EU Cyber Resilience Act: Key Obligations for IoT and Firmware Makers from 2026

·1 views

The EU Cyber Resilience Act (Regulation 2024/2847), which took effect on December 10, 2024, will begin its first operational phase on September 11, 2026, when manufacturers must start reporting actively exploited vulnerabilities and serious security incidents. The regulation applies to all hardware and software sold on the European market, including IoT devices, Linux gateways, and embedded systems, with full provisions kicking in from December 11, 2027. Manufacturers are required to know exactly which products are affected, which firmware versions they run, and what software components they contain in order to meet tight reporting deadlines. The CRA also mandates that cybersecurity be built into the entire product lifecycle — covering firmware, bootloaders, software dependencies, updates, SBOMs, and post-sale vulnerability management. The regulation marks a fundamental shift for the embedded sector, demanding that security be treated as a core engineering discipline rather than an optional add-on.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

OptiQra: Open-Source Tool That Audits Websites and Automatically Fixes Issues

A developer frustrated with audit tools that only list problems has built OptiQra, an open-source website optimization tool that crawls sites, identifies issues, and automatically fixes many of them. The tool covers traditional SEO elements such as meta tags, broken links, structured data, and accessibility, as well as performance metrics via optional PageSpeed Insights integration. OptiQra also includes generative engine optimization (GEO) and answer engine optimization (AEO) audits, checking whether AI crawlers can access content and whether pages are structured for AI-driven discovery. For fixes requiring written content, users can connect their own API keys from providers like OpenAI, Anthropic, or Google, while simpler issues are resolved deterministically without AI. Built-in integrity checks discard any AI-generated changes that violate a page's structural rules, and the tool can also audit local project source files rather than just live websites.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Used AI to Turn 2.5-Hour Voice Memo Into a 5-Part Technical Series

A software developer recounts how the idea for a technical writing project called 'The Database Marathon' came to him during a Saturday morning bike ride, when he realised the end-to-end story of months of database work had never been documented in full. He recorded a 2.5-hour voice memo of his recollections, cleaned up the transcript himself, then used Claude to help shape it into a structured five-part article series. The collaboration worked like an author-editor relationship, with the developer directing content and the AI assisting with structure, fact-checking, and clarity over several days. The developer acknowledged upfront that AI was used as a tool, but stressed that the underlying experience, decisions, and technical work were entirely his own. He also reflected on the broader problem of AI-generated filler content crowding out authentic firsthand accounts, arguing that the value lies in what real experience exists beneath the writing, not in the tool used to express it.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Drift Monitor to Track Chinese AI API Model Catalog Changes

Chinese AI providers such as DeepSeek, Qwen, GLM, Kimi, and aggregator AIWave update their model catalogs frequently, causing static SDK configurations to become outdated between development cycles. A model catalog drift monitor treats provider metadata — including model IDs, context windows, output limits, cache pricing, and rate limits — as live operational data rather than fixed configuration. The approach targets mismatches that cause real production incidents, such as a model alias pointing to a changed endpoint or a billing forecast based on outdated pricing tiers. The monitor works by periodically fetching and comparing provider metadata against a stored baseline, without handling user prompts or credentials. According to the author, who reviewed official provider pages on August 13, 2026, several providers including DeepSeek and Kimi had already published upcoming pricing and context changes scheduled for later that month.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Apache Data Lakehouse Projects See Releases, Spec Debates in August 5–12 Week

The week of August 5–12, 2026 saw significant activity across Apache data lakehouse projects, with four projects shipping new releases and several major architectural discussions underway. The Iceberg community began formally scoping its v4 table spec, grouping workstreams into content metadata, table features, and data types, while a separate proposal suggested making v4 manifests Parquet-only by dropping Avro support. Apache Polaris released version 1.7.0 with new Kafka and GCS features, and also disclosed a low-severity security vulnerability in its register endpoint. Apache Parquet formalized its versioning strategy for forward-incompatible changes and released parquet-java 1.18.0, while Apache DataFusion Comet reached its 1.0.0 milestone after two years of incubation with a discussion opened about elevating it to a top-level ASF project. Across the ecosystem, the week's central theme was communities debating how to evolve formats and standards without disrupting existing users and integrations.

0 comments Read more at DEV Community