Published: August 5, 2026
Last modified: August 5, 2026
Hello,
The summer holidays are in full swing across much of the Northern Hemisphere. While many people are taking a well-deserved break, the embedded security world is not.
This edition brings together a selection of news and resources from the past few weeks.
And I also wanted to share five embedded security mistakes I still see in 2026. Some of them are old, some are new, and some are practices that worked reasonably well in the past but no longer do.
My list for summer 2026 is:
- Designing products that cannot accept major software upgrades.
- Measuring security by CVE counts.
- Using telemetry as the primary solution for vulnerability management.
- Treating compliance as the objective rather than the outcome.
- Believing Secure Boot alone makes a product secure.
I hope you’ll find ideas or tools in this newsletter that help you build more secure embedded products and avoid mistakes.
If you’d like to discuss any of the topics I cover today, just reply to this message.
See you soon,
Marta
Linux kernel development
LWN continues its coverage of the Linux Storage, Filesystem, Memory Management, and BPF Summit (which took place in May). Memory management can be a complex topic, but advances in this area are often directly relevant to embedded developers. This year, there were talks about protecting BPF programs and improvements to the per-CPU memory allocator.
LWN summary article: https://lwn.net/Articles/lsfmmbpf2026/
Controversies around AI usage in open source
Approaches to AI in open source vary widely, from actively encouraging its use to imposing a complete embargo.
Linus has shared his opinion regarding AI usage in the Linux kernel which is accepting it as an useful tool:
https://lore.kernel.org/linux-media/CAHk-=wi4zC+Ze8e+p3tMv8TtG_80KzsZ1syL9anBtmEh5Z40vg@mail.gmail.com/#t
Many open source projects have AI policies now. Have you read the one(s) of the project(s) you contribute to?
Old UEFI shims vulnerable
Researchers have found old UEFI shims (first-stage bootloaders) that could be used to bypass secure boot. They have since been revoked, but this is a good reminder that signed binaries can still contain bugs and can easily be forgotten. This case affects UEFI, but a similar situation could happen with other secure boot implementations.
Detailed article:
https://www.welivesecurity.com/en/eset-research/forgotten-uefi-shims-undermining-secure-boot/
CRA updates
The FAQ for the Single Reporting Platform was updated in June… and then again in July. New information includes the fact that reporting will require an EU Login account, and that manufacturers are expected to start using the platform only after receiving their first notification to do so.
The current version of the FAQ:
https://www.enisa.europa.eu/topics/product-security-and-certification/single-reporting-platform-srp
SRP factsheet: https://www.enisa.europa.eu/media/57221
They have also published first detailed guides (with screenshots!):
- On how to submit a notification: https://www.enisa.europa.eu/cra-srp-ar-notification-submission-and-update
- And how to create an account: https://www.enisa.europa.eu/cra-srp-ar-user-registration
ENISA has also published the “SME Cyber Resilience Maturity Assessment Model”:
https://www.enisa.europa.eu/publications/sme-cyber-resilience-maturity-assessment-model
It provides a framework for assessing cybersecurity maturity in small companies. One important caveat, however: achieving the highest score does not mean your organization is ready for the CRA. Rather, it identifies possible directions for improvement.
Another interesting publication from ENISA is the “ENISA Secure by Design and Default Playbook,” which contains secure-by-default design examples:
https://www.enisa.europa.eu/publications/enisa-secure-by-design-and-default-playbook, and the accompanying Git repository is available here: https://github.com/enisaeu/enisa-sbd-playbook/
And that’s still not the end… the European Commission has also published the final version of the CRA Guidelines:
https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation
Embedded technology polls
We’ve run a number of polls this month. Here are our results. Among our readers, vendor kernels are still strong, SWUpdate and RAUC have similar usage base, and some projects are affected by RAM prices.
Announcements
There’s one last available place for the Embedded Security course starting on August 17th:
https://ygreky.com/embedded-security-yp/
If you’re planning your CRA compliance work, we announced the upcoming CRA Readiness Program yesterday. The first cohort starts on October 19th:
https://ygreky.com/cra-readiness-program/
And on a personal note, my new “Yocto Cookbook” is now available for pre-order: https://www.amazon.com/dp/1807607534
Where we were
- July 8 webinar: “The Cyber Resilience Act: What Embedded Developers Need to Know” together with Mind
Where you can meet us
- Kernel Recipes, Paris – September 2026
- Open Source Summit Europe and Embedded Linux Conference Europe, Prague – October 2026
- EU CRA Day at electronica, Munich – November 2026
