23:40, on call, and a flaw rated ten out of ten.

Kasper was on call the night it started, which meant his phone lay on the kitchen table next to the advent calendar his daughter had made him promise not to open early. It buzzed at 23:40. Then again. Then it did not stop. A weakness had been found in a tiny piece of free software that keeps a kind of diary of everything a computer does, and it was used almost everywhere. It got the highest danger score there is: ten out of ten.

The way it worked was almost insulting. A criminal did not need to break in. They only had to get one specially written sentence into that diary, typed in as a username or a search, and the computer would obey it. Kasper knew the diary software was somewhere in his company's systems. He just did not know where, or how many times, and every minute he spent searching, criminals were combing the internet for the computers he had not reached yet. Around two in the morning a thought arrived and would not leave: the system he was trying to save was the one that switched the heating on and off in thousands of homes, in December.

Under the Cyber Resilience Act, the online service behind a gadget counts as part of the product. Its building blocks must be kept up to date all the time, not twice a year. An actively exploited weakness must be reported to the authorities within 24 hours, and customers told what to do. Kasper still gets the call. He just gets to go back to bed.