Insignary Closes SBOM Accuracy Gap With Binary-Level Clarity for Regulatory Risk

China and US risks leave Europe’s chip sector facing a bleak future, report warns

Báo cáo chung của EU Institute for Security Studies và Institut Montaigne cảnh báo ngành chất bán dẫn châu Âu đối mặt nguy cơ kép từ Trung Quốc (có thể hạn chế xuất khẩu khoáng sản quan trọng trong vài tuần) và sự phụ thuộc vào phần mềm, công cụ thiết kế của Mỹ (có thể bị vũ khí hóa qua luật như MATCH Act). EU nên tận dụng lợi thế sẵn có như ASML thay vì theo đuổi tự cung tự cấp chip, trong bối cảnh chi phí năng lượng cao, vốn tư nhân eo hẹp và ngành tiêu thụ chip suy giảm. Chips Act 2.0 của EU cũng đã chuyển sang ưu đãi nhu cầu thay vì mục tiêu 20% thị phần toàn cầu vào 2030.

Lập trình viên nên đọc bài này để hiểu cách các chính sách quốc gia—đặc biệt là Mỹ và Trung Quốc—thay đổi quy mô ảnh hưởng đến công nghệ vi mạch, từ đó giúp họ dự đoán xu hướng mới về công cụ lập trình, hợp tác quốc tế và khả năng phát triển hệ sinh thái phần mềm an toàn cho tương lai.

The CRA is not about open source

The EU Cyber Resilience Act (CRA) is widely cited as a win for open source security, but it is fundamentally a product-safety law modeled on CE-marking — it governs manufacturers and consumers, not projects, packages, or maintainers. Non-commercial open source is exempted from scope, but exemption is not the same as benefit. The CRA creates no maintenance fund, no inspection body, and no requirement for manufacturers to contribute upstream. Its due-diligence clause for open source dependencies actually incentivizes risk reduction (vendoring, replacing, or scanning) rather than upstream investment. The steward category adds obligations to foundations without creating anything manufacturers are required to purchase. SBOMs under the CRA are private liability artifacts held in technical files, not public transparency instruments. The real cost is that 'we passed the CRA' now occupies the policy slot where an actual open source maintenance regime would go, while the open source community continues to read itself into a law whose subject is manufacturers and consumers.

CRA’s First Connected-Products Deadline Is in Less Than 100 Days

The EU Cyber Resilience Act's Article 14 takes effect September 11, 2026, requiring manufacturers of connected devices to notify EU regulators of actively exploited vulnerabilities within 24 hours, with a detailed follow-up within 72 hours and a final report within 14 days. This applies retroactively to all supported products in the EU market, regardless of when they were deployed. Most manufacturers are unprepared. Key steps include building SBOM-based supply chain visibility, establishing a formal vulnerability disclosure process with a named decision-maker, testing emergency patch workflows, and maintaining up-to-date customer contact data by market. Non-compliance carries penalties up to €15 million or 2.5% of global annual turnover. The author, from Finite State (which offers a managed CRA compliance service), argues that teams starting now can still meet the September deadline and gain a competitive advantage as similar regulations converge globally.

Software Bill of Materials (SBOM) Explained

A comprehensive guide to Software Bills of Materials (SBOMs) covering what they contain, why they matter for supply chain security, and how to integrate them into container workflows. SBOMs are machine-readable inventories of every component in a software artifact, including transitive dependencies, licenses, and checksums. The guide explains the two dominant formats (SPDX and CycloneDX), how to generate SBOMs at build time using Docker BuildKit, how to pair them with provenance attestations and cryptographic signatures, and how to use them for continuous vulnerability monitoring and policy enforcement. It also addresses regulatory requirements (EO 14028, CISA, EU CRA), common misconceptions, and an SBOM maturity model to help teams assess their current posture.

AI hardware demand keeps Asia’s factories humming as the Iran war bites

June PMI data shows Asia's manufacturing sector expanding for the sixth or seventh consecutive month, driven largely by AI hardware demand — chips, servers, and data-centre equipment. China's high-tech PMI hit 53.5, Japan reached 54.8, and smaller economies like Malaysia, Vietnam, Taiwan, and the Philippines also posted growth. The AI build-out is acting as a buffer against geopolitical headwinds from the Iran conflict, which is raising energy costs and extending shipping times. Risks include concentration in a single demand cycle, rising input costs, and tightening US export controls reshaping supply chains — including a $13m chip seizure in Malaysia.

Super Micro says two Taiwan staff detained in probe involving its AI servers

A Taiwanese court has detained two Super Micro employees and an Albatron Technology executive as part of an investigation into alleged smuggling of Nvidia GB300-equipped AI servers to China. Prosecutors allege export documents were falsified to disguise the true destination of servers valued at roughly $22 million. This is the third enforcement action against Super Micro's Taiwan operations in months, following a May port seizure of 50 servers and a late June raid on multiple offices. Super Micro denies being a target of the investigation and says it has placed all questioned employees on administrative leave. The case adds to the company's troubled recent history, which includes a Hindenburg short-seller report, an auditor resignation, and a near-Nasdaq delisting. A separate US federal indictment from March described a $2.5 billion smuggling scheme involving Super Micro's co-founder.

Nvidia's Kyber AI rack is delayed to 2028

Nvidia's Kyber AI rack, designed to house 144 Rubin Ultra GPUs in a single cabinet, has slipped from 2027 to 2028 due to manufacturing difficulties with a multi-layer PCB midplane circuit board. The larger NVL576 system linking eight racks is also likely delayed. A backup plan to bolt two current-gen racks together was scrapped after cloud customers rejected it, leaving Nvidia with no proven solution for scaling its most powerful Rubin Ultra systems. The delay opens a window for rivals like Google and AMD at the high end, and sent Asian PCB stocks sliding. Despite this, Nvidia's near-term position remains strong: current Rubin systems are in full production, shipping this autumn to AWS, Azure, and Google Cloud, with data-centre revenue projected 20% above Wall Street forecasts.