60
60
60
60
60
60
60
60
60
60
60
EU's Cyber Resilience Act starts the 24-hour vulnerability clock
EU Cyber Resilience Act reporting rules take effect, requiring manufacturers to disclose actively exploited vulnerabilities to ENISA within 24 hours, with fines reaching €15 million.
The Cyber Resilience Act's Article 14 mandatory reporting duties became applicable, requiring makers of products with digital elements sold in the EU — regardless of where they are based — to file an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a detailed notification within 72 hours, and a final report within 14 days of releasing a fix. Reports must be submitted through ENISA's Single Reporting Platform to the designated CSIRT, and non-compliance with these core duties can trigger fines up to €15 million or 2.5 percent of annual turnover. Manufacturers must also inform affected users of available fixes without undue delay, and most remaining CRA provisions, including mandatory SBOMs and security-by-design requirements, become applicable on December 11, 2027.
80
60
60
60
60
60
Week in review: Actively exploited Windows SMB flaw, trusted OAuth apps turned into cloud backdoors
60
60
60
60
60
60
60
60
Week in review: Palo Alto Networks firewalls under attack, Microsoft patches two exploited zero-days
60
Week in review: Malware delivery via Microsoft Teams, law firms under cyberattack, CVSS 4.0 is out
60
Week in review: Patch Tuesday forecast, 9 free ransomware guides, Cybertech Europe 2023
60
60
60
60
60
Week in review: Microsoft patches zero-day, Apple security updates, HashiCorp Vault vulnerability
60
60
60
60
60
60
60
60