News
This Week in SBOMs: OpenSSH's musl Hole, APT Swaps Packages, and the CRA Reporting Platform Hits v1.3
This is the third issue of This Week in SBOMs, covering Saturday 31 October to Friday 6 November 2026. Last week was about finding PHP and...
News
This Week in SBOMs: PHP2Shell Goes Live, Brotli Hides Behind Version Numbers, and Alpine's GitLab Scare
Welcome to the second issue of This Week in SBOMs, marking the first time we cover a standard seven-day period: Saturday 24 October to...
News
This Week in SBOMs: PHP2Shell, a Wave of Poisoned Releases, ENISA's SBOM Advisory and Germany's CRA Law
Welcome to the inaugural This Week in SBOMs, a weekly survey of developments within software security, regulation and standards, viewed...
Compliance
The CRA Single Reporting Platform Opens Tomorrow: What ENISA Actually Requires
Tomorrow, the Cyber Resilience Act’s reporting obligations stop being a date on a slide. From 11 September 2026, manufacturers of...
Announcement
Announcing sbomify v26.8.0: The One With Security Advisories
Most vulnerability tooling stops at the moment of discovery. You get a finding, a severity, maybe a fix version, and then you are on your...
Compliance
BSI TR-03183 Is Now Four Documents, and the CRA Clock Runs Out in Three Weeks
If you built your EU Cyber Resilience Act plan around a single BSI document, it is out of date. Not because the SBOM requirements changed,...
Announcement
Announcing sbomify v26.3.0: The One That Ditches the Token
The headline of v26.3.0 is about getting rid of something: the long-lived API token sitting in your CI secrets. With GitHub Actions OIDC...
Announcement
Announcing sbomify v26.2.0: The One That Signs the DoC
In v26.1.0 we shipped the first half of the EU Cyber Resilience Act workflow: figuring out whether you are in scope, and what you need to...
Announcement
Announcing sbomify v26.1.0: The One Where We Switch to CalVer
If you have been following along, you may have noticed the version number just made a fairly dramatic jump, going from v0.27 straight to...
Podcast
CRA Explained: What the Cyber Resilience Act Means for Device Manufacturers
The EU Cyber Resilience Act (CRA) is transforming how device manufacturers approach cybersecurity. To break down what this means in...