The EU's 24-hour cybersecurity vulnerability reporting deadline is too short