What changed on 11 September 2026
The EU Cyber Resilience Act (CRA) introduced mandatory reporting from 11 September 2026 for manufacturers of covered products with digital elements when they become aware of actively exploited vulnerabilities or severe security incidents affecting those products. This is a reporting obligation for covered manufacturers, not an automatic CMS patch deadline for every website owner.
Most of the CRA's core product-security obligations apply from 11 December 2027. Requirements for certain open-source software stewards also have a later timeline. The CRA is relevant to the software supply chain; whether a particular CMS developer, integrator or site operator is in scope requires a case-specific assessment.
Where patch management is already required
For entities covered by NIS2, cybersecurity risk-management duties include secure maintenance and vulnerability handling. Commission Implementing Regulation (EU) 2024/2690 sets more specific patch-management requirements for listed digital infrastructure and service-provider sectors. Its section 6.6 addresses applying security patches within a reasonable time, testing them, using trusted sources and documenting exceptions.
That does not mean every small business using WordPress or Joomla is subject to NIS2. Scope depends on its sector, size, role and the applicable national law.
A practical patch record for site operators
- List the CMS core version, server-side PHP version, theme, installed extensions and hosting provider. Include the vendor's support status.
- Record applicable security advisories and whether the site is actually affected. Prioritize internet-facing remote-code-execution issues such as PHP2Shell, WordPress WP2Shell and JCE when the affected software is present.
- Maintain tested backups, a rollback plan, update dates and verification results. For covered organisations, retain evidence appropriate to their obligations.
- Assign an owner to check advisories regularly. For PHP updates, involve the host: public CMS scanners cannot establish the running server patch level.
An important legal boundary
Even when a business is outside these particular rules, delaying a confirmed critical security update can still create serious operational and contractual risk. Where a site processes personal data, GDPR Article 32 also requires appropriate technical measures, and running software with a known, fixable vulnerability is hard to defend as appropriate. In practice, keeping the CMS, extensions and PHP updated is the site owner's responsibility.
Primary sources and patch references
Verify the latest release and vendor-specific backports before taking action. This guide records information available as of 26 October 2026.
Related security guides
Need a second opinion?
Start with a free public website check or describe the concern. Do not send credentials, raw customer data or full private logs. Any technical work beyond the free enquiry requires an agreed scope.