Standard
EU Regulation 2024/2847 requiring cybersecurity measures for digital products, including vulnerability handling and 24-hour exploit reporting.
Citrix has fixed two NetScaler ADC and Gateway flaws, each rated 9.5 out of 10, that attackers were exploiting before any patch existed. CISA wants owners to look for signs of compromise first because the update can erase the evidence, so the upgrade comes second.
Reality
From 11 September 2026, an actively exploited vulnerability starts a 24-hour early warning, a 72-hour notification and a 14-day final report, all timed from awareness. The artifact that decides whether you make it is your SBOM archive.
Reality
Air Security's Plugin4Shell lets a plugin be swapped during a background refresh while the agent reports the audited commit. Anthropic and OpenAI have patched, Copilot has no fix, and Google is retiring Gemini CLI.
Reality
Regulation (EU) 2024/2847 defines a product with digital elements to include the remote data processing its functions depend on, and it makes vulnerability handling an essential requirement for as long as the product is expected to be in use.
Reality
ENISA's Single Reporting Platform went live on 11 September 2026, the day manufacturers' Article 14 duty applied. The coordinating CSIRT is set by where a company is established, and open-source stewards have until December 2027.
Reality
The Commission's plain-language summary of Regulation (EU) 2024/2847 lays out staggered start dates for anyone shipping hardware or software into the EU, the earliest in June 2026 and the last in December 2027.
Reality
Politico reported that ENISA and CERT-EU ran an advanced OpenAI model over an EU project's code and got four fixed flaws out of it. Poland's CERT, doing the same kind of work, said it tested every hypothesis on real systems.
Reality
ENISA says in a July 2026 assessment that the research-and-develop delay defenders implicitly count on is disappearing as automated systems take over the attacker's work, with the remaining window measured in minutes.
Reality
The Cyber Resilience Act's reporting duties started binding manufacturers on 11 September 2026, and the first release of ENISA's portal has no API, so each report is typed into an English-language web form.
Reality
The Cyber Resilience Act does not fully apply until December 11, 2027, yet its Article 14 early warning binds 15 months earlier, starting from the moment a manufacturer is reasonably certain a product is being exploited.
Reality
The project says it will continue on legal advice it has not described. The code repository and the best-known public instance are verifiably back, and nothing has changed about the unofficial API that forces a rebuild every few months.
Reality
The pay market moved on the security chief within weeks of OpenAI's agents leaving their sandbox, while the budget that actually buys containment is still growing at its normal rate, with accountability landing before containment did.
Reality
Washington wants the G20 to reserve new AI regulation for novel considerations and to create no new oversight body, which lands as Europe enforces rules already on the books and Canada promises to argue back.
Reality
Records for about 5,000 applicants were encrypted and still exposed, because the key travelled in the API response. The warning about that API arrived a month early.
Reality
Archiving a project with a billion Docker pulls turned an object store into an audit finding. Docker's extended support does not remove the migration, it moves the deadline out to 2031.
Reality