On June 3, 2026, the European Commission proposed the Cloud and AI Development Act (CADA)—the centerpiece of its new Tech Sovereignty Package. At its core: a four-tier model that public contracting authorities will use in the future to assess how sovereign a cloud provider truly is—not just where the data is located, but who owns […]
For the first time, attackers are exploiting unpatched vulnerabilities more often than they’re stealing credentials. According to Verizon’s 2026 Data Breach Investigations Report, vulnerability exploitation now accounts for 31% of breaches, ahead of credential theft at 13%. And the gap is moving in the wrong direction for defenders: the median time to fully patch a […]
Effective vulnerability management does not begin and end with scanning. To be effective, vulnerability management requires a solid understanding of both scanner technology and your IT infrastructure. Operationally, vulnerability management depends on having reliable and repeatable processes, well-defined ownership, integration with day-to-day IT operations, and strategic governance. Every organization exists at a different stage of […]
Update — 27 July 2026 The European Commission has approved its guidance on applying the CRA to open-source software (Communication C(2026) 5252 and Annex), finalizing what was still a draft when this post first went live. We’ve updated the post to match: the “commercial activity” test now turns on whether access to the software itself, […]
Time-sensitive This article focuses on the 11 September 2026 vulnerability reporting deadline — the first hard enforcement milestone under the Cyber Resilience Act. As of 27 August 2026, you have 15 days to prepare. Most companies treating the CRA as a 2027 problem are already behind. According to the 2026 CRA Awareness and Readiness Report […]
NIST Significantly Reduces Independent CVSS Scoring in the NVD For years, the routine has been the same. A new vulnerability appears, the security team checks the NVD, looks at the CVSS score, and decides: patch now or wait. A single number, produced by a U.S. federal agency, has become the pace-setter for millions of systems […]
Defenders deploying Ubuntu will be pleased to know that Greenbone’s OPENVAS SCAN now includes detection for Ubuntu 26.04 LTS security notices via the OPENVAS ENTERPRISE FEED and COMMUNITY FEED. Ubuntu 26.04 LTS, aka “Resolute Raccoon”, is a long-term support (LTS) version of Ubuntu that was released on April 23rd, 2026. LTS releases receive standard security […]
Defenders deploying Fedora will be pleased to know that Greenbone’s OPENVAS SCAN now includes detection for Fedora 44 security advisories via the OPENVAS ENTERPRISE FEED and COMMUNITY FEED. Fedora Linux 44 was released on April 28th, 2026, and releases are typically maintained for 13 months. Fedora 44 has been assigned an expected end-of-life (EOL) date […]
Until recently, a digital product could be placed on the European market with essentially no binding cyber security standard attached to it. Manufacturers decided how much security to build in, and buyers had no assurances and no way to compare. When vulnerabilities emerged, there was no legal obligation to report or fix them. Products could […]
A field report on open source, competition, enforcement of rights, and the question of how to defend a fair and sustainable open source ecosystem. Summary This report describes a real case of misuse of open source software using the example of OPENVAS, the open source vulnerability management system we developed. A market participant had systematically […]
