Trump targets foreign-made power grid equipment, citing cyber, sabotage and supply-chain risks to U.S. national security. Executive Order 14420, signed on August 26, targets equipment and technologies that could expose the power grid to sabotage, unauthorized access, malicious remote activity or supply-chain disruption. The timing matters. The White House points to the rapid expansion of data centers, artificial intelligence, advanced manufacturing and defense production as reasons why the United States now depends even more heavily on reliable electricity. A disruption that might once have been treated primarily as an energy problem can now affect defense operations, critical infrastructure, emergency services and large parts of the economy. The order frames the problem in two ways. Foreign-made equipment can introduce a direct cybersecurity risk, including the possibility of hidden digital access mechanisms, while dependence on overseas suppliers can create a second vulnerability if geopolitical tensions or trade disruptions suddenly cut off critical components. The White House’s language is unusually broad when describing the scope of the concern. “NOW, THEREFORE, I, DONALD J. TRUMP, President of the United States of America, find that the situation with respect to the foreign supply of bulk-power system electric equipment constitutes an unusual and extraordinary threat, which has its source in whole or substantial part outside the United States, to the national security, foreign policy, and economy of the United States and hereby declare a national emergency with respect to that threat.” reads the Executive Order 14420. “This threat exists both in the case of individual transactions and when transactions are considered as a class. To deal with this threat, additional steps are required to protect the security, integrity, and reliability of bulk-power system electric equipment used in the United States.” That definition matters because the order isn’t aimed only at a specific piece of hardware from a specific country. It creates a framework under which the Energy Secretary can determine whether particular foreign entities, suppliers, countries or equipment present an unacceptable risk and then restrict transactions involving them. The restrictions apply to the acquisition, importation, transfer or installation of foreign-produced bulk-power equipment when the relevant transaction involves a designated Covered Foreign Entity and meets one of the risk conditions set out in the order. Those conditions include the possibility of sabotage, subversion, unauthorized access, malicious remote action or disruption of the power system and its supply chain. The order also reaches beyond the physical equipment itself. Its scope includes critical components, software, firmware, digital services, maintenance services and remote-access capabilities associated with covered equipment. “the transaction involves bulk-power system electric equipment — or any critical component, software, firmware, digital service, maintenance service, or remote-access capability associated with such equipment — designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a Covered Foreign Entity; and” continues the order. In practical terms, the government isn’t treating a transformer, an industrial controller and the software that manages it as completely separate security questions. That is particularly relevant to industrial control systems. The definition of covered equipment includes remote terminal units, programmable logic controllers, intelligent electronic devices, distributed control systems and safety instrumented systems, alongside transformers, generators, inverters, battery storage systems, protective relays, metering equipment and high-voltage circuit breakers. The order also allows agencies to consider software, firmware, remote access, update mechanisms and other supply-chain dependencies when deciding whether equipment falls within its security concerns. The geographical scope is also worth noting. The order defines the bulk-power system around interconnected transmission infrastructure and generation resources needed for grid reliability, including transmission lines rated at 69 kV or higher. Local electricity distribution facilities fall outside that definition. This isn’t only about equipment that companies might buy tomorrow. The Energy Secretary can also impose conditions on foreign-manufactured or foreign-operated equipment already installed before the order took effect. Depending on the risk, those measures could require operators to identify, isolate, monitor, secure, disconnect, replace or remove equipment. The order specifically requires officials to consider reliability, safety, the availability of secure replacements and continuity of essential services before demanding isolation or replacement. That last point is important because securing a power grid isn’t as simple as unplugging a suspicious device. Removing a component without a suitable replacement can itself create an operational problem. The order therefore leaves room for phased compliance and negotiated mitigation measures rather than assuming that every risky component can disappear overnight. The government also wants to avoid turning security screening into a permanent procurement bottleneck. The Energy Secretary can establish criteria for pre-qualified equipment and vendors, creating a list of products and suppliers that can receive exemptions from the baseline restrictions. At the same time, the order makes clear that pre-qualification doesn’t prevent the government from scrutinizing or restricting a transaction later if circumstances warrant it. The order doesn’t name a specific country as the target. Instead, it defines a Covered Foreign Entity broadly enough to include governments under certain U.S. arms embargoes or sanctions regimes, as well as entities that the relevant U.S. authorities determine are engaged in conduct detrimental to national security or foreign policy. SecurityWeek also noted that the structure resembles earlier Trump-era restrictions on foreign bulk-power equipment, including measures that previously focused on entities associated with China. The order does not mention any country by name. However, its structure is very similar to a 2020 Trump-era order on the U.S. power grid, which later led the Department of Energy to ban companies linked to China. The next phase will be regulatory rather than rhetorical. Within 120 days, the Energy Secretary is expected to issue rules or regulations needed to implement the order, including procedures for identifying covered entities, equipment and countries and for licensing transactions that would otherwise be prohibited. The administration also wants recommendations for changes to federal procurement rules that would give greater weight to national security risks and favor U.S.-manufactured energy infrastructure. Those procurement changes have their own timetable. The Energy Secretary has 180 days to develop recommendations for revisions to the Federal Acquisition Regulation, while the FAR Council would then have 90 days to consider proposing corresponding amendments for public comment. The policy fits into a wider push by the administration to reduce dependence on foreign supply chains for strategically important infrastructure. The Department of Energy said earlier this month that it is working to increase domestic production and availability of critical grid components, pointing to rapid growth in electricity demand and the need to strengthen the grid supply chain. For cybersecurity professionals, however, the most interesting part of the order isn’t the preference for domestic manufacturing. It’s the decision to treat supply-chain exposure, remote access and embedded technology as part of the attack surface of the power grid. That changes the question organizations need to ask about critical equipment. It’s no longer enough to know whether a device has a vulnerability today; operators also need to understand who made it, who controls the supplier, where critical software and firmware come from, who can remotely access the equipment, how updates reach it and what happens if that supply chain suddenly becomes unavailable. The uncomfortable reality is that a power grid compromise doesn’t necessarily begin with someone breaking through the perimeter of a utility network. It can begin much earlier, when an organization buys a component it can’t fully inspect, relies on a remote maintenance channel it doesn’t control, or becomes dependent on a supplier it can’t replace quickly. That’s the security problem Executive Order 14420 is trying to address. The White House has effectively moved part of the grid’s cyber defense line back into procurement, manufacturing and supply-chain decisions. And for critical infrastructure operators, that’s a much harder problem to solve than simply finding another firewall. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, power grid)
Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. The code injection vulnerability (CVE-2026-60004) targeted in these attacks was reported by Salesforce security researcher Shai Rod, and it allows authenticated attackers to execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches via the diffpatch API endpoint. While successful exploitation requires repository write access to repositories hosted on vulnerable servers, Gitea comes with self-registration enabled by default, allowing unauthenticated attackers to register an account, create a new repository, and trigger the vulnerability without prior credentials.
Hasbro, one of the world's largest toy and game companies, has disclosed that attackers have accessed the personal and financial information of an undisclosed number of employees. Founded in 1923, Hasbro is a publicly traded American multinational entertainment conglomerate on the NASDAQ and owns many brands, including Monopoly, Clue, Nerf, Transformers, Play-Doh, Peppa Pig, Scrabble, Magic: The Gathering, Dungeons & Dragons, and many others. The company has filed data breach notification letters with the Massachusetts Attorney General's Office, but didn't disclose the total number of affected individuals or when the incident was detected. "The information involved varied by individual but may have included your name and one or more additional personal information elements such as email, address, phone number, national ID number, or financial information," Hasbro said.
Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening. "This vulnerability gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which could be used to execute arbitrary Java code inside the application's
An Identity Fabric knits fragmented identity systems into a coherent layer that observes how identities behave across applications, APIs, and infrastructure. As enterprise access spans more cloud services and automated workloads, identity security depends less on static configuration and more on runtime visibility. This article covers the architecture, the risks of unmanaged identities, and
Australian police charged two men linked to TeamPCP over malware hidden in open-source code that stole 500,000+ credentials from 1,000+ organizations. Australian police have charged two men from Western Australia over a global cybercrime operation that allegedly hid malicious code in open-source software and used it to steal data from thousands of organisations. “Two West Australian men have been charged following a joint investigation between the AFP and Western Australia Police Force (WAPF), working in parallel with the Federal Bureau of Investigation (FBI), into a sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses.” states AFP. “The AFP charged the men yesterday (26 August, 2026) with a combined total of 14 offences after executing search warrants in Perth with WAPF, and the assistance of the FBI.” The Australian Federal Police, the Western Australia Police Force and the FBI executed search warrants in Perth on 26 August 2026 and arrested a 21-year-old from Cottesloe and a 23-year-old from Mandurah. They face a combined total of 14 charges covering unauthorised data modification, possession and supply of data for computer offences, and dealing with proceeds of crime. Police say the pair were principal participants in a syndicate known as TeamPCP, which allegedly inserted malicious code into software hosted on public repositories and then let other developers pull it in without knowing. Infected components ended up in systems across government, academia and the private sector, giving the group a way to steal credentials and other sensitive material at scale. “Parallel investigations started in April, 2026, after the AFP and FBI received information from multiple cyber threat assessment companies regarding a syndicate that allegedly inserted malicious code into software available on an open-source repository, which was then unwittingly used by other developers.” continues AFP. “Police will allege infected software was then distributed into computer systems at other organisations across government, academia and the private sector. The software allegedly enabled the syndicate to infiltrate those organisations to steal or harvest sensitive data, including user credentials and authentication materials.” The numbers are not small. Investigators estimate the malicious code potentially compromised more than 1,000 organisations worldwide, enabling the theft of over 500,000 credentials and the exfiltration of at least 300 gigabytes of data. Remediation costs so far run into the hundreds of millions of dollars. TeamPCP is behind multiple supply chain attacks, in the past, they targeted PyPI packages and NPM repositories, and most recently the “Mini Shai-Hulud” campaign also caught two OpenAI employees. The pattern is consistent: go after the tools developers trust, poison the supply chain, and let the downstream damage multiply. The confirmed list of modified tools includes Trivy, a widely used container vulnerability scanner; KICS, a static analysis tool for infrastructure-as-code; LiteLLM, a popular library for routing requests across AI model APIs; and the Telnyx Python SDK. These aren’t niche utilities. They’re commonly integrated into enterprise CI/CD pipelines, cloud infrastructure workflows, and security scanning processes. Hitting them means hitting a large number of organizations simultaneously through a single poisoned update. The group also deployed four distinct malware families. CanisterWorm harvested cloud access tokens, credentials, and API keys for AWS, GCP, and Azure. SANDCLOCK extracted AWS credentials, Kubernetes ServiceAccount tokens, local environment variables, and cryptocurrency wallet data. Mini Shai-Hulud was a self-replicating worm designed to spread across both npm and PyPI registries. Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files. The worm component is the part that deserves particular attention. Mini Shai-Hulud and its Miasma variant didn’t just infect the initial target and stop. They spread across open-source package registries autonomously, harvesting credentials and poisoning configuration files as they went. The FBI confirmed two GitHub repository names used for exfiltration: tpcp-docs and docs-tpcp. If either of those repository names appears in your GitHub organization, the worm created it using stolen credentials. TeamPCP’s method was straightforward and effective: inject malicious code into legitimate software packages, push the trojanized versions through normal distribution channels, and wait for CI/CD pipelines to pull them in automatically. The modified tools installed credential-stealing malware and persistent backdoors without any visible sign that anything had changed. “These men are allegedly members of the cybercriminal group TeamPCP, whose malicious code potentially compromised more than a thousand organizations worldwide,” Assistant Director Leatherman said. “We are proud to work with the Australian Federal Police and the Western Australia Police Force to impose cost on criminal actors and combat the growing threat of software supply-chain attacks.” The charges show how serious the alleged operation was. The 21-year-old faces several charges, including changing data without authorization, possessing and supplying data for computer crimes, failing to comply with a production order, and handling at least A$100,000 in criminal proceeds. The 23-year-old faces similar hacking charges, with maximum penalties ranging from three to 20 years. Police seized electronic devices and other items from properties in Cottesloe, Hamilton Hill and Mandurah. Investigators are now examining a large amount of data and have not ruled out further arrests or charges. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Australian authorities have arrested and charged two young men accused of being part of the TeamPCP hacking group linked to a string of far-reaching developer supply chain attacks. TeamPCP is a hacking group known for widespread supply-chain attacks over the past year that targeted open-source software and developer platforms to steal credentials, authentication secrets, and source code. High-profile attacks attributed to TeamPCP have impacted Trivy, LiteLLM, Telnyx, SAP, and TanStack packages, while the group has also breached the European Commission, Mistral AI, OpenAI, and GitHub. To carry out their attacks, the threat actors injected malicious code into software hosted on open-source repositories, which developers then unknowingly incorporated into their own applications on systems used by government, academic, and private-sector organizations.
Google Workspace breaches can begin with social engineering or forgotten third-party integrations rather than sophisticated exploits. This webinar examines real-world breaches, what happens during the critical first hours, and the security controls that can make the greatest difference.
The ShinyHunters extortion group has published sensitive data from nearly 13 million accounts stolen from clothing retailer giant Carhartt earlier this month, according to data breach notification service Have I Been Pwned. Founded in 1889, Carhartt is an American apparel company with workwear and streetwear manufacturing facilities in Kentucky and Tennessee and more than 3,000 employees in the United States and Europe. While Carhartt has yet to confirm the extortion group's claims or issue a statement about the breach, ShinyHunters claimed the attack on August 13 and said they allegedly stole more than 50GB of documents containing a wide range of customer, employee, and corporate data. "Millions of records of customer data and vast amount of sensitive information and PII containing employee, customer, customer metadata (royalty info), and other internal corporate data was compromised," the cybercrime gang said.
CISA urges water utilities to find and secure internet-exposed PLCs after July attacks showed how easily exposed industrial systems can be compromised. Over 100 internet-exposed systems in the US water and wastewater sector got hit by cyberattacks in July 2026, and CISA’s response wasn’t just an incident report, it was a how-to guide for making sure it doesn’t happen to you next. The agency’s exposure reduction guidance, published August 21, walks through exactly how organizations can find their own internet-facing weak points before an attacker does. The pattern behind the July attacks was surprisingly simple. Most of the affected systems were programmable logic controllers (PLCs), small industrial computers that control pumps and valves. Many connected directly to cellular modems and had no firewall or gateway between them and the internet. CISA warns that this type of setup can expose PLCs to serious security risks. “Directly connecting PLCs to the internet through cellular modems can create significant security risks. However, internet exposure reduction does not mean disabling necessary remote access; organizations should remove remote access when it is unnecessary and secure it when it is necessary.” states CISA. Hackers remotely accessed exposed PLCs, changed device IP addresses and passwords, and in some cases disabled shutdown processes and alarms, creating what CISA called unsafe conditions without notifying the operators running the actual equipment. Iran is the suspected actor behind much of this activity, likely tied to the ongoing war involving the US and Israel, though officials have stopped short of a formal attribution. CISA presents reconnaissance as an ongoing process. Organizations need to know which systems they expose to the internet and can use tools such as Shodan, Censys, or CISA’s Cyber Hygiene Vulnerability Scanning service to check their own IP ranges from the outside. The review should also cover ports used by industrial systems. Besides SSH, RDP, and HTTP, CISA highlights protocols such as Modbus, EtherNet/IP, DNP3, BACnet, and OPC UA. Finding one of these ports open does not automatically mean the system has been compromised, but it does indicate an exposure that needs to be investigated and addressed quickly. Where remote access is genuinely necessary, CISA’s advice is to route everything through a secure, centrally managed gateway rather than connecting straight to a PLC, HMI, or remote terminal unit. Pair that with phishing-resistant multi-factor authentication, unique credentials instead of shared defaults, and active monitoring of traffic in and out, and you’ve closed most of the gap that let this particular wave of attacks succeed in the first place. None of this is exotic security engineering; it’s the same basic hygiene that’s been recommended for years, just finally getting attention because attackers are actually using the gap. This isn’t an isolated incident CISA is responding to reactively, either. The water sector attacks sit inside a much larger pattern of nation-state interest in US and allied critical infrastructure, from China’s Volt Typhoon reportedly pre-positioning malware inside American infrastructure as a potential wartime disruption tool, to Russian-linked campaigns testing water and energy systems across Europe as part of broader pressure on NATO. If a foreign government is willing to spend years quietly waiting inside a power grid, an exposed PLC with a factory-default password isn’t a minor oversight, it’s an open invitation. “CISA urges all critical infrastructure organizations to route all necessary remote access through a secure gateway, firewall, VPN, or other centrally managed access solution, rather than connecting directly to a PLC, human-machine interface (HMI), or remote terminal unit (RTU).” concludes CISA. “The July 2026 malicious cyber activity targeting WWS Sector entities demonstrates the consequences of directly exposing PLCs to the internet. Threat actors remotely accessed internet-exposed PLCs, changed device IP addresses and passwords, and caused loss of monitoring and control functionality and, in some cases, operational disruptions.” If you run anything with the letters PLC, SCADA, ICS, or HMI in its job description, this guidance isn’t optional reading for next quarter. Go run the scan today, because the alternative is finding out the hard way that someone else already ran it for you. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Water Utilities)
Confirm this action.
Leaving now will discard your changes.