#OpenSSF
LightNews LightNews
newsen.bsky.social
OpenSSF Expands Membership and AI Security Initiatives for Software Safety#United_States#Salt_Lake_City#AI_Security#Software_Development#OpenSSF
OpenSSF Expands Membership and AI Security Initiatives for Software Safety
The Open Source Security Foundation (OpenSSF) welcomes new members and expands AI security resources to enhance software protection in a rapidly changing landscape.
third-news.com
November 9, 2026 at 4:28 PM
openssf.org
Welcome Beautiful Majestic Dolphin, DevGuard, and UElement Technologies to OpenSSF!

Announced at Open Source #SecurityCon North America, our newest members join a growing community advancing open source security.

Read the announcement: openssf.org/press-releas...
November 9, 2026 at 3:11 PM
openssf.org
Building toward CRA readiness? Start with the OpenSSF ecosystem.

Project Sylva shares what worked and what’s still hard with sigstore, SLSA, OpenSSF Scorecard, the Best Practices Badge, OSPS Baseline, Security Insights, and the CRA Readiness Guide.

openssf.org/blog/2026/11...
November 6, 2026 at 3:04 PM
openssf.org
🏆 Kubescape earned all six badges in this year’s Fall Security Slam with OpenSSF tools.

Congrats to the contributors. Looking forward to seeing the community at #KubeCon. Stop by OpenSSF booth #313!

openssf.org/blog/2026/11...
November 5, 2026 at 7:27 PM
linuxfoundation.org
AI security tools speed up security work by 17%, but false positives from AI scanning add 30% to workloads. That’s one of the tradeoffs 172 practitioners describe in a new LF Research report with OpenSSF.

Read it here: https://bit.ly/3WC1h6o
State of AI Impact on Software Security and Cybersecurity 2026
State of AI Impact on Software Security and Cybersecurity 2026
bit.ly
November 9, 2026 at 4:51 PM
openssf.org.web.brid.gy
From Sigstore to CRA readiness: Sylva’s journey with OpenSSF
Sylva’s security work relies heavily on the OpenSSF ecosystem. From supply chain tooling with Sigstore and SLSA to adopting OpenSSF Scorecard and Best Practices badges, learn how Sylva is approaching EU Cyber Resilience Act (CRA) readiness and building verifiable trust for downstream operators.
openssf.org
November 7, 2026 at 2:09 PM
golangoss.bsky.social
scorecard by @openssf (⭐️ 5814)

OpenSSF Scorecard - Security health metrics for Open Source

#go
November 4, 2026 at 5:10 PM
ryandaaldo.bsky.social
bundleferry --advise recommends a bundler and reports its security posture from OpenSSF Scorecard and OSV. Deterministic rules with citations, never an invented score. Every claim is checked by an independent verifier. https://github.com/ryanda9910/bundleferry
bundleferry --advise recommends a bundler and reports its security posture from OpenSSF Scorecard and OSV. Deterministic rules with citations, never an invented score. Every claim is checked by an independent verifier.
November 8, 2026 at 1:00 AM
openssf.org.web.brid.gy
OpenSSF Community Day Europe 2026: Driving Systemic Security and Operational Resilience in Open Source
At OpenSSF Community Day Europe 2026 in Prague, more than 200 attendees gathered onsite as practitioners, maintainers, policymakers, and security leaders came together across two distinct tracks: the Main Track (South Hall 3B) focusing on core community strategy, policy, and tooling, and the dedicated SCORED Track (South Hall 3A) highlighting academic research and technical supply chain studies.
openssf.org
November 7, 2026 at 2:09 PM
pedro-analytics.bsky.social
A Linux Foundation report, produced with Red Hat, Futurewei, OpenSSF and LF AI & Data, found that 1 in 4 incoming pull requests (proposed code changes) are low-quality AI output. Burnout is now the top concern for large projects. Only 1 in 3 projects have a formal AI contribution policy. 2/5
November 8, 2026 at 6:32 PM
newsen.bsky.social
AI-Fueled Coding Is Outpacing Security Reviews, New Study Unveils Serious Gaps#Canada#Vancouver#Linux_Foundation#OpenSSF#ActiveState
AI-Fueled Coding Is Outpacing Security Reviews, New Study Unveils Serious Gaps
A recent research study reveals alarming findings about AI in coding, indicating that rapid development is outpacing security reviews, raising significant concerns for organizations.
third-news.com
November 9, 2026 at 4:32 PM
heckj.bsky.social
Cool podcast with two folks that have been doing some great open source work in Swift - Ev Cheng and Sam Khouri - talking about the work in Swift to generate SBOM's when building your Swift projects. openssf.org/podcast/2026...
Accurate Swift SBOMs: Baking Security into the Toolchain
Join Apple engineers Ev Cheng and Sam Khouri on the OpenSSF podcast to explore native Swift SBOM generation, SE-0509, and the future of supply chain security.
openssf.org
November 3, 2026 at 9:08 PM
openssf.org.web.brid.gy
Case Study: Kubescape Completes All Six Security Slam Badges with OpenSSF
Kubescape completed all six project-level badges in the Fall 2026 Security Slam, bringing maintainers and community contributors together to strengthen security across its open source Kubernetes platform. Learn how 150+ hours of community contribution helped achieve OSPS Baseline Level Two status and harden 12+ repositories.
openssf.org
November 6, 2026 at 2:09 PM
openssf.org
Join OpenSSF and Defense Unicorns at ZarfFest on November 11. Meet fellow maintainers, swap stories with builders, and make new connections across cloud native and software security.

defenseunicorns.com/events/zarff...
ZarfFest: A Defense Unicorns x OpenSSF Happy Hour
ZarfFest: A KubeCon Happy Hour Presented by Defense Unicorns and OpenSSF Join Defense Unicorns and OpenSSF for ZarfFest, a happy hour bringing together the open source, cloud native, and software sec...
defenseunicorns.com
October 29, 2026 at 8:15 PM
bagder.mastodon.social.ap.brid.gy
The OpenSSF scorecard scores #curl 8.9 out of 10. https://scorecard.dev/viewer/?uri=github.com/curl/curl

Yeah...
OpenSSF scorecard report
OpenSSF scorecard report
scorecard.dev
October 27, 2026 at 4:14 PM
openssf.org
📊 AI speeds up coding, but maintainers estimate 1 in 4 pull requests are “AI slop.” New research supported by OpenSSF explores the gains, challenges, and need for clear AI contribution policies.

www.linuxfoundation.org/research/oss...
Navigating Open Source Software Development in the Generative AI Era
Navigating Open Source Software Development in the Generative AI Era
www.linuxfoundation.org
October 30, 2026 at 7:05 PM
openssf.org.web.brid.gy
OpenSSF Newsletter – October 2026
October brought four new members and fresh CRA resources from Prague, a practical guide to finding and fixing vulnerabilities with AI, and a new Sandbox project. Next stop: Salt Lake City for Open Source SecurityCon on November 9.
openssf.org
October 31, 2026 at 2:09 PM
opensource.org
The OSI and partners are delighted to invite you to submit a proposal for a talk, and join us for the 4th edition of the Open Source & EU Policy devroom at FOSDEM

https://opensource.org/blog/fosdem-2027-cfp-for-open-source-eu-policy-devroom
FOSDEM 2027: CFP for Open Source & EU Policy Devroom
The OSI, in collaboration with APELL, Eclipse Foundation, Github, Linux Foundation Europe, Mozilla, NLNET Labs, Open Forum Europe, and OpenSSF, are delighted to invite you to submit a proposal for a talk, and join us for the 4th edition of the Open Source & EU Policy devroom at FOSDEM.
opensource.org
October 28, 2026 at 5:13 PM
fossfables.bsky.social
OSERA is basically a maturity self-assessment — governance, security, community health — that projects score themselves on. I'm curious how useful that is next to OpenSSF Scorecard, where the checks are automated and you can't flatter yourself.
October 28, 2026 at 11:35 PM
planetfoss.net.web.brid.gy
FOSDEM 2027: CFP for Open Source & EU Policy Devroom (Open Source Initiative)
The OSI, in collaboration with APELL, Eclipse Foundation, Github, Linux Foundation Europe, Mozilla, NLNET Labs, Open Forum Europe, and OpenSSF, are delighted to invite you to submit a proposal for …
opensource.org
October 28, 2026 at 5:51 PM
opensource.google
This Week in Open Source #21 is live! 🎃🌐
👻 Supply-chain ghosts (GhostAction & LiteLLM) & EU CRA fork costs
🤖 200+ OSS AI contribution policies, Bootstrap triage & Genkit Go 1.14 HITL
⚡ Native PyTorch TorchTPU, CNCF llm-d 1.0 & FOSDEM 2027 devrooms: goo.gle/twios-21
Title card for This Week in Open Source #21 (Oct 30, 2026) by Daryl Ducharme & Shane Glass (Google Open Source Programs Office): What Haunts Open Source Right Now—& How Humans Stay at the Controls. Summarizes 9 curated open source reads on supply-chain security (LiteLLM, GhostAction, EU CRA $258K fork costs), 200+ OSS AI contribution policies, Bootstrap triage, Genkit Go 1.14 HITL, OSI on open weights vs. open source AI, TorchTPU, CNCF llm-d 1.0, and 77 FOSDEM 2027 devrooms. Card 2 of 4 for This Week in Open Source #21: Supply-Chain Ghosts & Human-Led AI Workflows. (1) Supply-Chain Security: $258K Fork Cost — LiteLLM wheel compromise, GhostAction mining 345+ git histories, core PHP CVEs, and OpenSSF EU Cyber Resilience Act study. (2) Maintainer Boundaries: 200+ Policies — Over half of tracked OSS AI policies ban unreviewed PR walls while 61 carve out translation; Bootstrap twbs/triage preps fixes offline under human control. (3) Safe Automation: Typed HITL — Genkit Go 1.14 human approvals and OSI open source AI clarity. Card 3 of 4 for This Week in Open Source #21: TorchTPU, CNCF llm-d 1.0 & Nov–Jan Event Calendar. Features TorchTPU native PyTorch backend co-built by Google and Meta (.to("tpu") across 5,000+ models) and CNCF Sandbox llm-d 1.0 distributed vLLM inference across GPUs & TPUs alongside 77 FOSDEM 2027 devrooms. Lists upcoming conferences: Nov 4–5 OSFF New York, Nov 6–7 SeaGL, Nov 9–12 KubeCon + CloudNativeCon NA, Nov 13–14 SFSCON, Dec 1–11 Yocto Summit & OSS Japan, and Jan 30–31 FOSDEM 2027. Card 4 of 4 (Bluesky Action Card) for This Week in Open Source #21: Explore All 9 Open Source Reads & Event Links at https://goo.gle/twios-21. Highlights editors Daryl Ducharme & Shane Glass (@opensource.google) and featured communities and conferences on Bluesky: @opensource.org, @cncf.io, @linuxfoundation.org, @allthingsopen.bsky.social, @seagl.org, and @fosdem.org (Brussels, Jan 30–31).
October 30, 2026 at 6:35 PM
ryandaaldo.bsky.social
bundleferry --advise recommends a bundler and reports its security posture from OpenSSF Scorecard and OSV. Deterministic rules with citations, never an invented score. Every claim is checked by an independent verifier. https://github.com/ryanda9910/bundleferry
bundleferry --advise recommends a bundler and reports its security posture from OpenSSF Scorecard and OSV. Deterministic rules with citations, never an invented score. Every claim is checked by an independent verifier.
October 27, 2026 at 1:00 AM
ossalt.bsky.social
OSSのセキュリティ欄に「未評価」とあったら、どう判断する？

「未評価」はOpenSSF Scorecardの点数がない状態で、危険という判定ではありません。

確認したいのは①脆弱性の報告窓口（SECURITY.md）②依存ライブラリの更新体制③リリースの継続性。スコアが高くても運用設定まで安全になるわけではありません。

ossalt.jpでは各ツールのセキュリティ欄に確認材料を掲載しています。選び方はこちら。
自前で動かすソフトの選び方 | ossalt.jp
オープンソースへの乗り換えで後悔しないための確認項目。ライセンス、セキュリティ、更新の継続性、運用コストの見積もり方。
ossalt.jp
October 29, 2026 at 3:15 AM
sergiocuellar.bsky.social
Security Slam 2026 – Fall edition
The Open Source Security Foundation (OpenSSF) is partnering with the Cloud Native Computing Foundation (CNCF) Security Technical Advisory Group (TAG Security) to support the 2026 Security Slam at…
www.cncf.io
October 26, 2026 at 6:39 PM
offseq.bsky.social
HIGH severity: npm package '@capsense/ccx-welcome-page' v99.99.100 contains malicious code contacting risky domains. Remove or replace this version now. https://radar.offseq.com/threat/malicious-code-in-capsenseccx-welcome-page-npm-f31ee7cef51f2a34 #OffSeq #npm #ThreatIntel
Malicious code in @capsense/ccx-welcome-page (npm)
The OpenSSF Package Analysis project flagged the npm package '@capsense/ccx-welcome-page' at version 99.99.100 as malicious. The determination is based on the package's network communication with a domain known for malicious activity. No fu
radar.offseq.com
October 26, 2026 at 3:00 AM