Topic
A structured inventory of a software product's components, often in CycloneDX or SPDX format, used for supply-chain security and compliance.
Grid-tech vendors have had to report actively exploited vulnerabilities and severe incidents under the EU Cyber Resilience Act since 11 September 2026. SBOMs and vulnerability handling become mandatory on 11 December 2027.
Reality
EU Cyber Resilience Act rules have required connected-product makers to report exploited flaws through ENISA within 24 hours since 11 September 2026. One incident can also start DORA, NIS2 and GDPR clocks, so runbooks need a triage step that splits into parallel filings.
Reality
OpenChain released Automotive SBOM Framework 1.0 on October 7, fixing the fields a software inventory must carry between automakers and suppliers. Whether it helps depends on every supplier tier filling those fields the same way in real exchanges.
Reality
Syft and Trivy reported 43.78% and 32.71% of lockfile packages across 2,050 JavaScript repositories in an Inria and ANSSI study, against 98.72% for cdxgen. The tool, its version and its flags decide what an SBOM lists, so that recipe belongs under version control.
Reality
TECH VEDA counts 36 actionable device CVEs across 14 non-kernel packages in September, two of them Chromium V8 bugs on CISA's exploited list. How many apply to a given fleet depends on each image's SBOM and on which scorer a team trusts.
Reality
From 11 September 2026, an actively exploited vulnerability starts a 24-hour early warning, a 72-hour notification and a 14-day final report, all timed from awareness. The artifact that decides whether you make it is your SBOM archive.
Reality
Swift Build became the default in Swift Package Manager with the September 15 release, so the engine under every package changed even for teams adopting none of 6.4's interop work. Everything else in the release waits for a source edit.
Reality
Two or three of the 95 were genuine, and reviewers had to read all of them to find out. The EU's 24-hour ENISA clock starts on September 11, 2026, and only evidence of active exploitation starts it.
Reality
"Use .h5 or .keras instead of pickle" is not a mitigation. Scanning pipelines built on the pickle-only model of executable artifacts have a hole in them.
Reality