So Outside Technology Security CMS
AnQiCMS
Online Demonstration

Vulnerabilities exploited in the wild must be reported within 24 hours, who should submit this report

📅 2026-11-01 👁️ 0

Who is affected by this new rule requiring the reporting of vulnerabilities exploited in the wild, and what report do website operators need to submit? The obligation lies with manufacturers placing products with numerical elements in the EU market, as well as open-source software maintainers under specific conditions, not with every operator of a site. Most domestic sites are not within the jurisdiction, but this set of three-time limits is worth borrowing for your own emergency rhythm.

When does the new regulation take effect

The obligation to report rules will start to apply from September 11th of this year, the triggering conditions are two types of events: vulnerabilities being exploited in the wild, and major events affecting product safety. That is to say, having 'vulnerabilities' does not necessarily trigger reporting; whether they have been exploited, and whether they affect safety, is the starting point for judgment.

What is due for each of the three time limits

Time limit What is exchanged Content focus Common gaps
Twenty-four hours Early warning Initial judgment on the existence and impact of the event Report only after the root cause is found
Seventy-two hours Vulnerability or event announcement Technical details, exploitation status No distinction of affected versions
Within fourteen days Final report Rectification measures and root causes Rectification and release immediately archived, no root cause written

First tier must be provided within 24 hours after awareness of the event, the second tier should provide more complete information, and the third tier should submit the final report within fourteen days after the implementation of available rectification measures. The difference between the three tiers is not that 'the longer the writing, the better', but that it answers three different questions: Did an incident occur, what was the impact, and how to completely fix it.

Who is considered as a party that needs to be reported

The entity responsible for declaring is the manufacturer of the product, including the主体 that combines hardware, software, and cloud services to enter the market; the maintainer of open-source software assumes its own declaration obligations within the rules, but the scope is different from that of commercial manufacturers.

The operator of the site is usually in the position of a 'user': you do not constitute a manufacturer, but the systems and plugins you rely on belong to the regulated products. What truly affects the operator is indirect obligations - once the declaration is initiated upstream, the pace of repairs and the disclosure of information will be faster, and your emergency window will be compressed accordingly.

What can unregulated sites do with this time limit?

Treat the three-level time limit as an internal handling rhythm, which is a very useful organizational method.

  • Discover vulnerabilities that are being exploited in the wild: complete the initial assessment of the impact within 24 hours and communicate with the outside world, clearly stating which sites are affected;
  • Within 72 hours: complete the list of affected versions, exposure surface, and judgment of whether there are already intrusion traces, and form a notification report;
  • Within 14 days after the measures are available: write the root cause and corrective conclusion, and archive it to the operation and maintenance records.

The complementary capabilities on the self-built system side are equally important. AnQiCMS in the v3.6.6 release notes also handled two high-risk issues of list sorting parameter injection and the login credentials of site switching being forgeable, and provided subsequent actions such as rotating site signature configuration and changing the administrator password. Such entries of 'changing credentials after repair' correspond to the final report phase in the timeline.When integrating with automation, the MCP interface sets the exposure range based on the intent domain, operations such as backup, upgrade, and multi-site are default closed at the site-wide level; write operations are merged and confirmed at the round level to avoid being executed by automation scripts in the emergency window.External AI clients such as Claude, Cursor can access this interface, but the approval process remains on the human side.

Four things fall on the daily duty shift.

  1. Subscribe to the announcement source of the dependent system, don't wait until the vulnerability is already in the wild to know about the announcement.
  2. Write the clear duty rules for 'who has the authority to shut down the public entry point'.
  3. Each handling should leave a timestamp, and the final report is directly assembled from it;
  4. Practice a 24-hour and 72-hour window, to see if the internal process can keep up.

Common questions

I am just the operator, do I need to report to the regulator?Generally, it is not necessary, the rules govern the manufacturer and the maintenance party; the operator's action is to convert the upstream announcement into internal handling.

When does the 24-hour period start?Start from the time of realization of the event, not from the time of identifying the root cause, this is the significance of early warning.

What should be done if the deadline is missed?Record the reasons for delay and remedial actions, the regulator is concerned about the effectiveness of the process, and it is more beneficial to keep a complete record after the event than to conceal it.

Is it necessary to be so tight with the internal rhythm?In scenarios with the risk of being exploited in the wild, the shorter the window, the less exposure time can be reduced; common defects do not need to be covered with the same strength.

Related articles

That week when the new version was released, the old branch just stopped supporting it, what should sites running Drupal do first?

The week of the major version release, the old branch just reached the end of support. For sites running Drupal, what should be done first? First, accept the backup, then plan the upgrade path. The official schedule compressed two time points into adjacent days, effectively compressing the upgrade window. This article explains why the scheduling collided, what level of backup is considered acceptable, the order in which module compatibility should be checked, and what choices are left after the discontinuation.

2026-11-01

The core security version fixed over twenty issues in one go, where did the rollback patch stop on which branch?

When the core security version fixes more than twenty vulnerabilities at once, it is first necessary to clarify the statistical scope, and then to see where the patch追溯 stops on which branch. This article takes a round of repairs made public at the end of this month as an example, explaining the difference between the number of fixes and the number of announcements, the minimum support branch, and why versions below the minimum do not receive any patches, and provides the disposal sequence for sites still on the old branch and the acceptance list for self-built systems during emergency upgrades.

2026-11-01

Only about 10% of sites have installed llms.txt, can this number indicate that it is useless?

Only about one-tenth of the sites have installed llms.txt, can this adoption rate number indicate that it is useless? No. A low adoption rate indicates that it is not yet a common practice, and an unclear relevance indicates that it is not a lever for citation volume, neither of which equals invalid. This article separates the sample and scope boundaries of two studies, provides a way to judge it as a reading path rather than a ranking method, and explains how to cross-verify whether it has been read using crawl logs and site maps.

2026-11-01

AI answers mention the brand but do not provide a link, should the mention rate and citation rate be counted separately?

In AI answers, when mentioning a brand without providing a link, should the mention rate and citation rate be separated? Yes. Mention is the brand name appearing in the answer, and citation is the answer accompanied by a link to the source. These are different events, and merging statistics will understate or overstate visibility. This article explains the misjudgment caused by the difference in measurement criteria, provides a ledger field for separate recording, and describes two things that can be improved on the content side.

2026-11-01

There is an additional type of traffic from image search in the report, should this type of traffic be handled separately for content?

Is there a category of data found through image search in the report? Should the site create separate content for it? Do not open a new content line yet, but check if the image description is consistent with the text on the landing page. This article explains the statistics of this type of query initiated by images, its relationship with the original web page report, why the gray data is not aligned, and gives the judgment sequence of using a keyword library to fill in this type of query and distinguishing automatic image matching from manual image selection.

2026-11-01

How will the site that sends AI articles in batches judge the guide that adds a sentence that must be manually verified?

How will the site that publishes AI articles in batches determine it? The focus of the determination is on the purpose rather than the tool: creating pages in bulk to manipulate rankings is considered abuse, while fact-checking after辅助 creation does not belong. This article explains where this sentence has been changed, what specific checks are made before publication, and the step that is easily missed between in-site sensitive word filtering, content review, scheduled publishing, and bulk import.

2026-11-01

The visits brought by AI only account for one percent of the website traffic, why is the conversion rate higher?

Does the access recommended by AI only account for a little over 1% of the site traffic, but the conversion rate is significantly higher? Is this investment worth it? First, let's look at the differences in the scope of the two numbers: the proportion is counted according to the total site sessions, and the conversion is counted according to the recommendation channel, which cannot be directly divided. This article explains the differences in the samples, the order of judgment of the investment, and the actions that the site needs to take at both ends of being referred to and receiving conversions.

2026-11-01

Increased by nearly 20% in half a year, what should be checked before renewing the overseas website package?

The overseas website package has increased by nearly 20% for half a year, what should be checked before renewal? Check the billing method and renewal price first, and then check the additional items such as domain name, email, and certificate. This article takes an increase in monthly fees as an example to illustrate the difference between the first-year price and the renewal price, and gives the accounting order of the self-built plan: the server and labor hours should be recorded separately, the memory and capacity specifications provided by the official can only be used as a reference and cannot be directly used as an invoice.

2026-11-01