Standard
EU regulation requiring cybersecurity standards for hardware and software sold in the EU, with 24-hour reporting of exploited flaws.
AWS says teams can sign binaries, container images and SBOMs with ML-DSA today, using KMS, Private CA and IAM Roles Anywhere. CNSA 2.0 mandates exclusive quantum-resistant software signatures by 2030, and AWS dates the EU CRA's full effect to December 2027.
Reality
EU Cyber Resilience Act rules have required connected-product makers to report exploited flaws through ENISA within 24 hours since 11 September 2026. One incident can also start DORA, NIS2 and GDPR clocks, so runbooks need a triage step that splits into parallel filings.
Reality
Linux Foundation Europe's Thierry Carrez said at the Open Source Summit in Prague that switching to open source alone will not end Europe's dependence. European groups supply 15% of governance participation, The Stack reported, so teams that switch adopt projects governed mostly from outside Europe.
Reality
OpenSSF published CRA readiness guidance for manufacturers that have owed 24-hour warnings on exploited vulnerabilities since September 11. Open-source stewards do not start reporting until December 2027, so for 15 months the duty sits with product teams alone.
Reality
The Cyber Resilience Act's vulnerability reporting duties are already in force, well before the December 2027 date that governs most of the regulation, and they sit alongside five other disclosure regimes whose clocks start differently.
Perspective Coverage
5 publishersReality
Syft and Trivy reported 43.78% and 32.71% of lockfile packages across 2,050 JavaScript repositories in an Inria and ANSSI study, against 98.72% for cdxgen. The tool, its version and its flags decide what an SBOM lists, so that recipe belongs under version control.
Reality
TECH VEDA counts 36 actionable device CVEs across 14 non-kernel packages in September, two of them Chromium V8 bugs on CISA's exploited list. How many apply to a given fleet depends on each image's SBOM and on which scorer a team trusts.
Reality
EU Cyber Resilience Act manufacturers have had to report actively exploited vulnerabilities since September 11, before broader duties arrive in December 2027. The New Stack argues those reports hold up only if engineers can already name the affected versions, components and fixes.
Reality
BH Consulting launched BH Haven, a four-tier SME service in which a proprietary AI tool drafts findings and consultants approve them. CEO Brian Honan said using AI internally does not move the firm's contractual responsibility for a missed gap onto the software.
Reality
EU Cyber Resilience Act rules have required 24-hour ENISA warnings on exploited flaws in commercial container images since Sept. 11, 2026. Vendors of supported Kubernetes operators and Helm charts are on the same clock, well before the rest of the law is enforced in December 2027.
Reality
watchTowr says attackers exploited two remote code execution flaws in Citrix NetScaler ADC and Gateway before any fix existed. The August patch for CVE-2026-19490 fixes a different bug, so every operator now has to decide whether to keep the box online and whether to assume it is breached.
Perspective Coverage
3 publishersReality
CERT Polska dated successful attacks to at least September 2 and published its warning on September 5, so operators who deferred the RouterOS update have three days of configuration changes to read as well as a patch to install.
Perspective Coverage
8 publishersReality
Microsoft fixed 974 flaws in September and two were already under attack, but both need an attacker who is already on the machine, while the twenty bugs Dustin Childs classes as wormable need no login at all.
Reality
Administrator access on Mathspace's self-hosted reporting tool needed no login, and the week's other exposures sat in an unclaimed Elasticsearch cluster and inside an AI provider's shared package cache.
Reality
Two or three of the 95 were genuine, and reviewers had to read all of them to find out. The EU's 24-hour ENISA clock starts on September 11, 2026, and only evidence of active exploitation starts it.
Reality
The provenance on @7nohe/openapi-react-query-codegen was accurate about every question it was built to answer, which is why the Docker Security Dispatch reaches instead for a five-day resolution cooldown that npm ci does not apply.
Reality
The EU Cyber Resilience Act starts the notification clock the moment a manufacturer learns a flaw is being exploited, making SBOM accuracy an operational deadline as much as a compliance requirement.
Reality
EU Cyber Resilience Act enforcement starts in September with personal liability for security leaders written in, according to JFrog, so the lag between an auditor's request and the proof now has a named owner.
Reality
Manufacturers selling into the EU owe a regulator notice within 24 hours of learning that a product flaw is being exploited, while the design rules that would produce the records needed to answer arrive 456 days later.
Reality
Traefik Labs argues most CVEs in a container come from the OS packaging around the application, not the application. Its pitch is attack surface reduction rather than faster detection.
Reality