OpenSSF

🚨 New Tech Talk Alert 📅 Nov 2, 12 PM ET: Join OpenSSF to learn how an upstream-first strategy reduces tech debt & streamlines CRA compliance! Featuring experts from Linux Foundation, Ericsson, & ActiveState. Read: openssf.org/blog/2026/10... Register: zoom.us/webinar/regi...

💎 How do software attestations support due diligence? Eddie Knight explores how OpenSSF’s Gemara connects security policies, evaluations, enforcement, and audit evidence, with a practical look at CRA readiness. Read more: openssf.org/blog/2026/10...

Your Wednesday night #KubeCon plans? Sorted. Join OpenSSF + Defense Unicorns at ZarfFest for drinks, bites, and open source community. Nov. 11 | 6:30–9:30 p.m. Le Méridien, Salt Lake City Register: defenseunicorns.com/events/zarff...

OpenSSF just launched a new guide: Finding and Fixing Software Vulnerabilities Using AI, authored by David A. Wheeler. Learn how to prepare your setup, run AI effectively, and build deterministic safety nets for your code. Read & access the guide: openssf.org/blog/2026/10...

What happens when an AI agent can hide its tracks? CNCF’s Chris Aniszczyk joins CRob on What’s in the SOSS? to explore autonomous agents, disappearing evidence, and why independent observability matters. 🎧 Listen: openssf.org/podcast/2026...

From 1 ecosystem to 8. 🔐 GitHub expanded malware advisories using OpenSSF’s community-driven data, bringing broader coverage to developers with Dependabot malware alerts enabled. See shared security infrastructure in action: openssf.org/blog/2026/10...

Welcome Privateer to the OpenSSF Sandbox! 🎉 Privateer combines automated security checks with optional AI-assisted evidence review, flagging uncertain findings for human review. Explore the project and get involved: openssf.org/blog/2026/10...

Our new report, “Strengthening Software Supply Chain Security with OpenChain and OpenSSF,” explores how OpenChain's governance processes and OpenSSF's secure engineering practices work together. openssf.org/resources/st...

🚀 The Fall Security Slam is live! Join the open source community October 5–November 6 to strengthen your project’s security, earn badges, and put OpenSSF best practices into action. All projects are welcome! 🎥 Learn how to get started with Eddie: youtu.be/AvjltBoM4rE?...

🎙️ From upstream projects to downstream products, how do we manage open source risk as the regulatory landscape changes? Vincent Danen (Red Hat) joins What’s in the SOSS’ “Big Thoughts, Open Sources,” to explore that question in our latest episode. openssf.org/podcast/2026...

🎉 Welcome A-Team Systems, Emphere, DACHS IT GMBH, and JetBrains to OpenSSF! Live from #OpenSSFCommunity Day Europe in Prague, we’re sharing new members and CRA readiness resources to help strengthen open source security. openssf.org/press-releas...

🇨🇿 Heading to Prague for #OSSummit? Don’t miss Adrianne Marcum and Christopher Robinson (CRob) for “AI Everywhere, Trust Nowhere? Navigating Open Source Security, ‘AI Slop,’ and the New Attack Surface.” Add it to your agenda: sched.co/2Radz

September Newsletter is here! 📰 September brings a commitment to sustainable package registries, practical CRA guidance, new community security work, and more. Catch up on the latest OpenSSF updates: https://openssf.org/newsletter/2026/09/30/openssf-newsletter-september-2026/

Angie Jones, VP at the Agentic AI Foundation, joins What's in the SOSS talking about what it actually takes to run AI agents in production. 🎧 openssf.org/podcast/2026...

Heading to #KubeCon + #CloudNativeCon + Open Source #SecurityCon? Let’s connect at ZarfFest! 🎉 Join OpenSSF and Defense Unicorns for an evening of drinks, light bites, and great conversations with fellow builders, maintainers, and open source friends. defenseunicorns.com/events/zarff...

Open source participation creates business and career value. Explore IBM’s journey with RedHat and #ProjectLightwell, plus Jamie Thomas’s insights in conversation with CRob. What’s your strategy to give back? openssf.org/blog/2026/09...

Securing the open source supply chain is also about growing the community! 🌍✨ In this recap of the OpenSSF Summer Mentorship Lightning Showcase, discover how our talented mentees teamed up with seasoned mentors to tackle critical security challenges across projects. 🔗: openssf.org/blog/2026/09...

Ready to level up your open source project’s security posture? 🛡️ OpenSSF & CNCF TAG Security launched Security Slam 2026 (Oct 5–Nov 6) for ALL OSS projects! Prepare for the EU CRA, access Slack advisors, and earn badges. Read the blog: openssf.org/blog/2026/09...

AI speeds up development. Can your security keep pace? ActiveState CEO Abby Kearns joins What’s in the SOSS? to tackle AI velocity, CRA compliance and dependency debt. Know your dependencies. Hear her perspective. 🎧 Listen: openssf.org/podcast/2026...

AI moves fast. Critical infrastructure needs support. The OpenSSF Governing Board backs sustainable funding for public package registries: stronger security, reliable services, and continued free access for developers. We’re in. Join us: openssf.org/blog/2026/09...

🌱 September 11 has passed. What’s next for CRA compliance? Find your role and next steps with OpenSSF. Thanks to Roman Zhukov for inspiring our garden analogy and the Global Cyber Policy Working Group for helping it grow! Find your path: openssf.org/blog/2026/09...

Mila from AWS breaks down how OS projects can maintain secure infrastructure without financial strain. Discover how Gradle and Compiler Explorer leverage the AWS Open Source Promotional Credit Program to harden the global software supply chain. Read: openssf.org/blog/2026/09...

The September 11 CRA reporting milestone is here. Our new community guide explains manufacturers’ reporting obligations and how open source maintainers and stewards can prepare for collaboration when vulnerabilities affect downstream products. openssf.org/blog/2026/09...

AI changes the speed of vulnerability discovery, not the fundamentals of software security. Sal Kimmich and Simon John examine the UK GDS guidance, the case for “open by default,” and why durable enforcement must focus on real security practices. openssf.org/blog/2026/09...

AI is reshaping software engineering and security, but its impact cuts both ways. OpenSSF Board Chair Mark Russinovich, CTO, Deputy CISO and Technical Fellow at Microsoft Azure, joined us June 26 to discuss AI, supply chain security and vulnerability management. 🎧 openssf.org/podcast/2026...

From our Happy Hour Reception at The Cosmopolitan to deep dives into software supply chain security, AI findings, and the hallway track, OpenSSF was proud to advance open source security at Hacker Summer Camp 2026! Read the full recap: openssf.org/blog/2026/09...

The EU Cyber Resilience Act is reshaping responsibility across the software supply chain. In the latest What’s in the SOSS?, Madalin Neag breaks down what the CRA means for open source, software stewards, maintainers, and organizations preparing for compliance. openssf.org/podcast/2026...

📰 The August Newsletter is here! It is packed with exciting updates within the OpenSSF community, including how Ericsson solved CRA obligations with over 1,400 upstream fixes, and key strategies for securing agentic AI ahead of AGNTCon NA. Read: openssf.org/newsletter/2...

📰 The August Newsletter is here! It is packed with exciting updates within the OpenSSF community, including how Ericsson solved CRA obligations with over 1,400 upstream fixes, and key strategies for securing agentic AI ahead of AGNTCon NA. Read: openssf.org/newsletter/2...

We are excited to announce that #BOMHort (formerly SeeBOM) has officially joined the OpenSSF family as a Sandbox Project!!! Read the full announcement on our blog to learn more about BOMHort: openssf.org/blog/2026/08... Get involved on this project: openssf.org/projects/bom...

How did one team improve security across the entire open source ecosystem? Ericsson took on the EU Cyber Resilience Act (CRA) by eliminating private forks and going straight to the source. Read the full case study: openssf.org/blog/2026/08...

We're heading to #AGNTCon + #MCPCon North America this October! 🚀 If you're working on agent infrastructure, tooling, or production AI systems, come see us at the OpenSSF booth to grab some swag and chat! 👋 Read more on our blog: openssf.org/blog/2026/08...

How does a major telecom leader solve EU Cyber Resilience Act (CRA) compliance? By going 100% upstream. By eliminating custom patches and fixing vulnerabilities at the source, Ericsson lowered long-term lifecycle costs while strengthening the global supply chain. openssf.org/blog/2026/08...

Hiding behind a private code fork to avoid EU CRA compliance is a $250,000 mistake per release. Check out the latest podcast with Dave Russo from Red Hat to learn more: openssf.org/podcast/2026...

In Episode #69 of What’s in the SOSS?, we've invited Roman to break down what the CRA means for open source maintainers, stewards, and manufacturers. 🎧 Listen & learn how to prepare your team & bake "compliance as code" into your development lifecycle: openssf.org/podcast/2026...

With CRA enforcement kicking off in Sept, manufacturers face new obligations to demonstrate security due diligence for the open source components they consume. Learn how the ORBIT Launchpad is helping organizations shift from reactive patching to proactive compliance. 📺 youtu.be/gAv60r9ZRVs?...

Join us for the upcoming OpenSSF Tech Talk to learn how industry leaders are navigating regulatory milestones and strengthening software supply chain security. 📅 August 20, 1 PM ET / 7 PM CET Read & register: openssf.org/blog/2026/08...

This month, What’s in the SOSS? is going all in on CRA readiness, starting with Megan Knight, PMP, Chair of the OpenSSF Awareness SIG. Learn what you can do today, and why the open source community doesn’t have to figure this out alone. openssf.org/podcast/2026...

Meet Katherine Druckman, one of our incredible ambassadors at OpenSSF! 🌟 As a longtime friend of the OpenSSF community, Katherine brings a deep understanding of open source and security to her ambassador mission. www.youtube.com/shorts/d6ih_...

OpenBao v2.6 is here! 🥟 This is our most collaborative release to date, featuring contributions from 42 first-time contributors, 27 individuals contributing multiple changes, and 8 users with double-digit change counts. Learn about this new release: openssf.org/blog/2026/08...

Mila Zhou recently sat down with Yesenia Yser on the What's in the SOSS podcast to share her path from accounting to her role as a Senior Open Source & Security Program Manager at Amazon Web Services (AWS). openssf.org/podcast/2026...

📰 The July 2026 OpenSSF Newsletter is out, featuring the newly published schedule for OpenSSF Community Day Europe in Prague! Check out the full issue to catch up on the latest project releases and regulatory updates across the community: openssf.org/newsletter/2...

The schedule for #OpenSSFCommunity Day Europe 2026 (Oct 6 in Prague) just dropped! Get a sneak peek at the single-day event co-located with #OSSummit Europe. Learn what sessions are happening, who's speaking, and why you should attend. Read: openssf.org/blog/2026/07...

What is a Dependency Firewall? 🧱 A dependency firewall is an install-time security checkpoint that evaluates open source software packages before they execute. Read the analysis from OpenSSF's member Aikido Security: https://openssf.org/blog/2026/07/28/what-is-a-dependency-firewall/

New What's in the SOSS? 🎧 CRob talks with Michael Winser, co-founder of Alpha-Omega on turning AI into the maintainer's power tool: AI assists on maintainers' terms, not more vulnerability slop. openssf.org/podcast/2026...

The CRA is shifting legal responsibility for software security back to manufacturers. With mandatory vulnerability reporting starting September 2026. Get ahead of compliance with the free eBook, "Built to Last" by Sal Kimmich (OpenUK). openssf.org/resources/bu...

What happens at OpenSSF Community Day? Hannah shares her key takeaways from her first time attending Community Day in Minneapolis. #OpenSSFCommunity Day Europe is coming this fall, read the blog and see why Hannah enjoyed her first Community Day: openssf.org/blog/2026/07...

Open source adoption across Africa is growing at an incredible rate. OpenSSF ambassador Ejiro Oghenekome shares key takeaways from representing OpenSSF and the BEAR Working Group at #AfricaCyberFest. Read the blog: openssf.org/blog/2026/07...