A diverse coalition of cyber notables that include top security pros and researchers from ESET, Rapid7, the Electronic Frontier Foundation, and Google’s Vint Cerf, have taken the European Union (EU) to task over requiring software publishers to disclose unpatched vulnerabilities to government agencies within 24 hours of exploitation. In an open letter to the EU, 56 cybersecurity leaders said the EU’s proposed one-day vulnerability disclosure requirement under the Cyber Resilience Act (CRA) means that dozens of government agencies would have access to a real-time database of software with unmitigated vulnerabilities without the ability to protect them.

Source: SC Magazine