The Cyber Resilience Act (CRA) establishes cybersecurity requirements across the entire lifecycle of products with digital elements, from secure design and development to post-release support. ^[1] Across three generators, all 85 artifacts appeared among the Top-3 results for their corresponding queries, and CodePoisonRAG achieved attack success rates between 0.80 and 0.93. ^[2] Researchers introduced CodePoisonRAG, a framework that transforms benign fixed-code entries into poisoned artifacts to influence Retrieval-Augmented Code Generation (RACG) systems. ^[3] Organizations need operational processes capable of moving quickly from detection to assessment, remediation, verification, and documentation rather than reconstructing information manually after an incident. ^[4] The CRA makes the traditional model of finding vulnerabilities, opening tickets, and closing them insufficient because it does not verify that the resulting software is secure. ^[5] The CRA's vulnerability-reporting requirements begin applying on September 11, ahead of the broader requirements scheduled for December 2027. ^[6] The attacker has no access to the victim's deployed knowledge base, retriever, re-ranker, generator, prompt, or defense mechanism and injects at most one artifact per anticipated programming task. ^[7] The CodePoisonRAG attack chain combines CWE-specific Vulnerability Injection, which embeds a selected source-to-sink flow, with Semantic Mislabeling, which adds false safety claims without repairing the vulnerable behavior. ^[8]