Manufacturers selling products with digital elements in the EU must now report actively exploited vulnerabilities to cybersecurity authorities under the Cyber Resilience Act’s mandatory reporting rules.

The reporting duties set out in Article 14 of the CRA became applicable today. Subject to the regulation’s exemptions, they apply to manufacturers of products with digital elements made available in the EU, regardless of where those manufacturers are based.

Manufacturers must submit an early warning within 24 hours of becoming aware of an actively exploited vulnerability, followed by a more detailed notification within 72 hours.

The same deadlines apply to severe incidents affecting the security of products with digital elements.

The only difference in timing is related to the final report. Manufacturers must provide a final report on an actively exploited vulnerability within 14 days of making a corrective or mitigating measure available. For serious incidents, the final report is due one month after the first report.

Darren Anstee, CTO for security at Netscout, said the reporting deadlines introduce much-needed urgency in working toward global cyber resilience.

“The 24-hour window in which an initial warning must be reported creates a level of urgency, with subsequent deadlines ensuring that the gathering and release of additional information is prompt,” he said.

“Better, more rapid sharing of information helps organisations put defences and mitigating controls in place when they know there is heightened risk.”

EU and non-EU manufacturers must file these reports through ENISA’s Single Reporting Platform (SRP).

Notifications are addressed to the coordinating computer security incident response team (CSIRT) determined under the CRA. For an EU manufacturer, this is generally the CSIRT for the member state where it has its main establishment; separate rules determine the coordinator for manufacturers based outside the bloc.

Manufacturers must also inform affected users, where appropriate, about actively exploited vulnerabilities or severe incidents. The CRA states that users must be informed of available corrections or mitigations without undue delay.

Generally, failures under the CRA are punishable by varying tiers of fines, the most serious of which can reach €15 million ($17.4 million) or 2.5 percent of the offender’s annual turnover, whichever is higher.

The reporting duties that took effect today are classified as core responsibilities under the act, meaning failures to comply with them could lead to the maximum fines being issued.

They are the latest step in the EU’s plan to drip-feed tighter security regulations on companies operating in the bloc.

Most remaining CRA provisions become applicable on December 11, 2027, at which time manufacturers will also be required to embed security by design and default. That means no default passwords and security updates are no longer optional.

Products covered by the CRA will also have to undergo the applicable conformity assessment before being placed on the EU market and bearing a CE mark.

More than a deadline

The CRA’s new rules are not just intended to accelerate manufacturers’ responses to security flaws. They are also intended to give businesses a better understanding of their software supply chains.

With the reporting clock starting as soon as manufacturers become aware of an issue, they cannot afford to begin mapping an affected product only after a vulnerability or incident emerges. They need a comprehensive view of the affected product and any related products that may share the flaw if they are to meet the deadlines.

Furthermore, those requirements demand that manufacturers maintain this understanding throughout each product’s lifecycle.

Creating a software bill of materials (SBOM) when a product is launched is one thing. The SBOM becomes a mandatory requirement when most of the CRA’s remaining provisions become applicable next year.

Maintaining that security snapshot over time, however, is intended to help reduce the number and impact of serious cyberattacks across the EU.

“What all this means for manufacturers is that secure development, effective vulnerability handling, and traceability across the software supply chain should be elevated to the top of their priority list,” said Eran Kinsbruner, veep of product marketing at Checkmarx.

“Modern applications are assembled from a complex ecosystem of components, with combinations of proprietary code, open-source packages, third-party components and, increasingly, AI models and services all interconnected,” he added. “Organizations need to understand these components, their dependencies and the risks they introduce.”

Given enough time, the CRA looks set to improve cyber resilience across the board. However, lawyers warn that manufacturers, particularly those outside heavily regulated sectors, must now contend with a growing body of overlapping rules.

“The CRA is arriving as organizations are already grappling with a growing body of Digital Decade legislation, including NIS2, DORA, the Data Act, and the AI Act,” said Heidi Waem, data, privacy and cybersecurity partner at DLA Piper.

“We’re seeing the compliance challenge for many businesses evolving beyond understanding single regulations in isolation, but determining how multiple frameworks interact, where requirements overlap and how compliance programmes can be coordinated across them.”

John Magee, partner and global co-chair of data, privacy, and cybersecurity at the same law firm, added: “Even now we’re seeing the breadth of the regulation’s reach catching organizations off guard.

“Many still associate the CRA primarily with consumer IoT devices, when in reality it applies to a much broader pool of products with digital elements. For compliance teams already very busy managing multiple Digital Decade initiatives, there is a risk that this first wave of CRA obligations has arrived sooner, and with a wider impact, than they had expected.” ®

Apple’s changes to the Keychain in macOS Tahoe made it more secure. However, by binding it to device-specific Secure Enclave keys, users now can’t manually copy the login Keychain and use it on another Mac.

Attacks on Mac users are getting more sophisticated over time, with AI also opening the door to even more malware and the discovery of new intrusion techniques. While Apple does work to increase the security of its operating systems and software to counter the threats, they can also become a burden to administrators.

In a blog post on September 8, Rich Trouton wrote that it wasn’t possible to manually copy login Keychain files from one Mac to another. At least, doing so and still being able to use them on the new machine.

As he explains, the login keychain is a SQLite database file stored in the user’s home folder, which you could previously copy from one Mac to a second. While you could use the file straight away on earlier versions, an update to macOS Tahoe meant that it wouldn’t work for Macs using a Secure Enclave.

The Secure Enclave guards the metadata key that protects the keychain attributes required to decrypt it. The change means that the Secure Enclave must be used whenever the login Keychain file is accessed.

The metadata key can be cached in the Application Processor for fast keychain entries. However, the Secure Enclave must be accessed for that cache to exist in the first place.

If you’ve moved the Keychain file to another Mac, it won’t have access to the Secure Enclave, and therefore won’t open.

Changed chain in macOS Tahoe

While the change is only really becoming known now, it’s something that actually happened back in March. According to Trouton and another September 10 post by Jeff Johnson, the macOS 26.4 update introduced it.

Testing confirmed that the ability to copy the file worked for macOS 26.3, including via a virtual machine. However, copying the login Keychain from a virtual machine running macOS 26.4 didn’t work, due to not being able to be read on other Macs.

Other non-login Keychain files are unaffected and can be unlocked on other Macs fine.

In an addendum on September 11, Johnson writes that this was a “ticking time bomb” that Apple included in a minor macOS update. For macOS 26.3 and earlier, Johnson explains that users could recover their login Keychain on a new Mac, but that’s not possible on macOS 26.4 by copying it over.

In an emergency and with the death of a Mac, Johnson says users would only discover the login Keychain wouldn’t work at the worst possible moment. “This is incredibly irresponsible of Apple,” he concludes.

Exceptions and workarounds

It is evident that a straight copy of the login Keychain and opening it elsewhere simply won’t work. The hardened security is there to stop malicious actors from doing just that.

However, it is only a problem if you are copying your credentials in this particular way.

For users who are restoring backups to the same Mac, they will not be affected by the issue, as it’s the same Mac. It also won’t affect anyone using Migration Assistant, though it will be a problem for administrators performing bulk migrations in a corporate environment.

Exporting items before a migration is also a way around the issue, as well as the use of custom keychains and other password managers.

For home users, taking advantage of iCloud Keychain may be the route ahead. As well as ensuring your passwords are shared to your iPhone and iPad, they can also be synchronized with your other Macs.

For the past few generations, Samsung’s flagship Ultra phone has felt increasingly predictable. The only upgrade that really grabbed my attention on the Galaxy S26 Ultra earlier this year was its Privacy Display. The Galaxy S27 generation looks different, though, as Samsung appears to be putting some genuine effort into improving its flagship phones.

We have already seen a redesign in leaked renders, heard rumors of a larger battery, and read reports of changes to the zoom camera. Now, according to ETNews, Samsung plans to equip both the Galaxy S27 Pro and Galaxy S27 Ultra with Samsung Display’s latest M16 OLED material set. These would be the first Samsung smartphones to use M16.

So what exactly does M16 change?

M16 refers to the collection of organic materials Samsung Display uses to produce its OLED panels. The choice of materials affects the color, brightness, efficiency, and panel lifespan. Moving to M16 could give Samsung more flexibility to increase brightness or reduce how much power the display consumes.

The regular Galaxy S27 and S27+ are reportedly getting newer display materials as well. Samsung is expected to move those phones from M13 to M14, the material set introduced on the Galaxy S26 Ultra. Samsung Display already supplies M16 panels to other phone makers. The recently launched iPhone 18 Pro and Pro Max and the Pixel 11 series use the material set, and the upcoming iQOO 16 is expected to get it later this month.

Samsung has more display upgrades in the works

M16, CoE (Color Filter on Encapsulation), and Privacy Display are expected to help distinguish the Galaxy S27 Pro and Ultra from the regular S27 and S27+. Privacy Display returning on the Ultra would hardly be surprising, but bringing it to the new Pro model could give buyers another good reason to consider it.

The Galaxy S27 Ultra may also get an upgrade to its protective layer. Samsung and Corning are reportedly developing a new Gorilla Armor coating that could heal minor surface scratches over time. None of these changes sound particularly dramatic on their own, but the growing list of upgrades is making Samsung’s next generation of flagships much more interesting.

You take a risk when you buy the first version of something to ever exist, even when it’s made by a company with a history as well-documented as Apple’s. The new iPhone Duo looks cool, with its passport-style hinge and massive displays, but buying it is still a risk. You’re spending at least $2,000 on something you’ll use for multiple hours every day over at least the next 12 months, which is enough to give just about anyone a moment of pause to check in mentally and make sure this is the right decision.

The risk is real, I get it. Do it anyway, and be loud about it.

Apple/Screenshot by CNET

Apple is nowhere near the first to make a foldable phone, but this is the first iPhone that will bend (more than once, at least). That’s an interesting place to be, due largely to the folks who tend to own iPhones. Samsung is in its seventh year of releasing foldables, and I maybe see one or two of them in the wild when I wander major cities or busy airports. The folks who have them love them, and they’re happy to tell their friends about the cool things these phones can do, but the audience is largely early adopters, comfortable with things that aren’t fully baked.

Feedback from someone who isn’t tech-obsessed will always be more valuable to Apple than to a lot of its competitors. Features will be created and retired from that feedback, and it will eventually appear on most other folding phones.

My favorite example of this is actually another Apple product, the Watch. The first Apple Watch had some fitness features, but was largely focused on the idea that you could leave your phone behind because that’s what the competition was doing already. Instead of trying to replicate your phone in watch form, right down to the tiny keyboard seen on other smartwatches at the time, Apple focused on its fitness tracking and health monitoring features. They quickly became the most popular.

By the time the third-gen Apple Watch was announced, GPS and cellular features were now being shown off as a way to make those fitness features better. The Watch was no longer about replacing your phone. Now that we’re at Apple Watch Gen 12, fitness is basically all anyone talks about.

The next six months are going to be important for the future of Apple’s contribution to the foldable phone market, because the audience response will help shape the next iPhone Duo. Popular third-party apps will become native features, accessories will be made to address situations that haven’t happened yet and current features will be copied in every direction. It benefits everyone if the majority of the folks providing early feedback and getting excited about new ways to use this phone are outside of the standard group of IT folks, business execs on weekly flights or whoever is going to watch that front screen for 44 hours.

Grab one, if you can afford it. Watch Netflix on it and talk about how that experience could be better. Use your favorite apps side by side and see if it’s easy or intuitive for you to figure out on your own. Be an early adopter, and this time next year a lot more people will feel like the Duo was made with them in mind.

Russell Holly is a Managing Editor on the Commerce team at CNET. He works with all of CNET to assemble top recommendations as well as helping everyone find the best way to buy anything at the best price. When not writing for CNET you can find him riding a bike, running around in Jedi robes, or contributing to WOSU public radio’s Tech Tuesday segment.

See full bio

Advertisement

Inside, the Halo has a cylindrical IEST-certified HEPA three-stage filter that claims to capture 99.97 percent of nano-sized particles down to 0.3 microns, but in my opinion the coolest feature is the MegaScan Particle Sensor, which continuously monitors the air in real time to detect smoke, fine dust, and allergens down to PM2.5. PM2.5, typically used as the standard measurement for air purifiers’ ability to measure and lower levels of microscopic allergens or pollutants, are tiny airborne particles that measure 2.5 micrometers or less in diameter. They are particularly dangerous because their size means they can penetrate deep into the lungs and cause serious illness like asthma, heart disease, and lung cancer.

From the purifier’s top touchscreen panel, you can control fan speed, timer, and settings. On the quietest sleep setting, my decibel monitor app wasn’t even able to pick up the noise, as the fan wasn’t perceptible above the ambient noise of my house, even when I switched off all nearby appliances. Coway claims it’s 17 decibels in sleep mode, which I believe after not even being able to hear the machine in this mode. On the highest turbo setting, my decibel reader had it hovering around 75 decibels, which is akin to running a dishwasher or a vacuum.

As part of the Airmega Halo’s sleep features (in addition to whisper-quiet functioning), it has a low yellowish night light when in sleep mode, but this can also be turned off so the top panel is completely dark. It has a light sensor and automatically enters sleep mode, dimming lights and noise level when low light is detected.

When in smart mode and it’s dark for more than three minutes, the machine will automatically enter sleep mode. If the pollutant levels are “good” for more than three minutes, the fan stops automatically to save energy. But if it detects pollutants, it will restart the fan.

It has four lights indicating air quality levels: blue for good, green for moderate, yellow for unhealthy, and red for very unhealthy. The colored lights show in a halo around the top of the machine. I found it sort of tough to distinguish between levels at a glance because this color-coding system differs from the US AQI standards of green for good, yellow for moderate, red for unhealthy, purple for very unhealthy, and maroon for hazardous.

Mixed Signals

Hopefully, you come to WIRED Reviews because we actually vigorously test the gear we recommend. I didn’t just read the specs online and flip through the instruction manual—this machine was put through some intensely bad air to see if it could hold its own.

As with all air purifiers I test, the Halo was put through testing in various unhealthy air quality situations. I used this model for nearly a month, moving around my house to test in different locations: when cooking on my unventilated gas stove, under my living room window that draws in a lot of building and exhaust fumes, and outside my cat’s litter box. Additionally, I use an indoor air quality monitor to test pollutant levels against what the machine claims.

Winners & losers: Nobody likes seeing companies laying off people, except maybe their shareholders, but CEO Dara Khosrowshahi says the roughly 3,300 people Uber let go of last week will be a good thing for customers: it will use the savings to reduce prices, apparently.

Uber said last week that it was laying off 10% of its corporate staff, or around 3,300 positions, as the ride-hailing giant looks to reduce management layers. The move marks its biggest cuts since Covid.

At the Goldman Sachs Communacopia + Technology Conference yesterday, Khosrowshahi talked about taking the savings stemming from the layoffs and reinvesting them in the business, which includes lowering prices for customers.

The CEO added that the money saved from insurance will also be used to lower ride prices, something that he believes will keep travelers using Uber’s app.

Some of the savings will also be directed toward Uber’s autonomous taxi network. The company says it plans to invest over $1 billion in this area as it looks to compete with rivals such as Waymo.

As is so often the case when companies make mass layoffs, Uber performed better than expected in its recent quarterly earnings report. Khosrowshahi himself admitted that the layoffs had come at a time when the firm was in “a position of strength versus weakness.”

“Some companies wait,” he said. “We don’t believe in waiting.”

Of course, we only have Khosrowshahi’s word that prices are going to drop as a result of the layoffs. CEOs aren’t renowned for their honesty, and we’ve seen promises like these fail to materialize before.

When T-Mobile announced 5,000 job cuts in August 2023, CEO Mike Sievert said the restructuring would help deliver better value and a better customer experience. Less than a year later, the carrier announced price increases for customers on some older plans, including an extra $5 per voice line each month. Better value, it seems, is open to interpretation.

Uber might also want to use some of the money from the layoffs to pay the almost $1 billion fine recently imposed on the company by the EU. Between 2018 and 2022, Uber automatically suspended or deactivated drivers suspected of fraud or receiving poor ratings. The Dutch regulator found that these decisions involved no human review, breaching GDPR rules on automated decisions with significant personal or financial consequences.

MagSafe is safer and simpler, but USB-C has a few advantages of its own.

The differences between MagSafe and USB-C

Alina Vytiuk/Getty Images

When USB-C works best

Habanero Pixel/Shutterstock

At Apple’s recent hardware event, the software powering its foldable iPhone Duo stood out, with translucent Liquid Glass effects and vertically stacked icons. But you don’t need to snatch a folding smartphone to reap the benefits of Apple’s iOS 27 updates.

When iOS 27 leaves beta on Monday, Siri AI’s standalone app and smartphone search integration will likely be the most immediately obvious change for many iPhone users. But it’s worth digging even deeper to uncover helpful additions to key apps, like Apple’s Safari browser, as well as revamps to underutilized apps, like Shortcuts.

The version of Safari available in iOS 27 looks fairly similar to the last iteration, with a few key updates tucked away in the settings. These Safari features are powered by Apple Intelligence, which requires an iPhone 15 Pro or newer (they’re also available on iPadOS 27 and macOS 27).

Notify Me

Photograph: Courtesy of Apple

If you’re shopping online and want a quick price-drop notification, you can use the “Notify Me” feature to scan a webpage on a certain cadence and look for changes. First, head to the page you want to track and tap the three-lined hamburger menu icon in the top right corner of Safari. About halfway down, you’ll see this option listed.

“Safari can let you know when a website updates the content you’re interested in,” reads the feature’s description. Here you’ll find an open text box where you can describe what change in content you want Safari to scan for, as well as how often you want it to check.

For example, my couch is broken, so I’ve been eyeing a few different replacement options. I have two final contenders from CB2, but both are out of my price range. So, I set up a “Notify Me” for Safari to scan the pages each day for a significant discount. Whichever one goes on sale first will likely be what I decide to get, and now I don’t have to refresh the pages manually every day.

While many other browsers have similar shopping features, like the price-tracking bell in Google Chrome, I appreciate how this feature stretches beyond just buying stuff. You can also use Safari to scan for ticket drops, privacy policy changes, and other content updates.

Describe an Extension

Photograph: Courtesy of Apple

If you’ve experimented already with the “Describe a Shortcut” feature for iPhone automation, then “Describe an Extension” for Safari will seem familiar. It’s located under the same settings menu as the “Notify Me” tool, just a little further down.