# Cra articles ## Pages - [This Week in SBOMs: OpenSSH's musl Hole, APT Swaps Packages, and the CRA Reporting Platform Hits v1.3](https://sbomify.com/2026/11/06/this-week-in-sboms-2026-11-06/) (2026-11-06): SBOM news for 31 October to 6 November 2026: the OpenSSH 10.6p2 password bypass on musl systems (CVE-2026-123158), the APT man-in-the-middle flaw CVE-2026-109518, zlib 1.4 and libexpat 2.10.0, ENISA's SRP v1.3 and secure-update advisory, MAS's cryptographic inventory proposal, and a quiet week for SPDX, CycloneDX and PURL releases. - [This Week in SBOMs: PHP2Shell Goes Live, Brotli Hides Behind Version Numbers, and Alpine's GitLab Scare](https://sbomify.com/2026/10/30/this-week-in-sboms-2026-10-30/) (2026-10-30): SBOM news for 24 to 30 October 2026: PHP2Shell added to CISA KEV and exploited in firewalls, the Brotli CVE-2026-111497 KEV entry and PHP's rebuilt Windows packages, the attempted GitLab exploit at Alpine Linux, a quiet week for the CRA and NIS2, NIST IR 8547 final, CISA 2030, and steady work on SPDX, CycloneDX and PURL. - [This Week in SBOMs: PHP2Shell, a Wave of Poisoned Releases, ENISA's SBOM Advisory and Germany's CRA Law](https://sbomify.com/2026/10/23/this-week-in-sboms-2026-10-23/) (2026-10-23): A month of SBOM news, 22 September to 22 October 2026: the PHP2Shell RCEs, LiteLLM and other poisoned releases, compromised eMudhra CA keys, the ENISA Technical Advisory for SBOMs, national CRA implementation laws in Germany, Italy and France, ENISA SRP updates, NIS2 reporting reshaped by the Digital Omnibus, PURL and VERS approved by Ecma TC54, CycloneDX 2.0 proposals. - [The CRA Single Reporting Platform Opens Tomorrow: What ENISA Actually Requires](https://sbomify.com/2026/09/10/cra-single-reporting-platform-enisa-srp/) (2026-09-10): ENISA's CRA Single Reporting Platform goes live on 11 September 2026 with Article 14 reporting obligations. Registration, Assigned Representative roles, the 24/72-hour clocks, CSIRT selection, and the fields you will be typing. - [Announcing sbomify v26.8.0: The One With Security Advisories](https://sbomify.com/2026/08/25/announcing-sbomify-v26-8-0-the-one-with-security-advisories/) (2026-08-25): sbomify v26.8.0 adds full security advisory publishing with per-product gating, a rebuilt Trust Center, patch SLA targets and CRA KPIs, formal risk acceptance, malicious package detection, CSV evidence exports, and a new brand. - [BSI TR-03183 Is Now Four Documents, and the CRA Clock Runs Out in Three Weeks](https://sbomify.com/2026/08/20/bsi-tr-03183-four-parts-cra-update/) (2026-08-20): BSI published TR-03183-1 in version 1.0.0 on 31 July 2026, completing a four-part CRA guideline family. Here is what changed across TR-03183, the Commission's July 2026 guidance, and the ENISA Single Reporting Platform before 11 September. - [Announcing sbomify v26.3.0: The One That Ditches the Token](https://sbomify.com/2026/06/12/announcing-sbomify-v26-3-0-the-one-that-ditches-the-token/) (2026-06-12): sbomify v26.3.0 adds GitHub Actions OIDC trusted publishing so you can push SBOMs with no long-lived API token, expires personal access tokens by default, removes the Project layer, and ships a broad security and access-control hardening pass. - [Announcing sbomify v26.2.0: The One That Signs the DoC](https://sbomify.com/2026/05/13/announcing-sbomify-v26-2-0-the-one-that-signs-the-doc/) (2026-05-13): sbomify v26.2.0 completes the EU CRA workflow with a signed Declaration of Conformity, adds Component Lifecycle Events, SBOM signatures and provenance, and full CycloneDX 1.7 / SPDX 3.0.1 support. - [Announcing sbomify v26.1.0: The One Where We Switch to CalVer](https://sbomify.com/2026/04/02/announcing-sbomify-v26-1-0-the-one-where-we-switch-to-calver/) (2026-04-02): sbomify v26.1.0 introduces the CRA Compliance Wizard, switches to CalVer versioning, adds Trust Center subdomain routing, and brings full TEA v0.4.0 compatibility. - [CRA Explained: What the Cyber Resilience Act Means for Device Manufacturers](https://sbomify.com/2026/01/06/cra-explained-cyber-resilience-act-for-device-manufacturers/) (2026-01-06): Podcast episode with EU CRA expert Sarah Fluchs explaining SBOM requirements, the 5-year support mandate, and vulnerability management for device manufacturers. --- From sbomify: https://sbomify.com/tags/cra/