On this page (6 sections)
On 11 September 2026 the first obligations of the European Cyber Resilience Act (CRA) began to apply, specifically Article 14. It requires reports of actively exploited vulnerabilities and severe security incidents, on tight deadlines. Patchstack, a WordPress security company, published an explainer the same day and announced a managed reporting service for maintainers.
If you sell or maintain a plugin, theme, library or any software offered in the EU, this affects you directly. If you only run websites, it affects how quickly you may hear about exploited flaws in the software you depend on. Everything below comes from a single Patchstack article, which is also a vendor announcing its own service, so treat the legal summary as one company's reading and check the regulation text for your own case.
What Article 14 requires
According to Patchstack, manufacturers of software and connected products must report two things: vulnerabilities that attackers are actively exploiting, and severe security incidents affecting their products. Reports go through a single EU platform to national cybersecurity authorities and the EU cybersecurity agency ENISA. Manufacturers must also tell affected users what happened and how to protect themselves.
Patchstack stresses that Article 14 applies to all products and software, even those first made available on the European market before 11 September 2026.
Reporting deadlines
| Stage | Deadline | Content |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Initial alert about the actively exploited vulnerability or severe incident |
| Notification | Within 72 hours of becoming aware | General information and an initial assessment |
| Final report (exploited vulnerability) | No later than 14 days after a corrective measure such as a patch is available | Detailed final report |
| Final report (severe incident) | Within one month after the 72-hour notification | Detailed final report |
Who counts as a manufacturer or a steward
Patchstack uses WordPress plugins as its example. A GPL-licensed plugin that also has a premium version, or any other way to earn money for its maintainer, makes the seller a manufacturer. A fully free plugin with no commercial intent, maintained by employees of a legal entity, would be an open-source steward.
Both groups carry Article 14 obligations. The difference Patchstack points out is that stewards cannot be fined, though the EU can still use other means to remove a non-compliant product from the European market. The company adds that this applies across all open-source ecosystems, not only WordPress.
The practical hurdle: the reporting platform
Patchstack says reports must be filed on the EU Single Reporting Platform. Maintainers first need a personal EU Login account, and multi-factor authentication is required to access the platform. It also states that the platform has no API and that three separate forms must be completed manually for each report.
With a 24-hour clock, the practical point is simple: do not wait for an incident to discover you cannot log in.
Patchstack's managed service
Patchstack announced a platform, described as free to access with an asterisk the excerpt does not explain, in which it acts as an Assigned Representative for open-source maintainers. It says it tracks active exploitation of individual vulnerabilities, collects evidence and notifies the maintainer once Article 14 requirements apply. The source excerpt is cut off, so the full feature list, conditions and any limits of the free tier are not confirmed here. Patchstack also says it has coordinated more than 50% of known WordPress ecosystem vulnerabilities, which is its own claim.
Only one publisher covers this so far, and it is the vendor selling the service. Evaluate it like any commercial offer.
What to do now
For maintainers and vendors:
0 of 6 done
For site owners and agencies:
0 of 4 done
Monitoring after the rules take effect
Expect more formal notices from vendors about exploited flaws, but do not assume they will arrive before attackers act. A 24-hour early warning goes to authorities first, and the sources do not say how quickly users are informed beyond the duty to tell them. Keep your own routine: review known plugin vulnerabilities, follow the WordPress security checklist and run regular scans with Webforta Scan to see what your site exposes from the outside.
For ongoing coverage of security news that affects site owners, browse the Webforta blog.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.