curl Moves Minor Vulnerability Reports Public and Gentoo Seeks Sponsors, Weeks After EU Cyber Resilience Act Reporting Duties Began

Background

The European Union’s Cyber Resilience Act (CRA) has moved from a future deadline to a running obligation. According to the European Commission, manufacturers have been required since 11 September 2026 to report actively exploited vulnerabilities and severe incidents affecting products with digital elements. The Commission page says they must submit an early warning within 24 hours of becoming aware and a full notification within 72 hours, through a Single Reporting Platform that ENISA has operated since the same date. Open-source software stewards are covered separately: the Commission says their reporting obligations apply from 11 December 2027. The Herald previously reported on the run-up to the first CRA deadline.

Meanwhile, the projects that supply much of the code underneath those products depend on volunteer time and outside money. FOSS Force describes this in general terms: like a large number of open source projects, Gentoo relies on volunteer developers for code and also depends on community donations and sponsors to cover expenses and infrastructure needs.

This article compares several recent, separate developments from October 2026. None of the cited sources links them to one another, and the comparison is the Herald’s.

Current situation

curl moves lower-severity reports into public view

Maintainer Daniel Stenberg wrote on the curl project’s blog that from 26 October 2026 reports deemed LOW or MEDIUM severity must be filed as issues in curl’s public GitHub repository, while only HIGH or CRITICAL vulnerabilities stay private in the HackerOne tracker. He wrote that over the last few years, over 90% of all submissions could quickly be assessed to be less than HIGH.

Stenberg attributes the change to workload. He wrote that “all key maintainers feel strained, overloaded and brought to the brink of what we can muster.” He also acknowledged a cost: the policy “will give bad people a slightly longer window of opportunity to exploit weaknesses at the expense of existing curl users.” He wrote that public handling does not shrink the work needed per report, but might spread it among more people. The Register adds that Stenberg had already shut curl’s bug bounty scheme earlier this year.

Gentoo looks for infrastructure sponsors

FOSS Force reports that Gentoo posted a request after losing several long-running sponsors this year. Its wish list covers virtual machine hosting, hosted physical servers, rack space, machines and cash. The report says mostly non-US capacity is needed at present, and quotes the project: “Partnerships with organizations aligning with Gentoo’s goals are strongly preferred.” FOSS Force also notes that Gentoo announced in February it was leaving GitHub for Codeberg. The Herald has separately covered Gentoo’s scheduled Chromium package removal, citing maintainer burnout.

Open Source Summit Europe focuses on compliance and measurement

The Register’s report from Open Source Summit Europe describes digital sovereignty as a recurring theme. It says speakers from Dell and Microsoft discussed OpenSSF’s efforts to build catalogs of open source components to help companies achieve CRA compliance, including CRABFOSC, the CRA Baseline For Open Source Consumption. It also reports that Berlin is working with PwC and aims to make 70 percent of the software stack on administrative workstations open source by 2032, and that one talk drew on CHAOSS guides on viability metrics. The Register’s reporter writes that plans, targets and measurements are signs that organizations are treating open source as infrastructure rather than an experiment. The Register’s summary of these sessions does not describe funding for maintainers.

A disagreement over disclosure rules

A separate dispute shows how disclosure norms are being tested. The Register reports that a PHP Foundation blog post says Chainguard “unilaterally broke the embargo” and published built images containing a fix more than six hours before the coordinated PHP release. Chainguard CEO Dan Lorenc told The Register his company “didn’t leak,” and said: “It’s coordinated vulnerability disclosure, unless there’s evidence of active exploits in the wild.” The two accounts disagree on whether publishing early was justified. Both appear in the same Register report.

Implications

The points below are the Herald’s reading of what the sources say, not findings from the sources themselves.

Different actors carry different clocks. The Commission’s page ties the 24-hour and 72-hour reporting steps to manufacturers and sets a later date for stewards. curl’s change concerns the handling of incoming reports, most of which Stenberg says are below HIGH severity. None of the cited sources says how curl’s new procedure relates to CRA reporting, and the Herald does not claim a connection.

Disclosure choices involve trade-offs that sources state openly. Stenberg describes public handling as a way to share workload and acknowledges a longer exploitation window for lower-severity flaws. The PHP dispute, as The Register reports it, turns on when a coordinated process should yield to evidence of active attacks. The cited sources do not say how many people staff the security processes of either project.

Support is arriving in different forms. Gentoo’s wish list is largely in-kind (hosting, hardware, rack space), and the project says it prefers partnerships with organizations aligned with its goals. The summit report describes compliance catalogs, targets and viability metrics. On the evidence of these sources, compliance tooling and maintainer capacity are described in separate places; the Herald found no cited statement that one pays for the other.

Open questions the sources leave unanswered: whether curl’s public-reporting policy changes how downstream manufacturers learn of issues they must report; how stewards will meet reporting duties from December 2027; and whether Gentoo finds replacement sponsors. FOSS Force’s report does not say how many sponsors Gentoo lost or how much of its budget they covered.

What the sources establish for developers is narrow: per Stenberg, curl’s LOW and MEDIUM reports go to a public tracker from 26 October 2026; per FOSS Force, Gentoo is soliciting infrastructure support; and per the Commission, manufacturers are already required to report actively exploited vulnerabilities and severe incidents.