Loading story…
The European Commission proposed revisions to the EU Cybersecurity Act aimed at strengthening EU-wide cybersecurity certification, tightening ICT supply-chain risk management, and improving protections for critical infrastructure, including measures affecting European mobile telecommunications networks. The changes are positioned to raise baseline security expectations for products and services used across the EU and to increase scrutiny of supply-chain dependencies in sensitive sectors.
The proposed direction has also triggered geopolitical and industry pushback tied to potential supply-chain restrictions: reporting highlighted warnings from EU cyber leadership that Europe’s defenses are lagging, alongside China’s stated intent to take “necessary measures” to protect firms such as Huawei if the EU imposes new restrictions. Together, the coverage indicates the revised Act is not only a technical certification and resilience effort but also a policy lever likely to affect vendor access and procurement decisions in European critical and telecom infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The European Commission proposed revisions to the EU Cybersecurity Act to strengthen EU-wide cybersecurity certification, improve ICT supply chain risk management, and bolster protections for critical infrastructure including mobile telecommunications networks.
The EU's cyber chief publicly warned that Europe's cyber defenses were lagging significantly behind attackers, highlighting growing concern over the bloc's cybersecurity posture.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Commission is pursuing revisions to the EU Cybersecurity Act to strengthen **union-level supply-chain risk management** for critical IT and telecom infrastructure, including the ability to impose targeted mitigations such as restrictions or bans on components from **“high-risk suppliers.”** Reporting indicates the proposal could effectively force member states to remove non-compliant equipment within a relatively short window—potentially **as little as three years**—as part of a broader effort to counter increasingly sophisticated hybrid threats to European infrastructure. The initiative is widely viewed as an attempt to harmonize and accelerate national actions that have been uneven across the bloc, amid long-running concerns about reliance on vendors such as **Huawei** and **ZTE** in 5G and other network deployments. The Commission’s approach emphasizes coordinated risk assessments and common rules for supplier trust decisions, reflecting ongoing debate over whether certain third-country suppliers could be compelled—via domestic legal obligations—to support state espionage or disruption operations, despite vendor denials of wrongdoing.
Jun 29, 2026
The European Commission unveiled a revised **EU Cybersecurity Act** proposal that would allow the bloc to identify and potentially exclude **“high-risk” suppliers**—including those deemed vulnerable to *third-country influence*—from critical digital infrastructure across **18 essential sectors**. The proposal also aims to streamline and accelerate EU-wide cybersecurity certification, reflecting a shift toward treating supply-chain security as both a technical and **geopolitical** risk-management issue. Reporting highlighted that the proposal, while not naming countries, is widely viewed as targeting Chinese vendors and supply dependencies—particularly around **network equipment** and connected energy technologies such as **solar inverters** that may connect to cloud services and create potential access paths into the energy grid. Separate coverage of the same Commission initiative noted plans to expand **ENISA’s** mandate, including closer operational cooperation with national authorities to help counter threats such as **ransomware**, but emphasized that the proposal still requires negotiation and approval by the European Parliament and member states before it can take effect.
Jun 29, 2026
The European Commission proposed a new **Cybersecurity Package** that would tighten security requirements for telecommunications networks by mandating the removal of **high-risk suppliers** from sensitive ICT and mobile network infrastructure and by strengthening EU-wide defenses against state-backed and cybercrime threats targeting critical infrastructure. The proposal would move beyond the uneven, voluntary adoption of the EU’s 2020 *5G Security Toolbox* by giving the Commission greater authority to coordinate **EU-wide risk assessments**, support restrictions or bans on certain equipment, and drive joint risk assessments across the EU’s **18 critical sectors**, including consideration of suppliers’ countries of origin and national security implications. Separately, ETSI published **ETSI EN 304 223**, a new European standard defining baseline cybersecurity requirements for **AI models and systems** (including deep neural networks and generative AI) intended for real-world deployment. The standard frames AI as a distinct security domain and addresses AI-specific risks such as **data poisoning**, **model obfuscation**, and **indirect prompt injection**, organizing requirements across five lifecycle phases: secure design, development, deployment, maintenance, and end-of-life; it is positioned as a shared baseline for vendors, integrators, and operators across the AI supply chain.
Jun 29, 2026