Loading story…
The European Commission proposed a new Cybersecurity Package that would tighten security requirements for telecommunications networks by mandating the removal of high-risk suppliers from sensitive ICT and mobile network infrastructure and by strengthening EU-wide defenses against state-backed and cybercrime threats targeting critical infrastructure. The proposal would move beyond the uneven, voluntary adoption of the EU’s 2020 5G Security Toolbox by giving the Commission greater authority to coordinate EU-wide risk assessments, support restrictions or bans on certain equipment, and drive joint risk assessments across the EU’s 18 critical sectors, including consideration of suppliers’ countries of origin and national security implications.
Separately, ETSI published ETSI EN 304 223, a new European standard defining baseline cybersecurity requirements for AI models and systems (including deep neural networks and generative AI) intended for real-world deployment. The standard frames AI as a distinct security domain and addresses AI-specific risks such as data poisoning, model obfuscation, and indirect prompt injection, organizing requirements across five lifecycle phases: secure design, development, deployment, maintenance, and end-of-life; it is positioned as a shared baseline for vendors, integrators, and operators across the AI supply chain.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The European Commission proposed new EU cybersecurity legislation to strengthen telecom and critical infrastructure security, including measures to remove or restrict high-risk suppliers. The package would expand EU-wide risk assessments, revise the Cybersecurity Act, and broaden ENISA's role in threat alerting, incident reporting, and ransomware response support.
ETSI released European Standard EN 304 223, establishing baseline cybersecurity requirements for AI models and AI systems used in real-world operations. The standard defines 13 principles across secure design, development, deployment, maintenance, and end-of-life, and addresses AI-specific risks such as data poisoning and indirect prompt injection.
The EU introduced the voluntary 5G Security Toolbox, encouraging member states to reduce reliance on high-risk vendors in telecommunications networks. Later reporting said implementation across member states was uneven.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Commission proposed revisions to the **EU Cybersecurity Act** aimed at strengthening EU-wide cybersecurity certification, tightening **ICT supply-chain risk management**, and improving protections for critical infrastructure, including measures affecting European **mobile telecommunications networks**. The changes are positioned to raise baseline security expectations for products and services used across the EU and to increase scrutiny of supply-chain dependencies in sensitive sectors. The proposed direction has also triggered geopolitical and industry pushback tied to potential **supply-chain restrictions**: reporting highlighted warnings from EU cyber leadership that Europe’s defenses are lagging, alongside China’s stated intent to take “necessary measures” to protect firms such as **Huawei** if the EU imposes new restrictions. Together, the coverage indicates the revised Act is not only a technical certification and resilience effort but also a policy lever likely to affect vendor access and procurement decisions in European critical and telecom infrastructure.
Jun 29, 2026
The European Commission unveiled a revised **EU Cybersecurity Act** proposal that would allow the bloc to identify and potentially exclude **“high-risk” suppliers**—including those deemed vulnerable to *third-country influence*—from critical digital infrastructure across **18 essential sectors**. The proposal also aims to streamline and accelerate EU-wide cybersecurity certification, reflecting a shift toward treating supply-chain security as both a technical and **geopolitical** risk-management issue. Reporting highlighted that the proposal, while not naming countries, is widely viewed as targeting Chinese vendors and supply dependencies—particularly around **network equipment** and connected energy technologies such as **solar inverters** that may connect to cloud services and create potential access paths into the energy grid. Separate coverage of the same Commission initiative noted plans to expand **ENISA’s** mandate, including closer operational cooperation with national authorities to help counter threats such as **ransomware**, but emphasized that the proposal still requires negotiation and approval by the European Parliament and member states before it can take effect.
Jun 29, 2026
The European Commission is pursuing revisions to the EU Cybersecurity Act to strengthen **union-level supply-chain risk management** for critical IT and telecom infrastructure, including the ability to impose targeted mitigations such as restrictions or bans on components from **“high-risk suppliers.”** Reporting indicates the proposal could effectively force member states to remove non-compliant equipment within a relatively short window—potentially **as little as three years**—as part of a broader effort to counter increasingly sophisticated hybrid threats to European infrastructure. The initiative is widely viewed as an attempt to harmonize and accelerate national actions that have been uneven across the bloc, amid long-running concerns about reliance on vendors such as **Huawei** and **ZTE** in 5G and other network deployments. The Commission’s approach emphasizes coordinated risk assessments and common rules for supplier trust decisions, reflecting ongoing debate over whether certain third-country suppliers could be compelled—via domestic legal obligations—to support state espionage or disruption operations, despite vendor denials of wrongdoing.
Jun 29, 2026