#security
4 posts tagged #security.
Read what the EU CRA reporting rules say, now that they apply
Reporting of actively exploited vulnerabilities and severe incidents under the EU Cyber Resilience Act has applied since 11 September 2026. This post quotes the 24 hour, 72 hour and final report deadlines from Article 14, says what the text says about open-source software stewards, and reads the Declaration of Conformity that Qt ships with commercial Qt 6.12 LTS. It is not legal advice.
What a C++ team can actually point at when asked about memory safety
The question now arrives in procurement paperwork rather than in conference talks, and C++26 shipped without the profiles that were supposed to answer it. What exists today is less impressive and more useful: a hardened standard library measured at a fraction of a percent, sanitizers in CI, and warnings that catch the class of bug being asked about.
Chrome fixed 1,072 security bugs in two releases and 97% of its code is span-clean
Chrome 149 and 150 fixed more security bugs than the previous 23 milestones combined, and 97% of first-party Chrome code now compiles cleanly under strict unsafe-buffer warnings. The strategy is worth reading closely: harden C++ aggressively, migrate selectively, and admit openly that runtime mitigations are approaching diminishing returns.
C++ Safety State of the Union: May 2026
C++ in May 2026 has four conversations running at once: regulators (CISA, EU CRA) demanding memory-safety roadmaps; the committee fighting over how to respond (Hagenberg vote 19 profiles / 9 Safe C++ / 11 both); what actually shipped in C++26 (P2900 contracts, P3471 hardened stdlib, P2996 reflection); and what the industry actually deployed (Chrome MiraclePtr -57% UAF, Google's 0.3% perf-cost data, Apple libc++ safe-buffers). They don't talk to each other in public. This essay wires them. Pre-Brno (8-13 June) reading.