2026-W33 looking ahead — items already in motion: a CRA reporting clock at four weeks, standards approval that will not beat it, an exploited flaw with no patch in existence, seven further flaws with no fix coming, and twelve thousand Polish clinics who each owe a notification

Items already in motion at the close of ISO week 2026-W33. Each carries a source and a date; none is a prediction.

• The Cyber Resilience Act's reporting obligations begin on 11 September 2026 — four weeks out, and the first hard operational clock in the regulation. ETSI's approval procedure for the 17 draft harmonised standards "will run until mid-September to mid-November 2026, depending on the vertical" (ETSI, 2026-08-13), so no presumption-of-conformity route will be available in the covered product categories before the reporting duty starts. The two are independent obligations and the second does not wait for the first.

• GeoServer's unauthenticated SQL injection has no CVE and no vendor patch, and is being exploited. watchTowr recorded hundreds of exploitation attempts within hours of the 12 August disclosure (SecurityWeek, 2026-08-14). Until OSGeo ships a fix, taking query endpoints off the public internet is the whole remediation — and GeoServer sits under public-sector geoportals and INSPIRE spatial-data services across Europe.

• Seven further flaws tracked this week have no fix in existence, beyond the GeoServer injection above. ShieldBreak, the published bypass of Microsoft's July fix for the Defender privilege-escalation flaw, is listed as tested on Windows Server 2025 and Windows 11 25H2 with no patch available and no vendor comment at publication (Cyber Kendra, 2026-08-12). Three FreeBSD CAM Target Layer pre-authentication kernel primitives behind TCP/999 were answered with a manpage warning rather than a code fix, and ship enabled by product design on TrueNAS Enterprise high-availability clusters (Calif, 2026-08-06). Three of the five NatJack NAT primitives carry no identifier and no vendor fix, and the Linux change for the one that does is recorded by the researcher as a partial mitigation.

• Around 12,000 Polish medical facilities each owe their own patients a notification over the MyDr breach, because the data-protection authority has confirmed the duty rests with the healthcare controllers rather than the platform (Gazeta Prawna, 2026-08-13); the facility count is reported at around 12,000 (Notes from Poland, 2026-08-13). MyDr itself has stated it cannot yet say what was taken, so the notifications and the scoping are proceeding in the wrong order.

• The Dutch Cyberbeveiligingswet registration obligation is live now, not pending. NCSC-NL states the duty applies from the Act's entry into force on 15 August 2026, with registration through the national entity register gated by eHerkenning at level EH2+ or SSOnRijk (NCSC-NL, 2026-08-15); no transition window is described.

• The Cl0p PTC Windchill extortion wave is between claim and confirmation. A leak-site tracker recorded 44 named victim listings on 12 August including a Swiss and a Dutch organisation, while BleepingComputer counts 43 named through exploitation of the Windchill flaw; two named organisations have since responded — Philips describing a contained single-server event and Shell saying it is investigating — neither attributing its incident to that flaw, and no other named victim has commented (BleepingComputer, 2026-08-14). Organisations running exposed Windchill or FlexPLM instances are in the window where a scoped exposure check and a webshell hunt cost less than waiting for the listing.

• Swiss federal administrative units have until 1 January 2027 to have built their own information security management system under the federal ordinance this pipeline tracks — four and a half months out, carried forward as a standing date rather than a new development.