Topic: vulnerability-management
-
Preparing a manufacturer's CRA vulnerability workflow: intake, evidence and reporting clocks
A proposed preparation protocol connects vulnerability intake and component records to the CRA reporting decision. It separates the reporting duty already applicable in 2026 from the wider vulnerability handling requirements applicable in December 2027.
-
CRA reporting since September 2026: triggers, deadlines and the Single Reporting Platform
The CRA requires manufacturers to report actively exploited product vulnerabilities and severe product security incidents. Both have 24-hour and 72-hour stages, but their final reports run from different events.
-
Confirming a security patch actually landed: matching installed versions against vendor advisories across OS families
An update job reporting success is not proof a specific vulnerability is fixed; matching the installed package or build version against the vendor's own advisory — Ubuntu USN, a RHEL-family advisory (RHSA on RHEL) via dnf updateinfo --security, Debian DSA via debsecan, Windows Get-HotFix, or a macOS build number against Apple's own security-release page — is what closes the loop, and a pending restart can leave the old, vulnerable binary still running even after that check passes.
-
Swiss cyberattack reporting and the CRA: different duties for operators and product manufacturers
Swiss critical-infrastructure reporting concerns qualifying cyberattacks on covered operators. The CRA concerns product manufacturers supplying the EU market, including Swiss manufacturers; similar early deadlines do not make the recipients or reporting triggers interchangeable.
-
CRA and open source: distinguishing contributors, manufacturers and stewards
An open-source licence does not by itself determine CRA duties. The regulation distinguishes commercial product supply, contributions to software outside a contributor's responsibility, and sustained support by open-source software stewards, whose Article 24 duties start in December 2027.
Machine-readable: JSON