Technology

Executive Order 14409, signed June 2, 2026, directs NIST and the NSA to finalize a voluntary framework by August 1 requiring frontier AI developers to give the federal government up to 30 days of pre-release model access. Five companies have signed CAISI evaluation memoranda so far: OpenAI, Anthropic, Google DeepMind, Microsoft, and xAI. Meta, despite having signed both the 2023 White House commitments and the 2024 Seoul commitments, has not agreed to a CAISI memorandum as of late June 2026, making it the most visible test of a framework that carries no legal enforcement mechanism.

CISA's July 7, 2026 advisory batch disclosed two ICS vulnerabilities with sharply different risk profiles: CVE-2026-10763 in Hitachi Energy PROMOD V scores 7.1 on CVSS and is remotely exploitable via unencrypted HTTP in software embedded across North American ISO and RTO market operations for over fifty years, while CVE-2026-48192 in Siemens Mendix Studio Pro scores 5.4 and requires a user to open a malicious file on a local development workstation. Neither CVE appears in CISA's Known Exploited Vulnerabilities catalog, meaning federal remediation deadlines under BOD 26-04 do not apply, but the PROMOD V flaw's network attack vector and deep integration into production-cost modeling and energy-trading workflows make it a priority item for the next available OT maintenance window. Patches are available from both vendors: PROMOD V 1.0.11 plus HTTPS configuration on the third-party Digipede server component, and Mendix Studio Pro V10.24.21 or V11.6.7.