Published on 28 October 2026, version 2.0 of the GCVE-BCP-02 guide describes vulnerability handling and coordinated disclosure as a complete operational process, from preparation to lessons learned, and ties it to the reporting obligations of the European Cyber Resilience Act. It adds an annex on coordination between upstream projects, distributions, integrators and manufacturers in open source ecosystems.
