critical equipment. It’s no longer enough to know whether a device has a vulnerability today; operators also need to understand who made it, who controls the supplier, where critical software and firmware come from, who can remotely access the equipment, how updates reach it and what happens if that supply chain suddenly becomes unavailable. The uncomfortable reality is that a power grid compromise doesn’t necessarily begin with someone breaking through the perimeter of a utility network. It can begin much earlier, when an organization buys a component it can’t fully inspect, relies on a remote maintenance channel it doesn’t control, or becomes dependent on a supplier it can’t replace quickly. That’s the security problem Executive Order 14420 is trying to address. The White House has effectively moved part of the grid’s cyber defense line back into procurement, manufacturing and supply-chain decisions. And for critical infrastructure operators, that’s a much harder problem to solve than simply finding another firewall. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, power grid)
Confirm this action.
Leaving now will discard your changes.