The EU Cyber Resilience Act's 24-hour clock started on 11 September: who it covers, and a free way to check your dependencies

The EU Cyber Resilience Act's 24-hour vulnerability reporting duty is live. Who it covers (games, apps, desktop software, plugins), who it does not (most SaaS), what 'actively exploited' means, and a 40-line check against OSV.dev and CISA KEV.