How to find, triage, and report vulnerabilities under the CRA. SBOM generation, CVE triage, VEX statements, coordinated disclosure, and the 24-hour early-warning notification required from 11 September 2026.
ENISA's July 2026 frontier AI paper: exploitation at machine speed. 5 consequences for Cyber Resilience Act manufacturers, from CVD floods to patch diffing.
ENISA onboards its first CVE Numbering Authorities: what 4 new CNAs and 7 transfers mean for the CRA Article 14 reporting chain before 11 September 2026.
ENISA's Secure by Design and Default Playbook (final v1.0, July 2026) turns CRA rules into 22 practical checklists for SMEs, now also on GitHub.
Generate a firmware SBOM using Yocto, Buildroot, EMBA, or Syft. ENISA vulnerability reporting starts September 11, 2026. Step-by-step workflows for CRA compliance.
Set up security.txt at /.well-known/security.txt: Contact, Expires, a copyable example and the CRA technical file link.
A hands-on guide to generating Software Bills of Materials for CRA compliance. Covers open-source tools, format selection, and automated pipeline integration.
Get notified when we publish new articles about CRA compliance and product security.
