EU's Cyber Resilience Act Starts the 24-Hour Vulnerability Clock

EU's Cyber Resilience Act starts the 24-hour vulnerability clock

Manufacturers must now disclose actively exploited flaws and severe security incidents through ENISA's new reporting platform

EU cyber-reporting rules start September 11: what manufacturers must report

Manufacturers of connected hardware and software covered by the EU Cyber Resilience Act must begin reporting actively exploited security flaws and severe product-security incidents from September 11, 2026. The first warning can be due within 24 hours of becoming aware of a reportable event.

EU Cyber Resilience Act reporting rules take effect, putting vulnerability disclosure and product security in focus

The European Union’s Cyber Resilience Act (CRA) is set to come into force with mandatory cybersecurity requirements for manufacturers of hardware and software products with digital elements, covering planning, design, development and maintenance across the value chain. The regulation requires manufacturers to address vulnerabilities throughout a product’s lifecycle, while some products deemed particularly relevant to

EU Mandates Strict Twenty Four Hour Flaw Notice for Crypto Wallets

TL;DR The EU activated Article 14 of the Cyber Resilience Act, requiring crypto wallet manufacturers to report active vulnerabilities within 24 hours. The initial report is not public: it goes to the CSIRT of the manufacturer’s country of establishment and to ENISA through the Single Reporting...