--- title: The Open Source Question Coming Due in September | daily.dev description: The EU Cyber Resilience Act's first disclosure obligations take effect in roughly two months, requiring organizations to report actively exploited... canonical: https://daily.dev/posts/the-open-source-question-coming-due-in-september-qwyguy9vv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Open Source Question Coming Due in September | daily.dev og:description: The EU Cyber Resilience Act's first disclosure obligations take effect in roughly two months, requiring organizations to report actively exploited... og:url: https://daily.dev/posts/the-open-source-question-coming-due-in-september-qwyguy9vv og:image: https://api.daily.dev/og/posts/qWyguY9VV.png og:image:alt: The Open Source Question Coming Due in September og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Open Source Question Coming Due in September **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 5 min read · 0 upvotes · 0 comments ## Summary The EU Cyber Resilience Act's first disclosure obligations take effect in roughly two months, requiring organizations to report actively exploited vulnerabilities within 24 hours. Most organizations are unprepared because they rely on scanner reports rather than documented decision records. The core argument is that open source dependency governance is a business decision requiring written accountability — who approved a dependency, why, and what alternatives were considered — not just a technical scan. The PolinRider supply chain campaign (162 malicious artifacts across 108 packages, linked to North Korean actors) illustrates the scale of the threat. AI-generated code is accelerating the problem. IBM and Red Hat's Project Lightwell is cited as an example of where compliance readiness is heading, with SBOMs and vulnerability data sharing built in by default. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Open Source Is Free. Until Someone Comes to Collect.](https://daily.dev/posts/open-source-is-free-until-someone-comes-to-collect--slcvkc6o7) · Security Boulevard · 0 upvotes · 0 comments - [Making the Cyber Resilience Act Work for Open Source](https://daily.dev/posts/making-the-cyber-resilience-act-work-for-open-source-ri1ckviqk) · The New Stack · 0 upvotes · 0 comments - [EU rules on securing IT products could affect open source software users beginning this week](https://daily.dev/posts/eu-rules-on-securing-it-products-could-affect-open-source-software-users-beginning-this-week-loj2t8f8z) · InfoWorld · 1 upvotes · 0 comments - [Taking Stock of the State of European Cyber Resilience Act \(CRA\) Compliance: An Urgent Wake-up Call for the Open Source Ecosystem](https://daily.dev/posts/taking-stock-of-the-state-of-european-cyber-resilience-act-cra-compliance-an-urgent-wake-up-call--6yezrqnee) · Linux Foundation · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#supply-chain](https://daily.dev/tags/supply-chain), [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/the-open-source-question-coming-due-in-september-qwyguy9vv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Open Source Question Coming Due in September","url":"https://daily.dev/posts/the-open-source-question-coming-due-in-september-qwyguy9vv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-open-source-question-coming-due-in-september-qwyguy9vv"},"datePublished":"2026-07-22T14:31:22.743Z","dateModified":"2026-07-22T14:31:54.762Z","description":"The EU Cyber Resilience Act's first disclosure obligations take effect in roughly two months, requiring organizations to report actively exploited...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cf6a6d2fee815cb287f40a6187312934?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cf6a6d2fee815cb287f40a6187312934?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-open-source-question-coming-due-in-september-qwyguy9vv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,supply-chain,sbom","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"The Open Source Question Coming Due in September"}]} ```