Cyber Resilience Act: what software makers must do now that reporting applies
Cyber Resilience Act: since 11 Sep 2026, manufacturers must report exploited vulnerabilities within 24 hours. Who is affected and what to prepare now.
Threat
New vulnerabilities are disclosed every day.
WordPress. PHP. Windows. Citrix. In the last few weeks alone, and all actively exploited. Your application very likely runs on exactly this kind of software.
- WordPressFlaw
CVE-2026-87902
WordPress core before 7.1.2
- Elementor ProFlaw
CVE-2026-32475
Elementor Pro (WordPress plugin)
- WindowsFlaw
CVE-2026-85880
Windows ALPC · Patch Tuesday
- npmMalware
indexed-btree
npm · malicious package imitating sorted-btree
- PHPUpdate
PHP 8.2.34 – 8.5.11
PHP security release
- CitrixFlaw
CVE-2026-88771
Citrix NetScaler ADC/Gateway · zero-day
- PHPFlaw
CVE-2026-109618
PHP 8.2–8.5 · remote code execution
- BinanceIncident
Security incident, withdrawals suspended
Public reports, Sept–Oct 2026. A flaw in a piece of software does not mean a company was affected.
Threat picture
9 out of 10
reported ransomware attacks in Germany in 2025 hit small and medium-sized businesses (about 90%).
Too small to be a target? The numbers say otherwise.
Source: German Federal Criminal Police Office (BKA), Bundeslagebild Cybercrime 2025.
Self-test
Three questions. Can you answer yes to all of them?
Are your website’s encryption and security headers up to date?
Are internal files and admin pages unreachable from the internet?
Are fraudsters unable to send e-mails in your name?
Worth a closer look. The check examines all three points. For free.
If you would still like to have it checked:
Check for freeNo self-test covers login, access rights or source code. That is what the audits are for.
Your answers are neither stored nor sent.
Security check
Check your website or web app. For free.
We check exactly these three points. Grade from A to F, PDF report usually within 2 hours on working days.
Request received.
This check sees 1 of 9 areas. The rest sits behind the login and in the code. What an audit sees →
That did not work. Write to us directly at contact@techspike.fr
The privacy policy of Techspike SARL applies.
In-depth reports are paid and optional. No obligation. All we need is the URL of your website or app and your email address.
No attack, no login.
Security check
example-shop.example
C
Overall grade
- 2 High
- 5 Medium
- 7 Low
- .git directory publicly reachableHigh
- TLS 1.0 still enabledHigh
- Content Security Policy missingMedium
- Server version visible (nginx 1.18)Medium
- Cookie without SameSite attributeLow
How we audit
Attackers automate. So do we. On your side.
Several specialised AI agents review your application in parallel, each in its own field. Another agent tries to disprove every finding. Only what is proven makes it into the report.
- 01Found
One of 12,640 signals. - 02Disproved?
A second agent tries. Without success. - 03Rated
With location, risk and recommendation.
Audited and rated according to
Not a penetration test. Every finding backed by its location and rated with CVSS.
Fictitious example.
Security check
example-shop.example
C
Overall grade
- 2 High
- 5 Medium
- 7 Low
- .git directory publicly reachableHigh
- TLS 1.0 still enabledHigh
- Content Security Policy missingMedium
- Server version visible (nginx 1.18)Medium
- Cookie without SameSite attributeLow
After the check
Your grade is in. Now what counts is what lies behind it.
The check examines the three points. For everything behind the login, the report tells you what makes sense.
| Your situation | Next step |
|---|---|
| Only encryption or headers affected | Fix it yourself. The report shows you how. |
| Customer accounts, shop or portal | App audit · login and access rights |
| Your own software, preparing for the Cyber Resilience Act | Code audit · source code and dependencies |
| Proof for a customer or investor, a building block for NIS2 | Full audit · from the outside into the code |
We only recommend what your findings justify.
Packages
Four packages. Clear prices. Start for free.
Security check
For every website and web app
free
App audit
For customer portals, shops and SaaS
€490excl. VAT
Code audit
For software makers and the Cyber Resilience Act
€890excl. VAT
Full audit
For proof to customers, investors and NIS2
€1,690excl. VAT
Enterprise
Security architecture review
For groups and platforms
On request
- Hosted in the EU
- No AI training on your code
- Code read-only
- NDA & DPA
- Methodology
All prices net, plus VAT. Businesses only. Our terms and conditions apply.
Comparison
All packages compared. The further right, the deeper we look.
| Security checkfree | App audit€490 | Code audit€890 | Full audit€1,690 | EnterpriseOn request | |
|---|---|---|---|---|---|
| What is tested | |||||
| TLS, security headers, cookies | included | included | partly | included | included |
| Login, sessions, rate limits | not included | included | included | included | included |
| Access rights: can user A see user B’s data? | not included | included | partly | included | included |
| Injection (SQL, XSS, SSRF) | not included | partly | included | included | included |
| Secrets and keys | partly | partly | included | included | included |
| Supply chain, Docker, CI/CD | not included | not included | included | included | included |
| What you get | |||||
| Grade and number of findings | included | included | included | included | included |
| Report with a prioritised action plan | not included | included | included | included | included |
| CVSS 3.1 ratings | not included | included | included | included | included |
| Debrief and re-check | not included | not included | not included | included | included |
| Framework | |||||
| Access | URL and email address | Address + 2 test accounts | Read access to the code | URL, test accounts and code | individual |
| Delivery | usually within 2 hours on working days | 1 working day | 2 working days | 4 working days | individual |
Questions
What clients want to know first.
How much does a security or code audit cost?
The security check is free. The app audit costs €490 (excl. VAT), the code audit €890 and the full audit (application and code) €1,690, each at a fixed price. For very large applications we quote the price before we start.
What is the difference between a code audit and a penetration test?
A penetration test attacks a running system from the outside. A code audit reads the source code and finds root causes, including ones a pentest never triggers. The two complement each other. We do the code audit.
How long does the audit take?
You usually receive the Security Check within 2 hours on working days. Once payment has arrived and access, code and approval are complete, we deliver the App Audit in 1, the Code Audit in 2 and the Full Audit in 4 working days. For the Code and Full Audit, Express delivers the report within 24 hours on working days.
What happens to my source code?
Code uploads are kept in private storage in the EU, and only we have access. For the analysis we use Claude by Anthropic (USA). The AI provider does not train on your code. We delete it no later than 30 days after delivering the report.
Is AI-generated code a security risk?
It can be. AI assistants readily reproduce unsafe patterns and outdated dependencies. Our audit reviews AI-generated code as strictly as hand-written code.
Does the report help with NIS2 and customer requests?
Yes. It documents method, scope, findings and actions and works as evidence for customers, auditors and investors. It does not replace a certification.
Which programming languages do you cover?
Among others C#/.NET, Java, Kotlin, TypeScript/JavaScript, Python, PHP and Go with their common frameworks. Your stack is not listed? Ask us.
How do you access the code?
As an encrypted archive or via read access to the repository (GitHub, GitLab, Azure DevOps, Bitbucket). You can revoke access at any time.
Contact
Let’s talk. We’ll show you where you stand.
15 minutes. Free. No obligation.
From the blog
Knowledge that protects. New articles on code security.
Code audit or penetration test? Differences, costs and the right choice
Code audit or penetration test? What each one finds, what it costs and when you need which. A side-by-side comparison, with fixed prices for our audits.
Vibe coding: how secure is AI-generated code?
Vibe coding security: nearly half of AI coding tasks contain a known flaw. The five typical mistakes in AI-generated code and how to have it audited.
Vulnerability of the day ·
PHP Use after free
8.1 CVSS · highExploitedUse after free in PHP. Exploitable over the network, without logging in, without any user action. CVSS 8.1 (high). According to CISA it is already being exploited. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.