They say "actively exploited vulnerability". So from the time you know the vulnerability is actively exploited is how I read it.
If it were not exploited, then telling 27 governments would create 27 opportunities for leaks, which would add considerable pressure and disturb your best judgment. But the phrasing says "actively exploited".
FWIW I once had a vulnerability reported to a widely used piece of software I alone maintained. I took a couple of days to fix and distribute it. Wrote a patch on the first evening, slept on it, looked hard on it the next day, had someone else review it, and finally released it about 40 hours after the report. Much more speed would have been difficult to achieve in a careful, responsible manner. My best friend once did something similar in 36 hours as part of a large team, and that was 36 really, really stressful hours. 24 sounds hard to my ears.
Very difficult to make and distribute a reliable fix in that time. Knowing that the leaks may start in 25 hours... that would be bad.
It's not up to one that did the fuck up to decide when people affected by the fuckup gets to know it happened.
I live in a country whose law explicitly protects the freedom of action. You can choose what you want to do and exceptions need good justification. The justification has to be a great deal better than "didn't do your fucking job" because the requirements on the fucking job are set out by contracts. Vendors and customers decide on the contracts between them.
That’s what the language requires. I don’t really care what contracts you have with people, if your software has an actively exploited bug in it, people should know.
There has to be nuance. Things that might _literally_ kill people probably shouldn't be reported the in the same way as a bug in a 15-year-old ink-jet printer driver.
The problem is, its actively being exploited. You're just keeping systems and people uninformed and unable to make mitigations.
Who would you require, by law to inform people?
> The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any incident having impact on the security of the product with digital elements.