I just read that they changed their mind, the funding was approved just hours before the deadline. https://www.theverge.com/news/649835/cve-cybersecurity-program-contract-renewed
The European Union has launched its own vulnerability database which is still in its beta phase, though: https://euvd.enisa.europa.eu/
A much more depressing (and perhaps more realistic) overview of what could happen and the options. https://www.theregister.com/2025/04/18/splintering_cve_bug_tracking/
