OpenSSF

🎉 The 2025 OpenSSF Annual Report has officially arrived!!! We invite you to celebrate another year of progress, creativity, and collaboration shaping a safer, more resilient open source community. Download the report: openssf.org/download-the-2… #AnnualReport #OSSSecurity

In the latest episode of What's in the SOSS?, Yesenia Yser talks with Mihai (MM) Maruseac, OpenSSF AI/ML Working Group Lead and Security & Privacy expert at @OpenAI, about securing AI models with the OpenSSF Model Signing (OMS) specification. 🎧 hubs.la/Q04ptqcr0

What happens when your weekend project becomes global infrastructure? On the latest "What’s in the SOSS?" podcast, Linux kernel icon Greg Kroah-Hartman talks kernel security, the EU CRA, and why your team needs to update today. 🎧 openssf.org/podcast/2026/0…

Despite widespread education campaigns over the last year, macro-level unfamiliarity with the EU CRA has actually widened to 66% globally. Read the new blog by Angelah Liu to see what changed (and what didn't) across 2 years of data. openssf.org/blog/2026/06/2…

The June 2026 OpenSSF Newsletter is here! The open source security landscape is moving faster than ever, and this month’s edition covers the critical shifts you need to know about. Read the full newsletter: openssf.org/newsletter/202…

For too long, security academia and open source maintainers have lived on different planets. SCORED '26 is bringing academics and open source practitioners into the same room to tackle security challenges. Read the blog from Justin Cappos: openssf.org/blog/2026/06/2…

Sponsorship is open for OpenSSF Community Day Europe 2026 — October 6, Prague. Keynote slots, exhibit space, social and email recognition, post-event data report. Platinum/Gold/Silver. Deadline Sept 4: openssfevents@linuxfoundation.org hubs.la/Q04mkW3k0

Open source is a powerful career accelerator; it's not just about code, but about influence and collaboration. Hear insights from Jamie Thomas on "Big Thoughts, Open Sources" with CRob. #Leadership

How did the "Mini Shai-Hulud" attack compromise 170+ packages while maintaining valid SLSA Build L3 attestations? Read the full blog to see where SLSA’s boundaries fall and how to secure your pipeline with defense in depth. 🔗: openssf.org/blog/2026/06/1…

The 2026 CRA Awareness & Readiness Report by The Linux Foundation Research and OpenSSF is officially out, and the data reveals a sobering reality for the global software ecosystem as the European CRA deadlines approach. Download the report: openssf.org/resources/publ…

How do we move from isolated security patches to a systemic, resilient software supply chain? Read the #OpenSSFCommunity Day NA recap and see how the community has been unifying tools, navigating AI, and securing the OSS. openssf.org/blog/2026/06/0…

Abandoned projects introduce hidden risks into your software supply chain. On the latest episode of the What’s in the SOSS? podcast, host CRob sits down with Isaac Wuest from HeroDevs to examine End-of-Life (EOL) open source software. hubs.ly/Q04jLjnk0

Read the blog: openssf.org/blog/2026/05/2…

Learn why machine-readable security signals provide the practical foundation for automated due diligence. These signals function as voluntary mechanisms for upstream transparency, not formal assurances or a transfer of legal liability. Link in the comments.

🚀 Software risk is becoming a board-level issue. Mike Vizard talks with Christopher Robinson of OpenSSF about the EU Cyber Resilience Act, vulnerability reporting, software dependencies and using business-focused risk language. Watch: techstrong.tv/videos/intervi…

Live from #OpenSSFCommunity Day North America! 🎉 We're celebrating an incredible quarter of growth and officially welcoming our newest members to the Foundation: ActiveState, Aikido Security, Minimus, TuxCare, and the FreeBSD Foundation! hubs.ly/Q04ht-_70

We've seen a concerning rise in targeted attacks on upstream registries like npm and PyPI through malicious packages. But how do you actually defend against them day-to-day? Learn how to strengthen your supply chain security: hubs.la/Q04hl3cR0

AI is flooding open source projects with vulnerability reports faster than maintainers can handle. @OpenSSF and @CNCF just dropped the free playbook. "This is math, not magic. And with the right practices, it is manageable." Download your copy: hubs.la/Q04h9_Fy0

From UI/UX to OpenSSF Contributor: Ejiro Oghenekome on What’s in the SOSS? Ejiro shares insights from her "100 Days of Cybersecurity" challenge and her leadership in authoring the "Beginner to Builder" series. hubs.la/Q04h7zm_0

Is your organization ready for the European Cyber Resilience Act (CRA)? New EU rules mandate "security by design" for digital products. The second Linux Foundation Research survey launches this June, learn why the ecosystem is falling behind. hubs.la/Q04gZHss0

The OpenSSF released the Secure Coding Guide for #Python (PySCG). This practical resource offers 50+ rules and code examples to help developers mitigate vulnerabilities in open source software. 🐍 Read the blog: openssf.org/blog/2026/05/1… Access the guide: best.openssf.org/Secure-Coding-…