By Angelah Liu, Linux FoundationÂ
TL;DR:
OpenSSF Community Day Europe 2026 (October 6 in Prague), focuses on open source software security, regulatory compliance like the EU CRA, and AI supply chain risks. The one-day event features technical sessions on tools like VEX, Gemara, and Sigstore, offering direct collaboration with maintainers and security experts.
Between evolving regulatory mandates like the EU Cyber Resilience Act (CRA) and the rise of AI-driven vulnerabilities, securing open source code has become a baseline requirement for engineering teams, not an afterthought.
The official Schedule for OpenSSF Community Day Europe 2026 is now live. Co-located with Open Source Summit Europe in Prague on October 6, 2026, this single-day event brings together open source maintainers, security researchers, enterprise contributors, and policy experts for a full day of technical exchange. Whether you’re looking to harden your CI/CD pipelines, get ahead of upcoming compliance frameworks, or simply talk shop with the maintainers behind the tools you rely on, this year’s schedule has a lot to offer.
Session Highlights
Keynote: Welcome & Opening Remarks
Steve Fernandez, General Manager of OpenSSF at the Linux Foundation, kicks things off at 9:00 CEST with the opening keynote, setting the tone and priorities for the day ahead.
EU Regulations & Governance
Right after lunch, Roman Zhukov (Red Hat), Daniel Appelquist, Madalin Neag (OpenSSF), and Megan Knight (Arm) take the stage at 13:55 CEST for Operationalizing the CRA and Shaping OpenSSF’s Community Roadmap. The CRA is reshaping how open source projects handle vulnerability management and maintainer liability, and this session is where the legal language turns into something developers can actually build into their workflows.
AI Infrastructure & Supply Chain Provenance
AI is playing a double role in security right now: an automated tool for finding bugs faster, and a new surface area attackers are learning to exploit. Three sessions dig into that tension from different angles.
Jeff Diecks and Laura Guazzelli from OpenSSF open the topic at 10:55 CEST with Preparing for the Vulnpocalypse: Using OSS-CRS To Find and Fix Bugs Before They Find You, covering automated vulnerability discovery at scale. At 11:20 CEST, Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson) will shift the focus to infrastructure with Defending Bare-Metal: Lessons Learnt From AI Security Analysis of Metal3 and OpenStack Ironic. And later in the afternoon, at 16:30 CEST, Sheng Sun and Sarah Evans (both of Dell Technologies) tackle the machine learning supply chain itself in Verifiable AI Provenance: Closing the Attestation Gap in the Machine Learning Supply Chain, asking how teams can actually verify what went into a model before it reaches production.
Tooling & Supply Chain Standards
Good security policy only goes as far as the tooling that puts it into practice. Hannah Braswell (Red Hat) walks through that idea at 11:45 CEST in From First PR To Hardening Guide: Structured Security With Gemara, showing how the Gemara framework brings structure to governance, risk, and compliance work. Later, at 16:50 CEST, Yuta Kiyoumi (Honda Motor Co., Ltd.) and Akihiko Takahashi (Fujitsu) bring a real-world manufacturing lens to the conversation with Applying VEX To Vulnerability Information Sharing in Multi-tier Automotive Supply Chains, showing how Honda uses the Vulnerability Exploitability eXchange (VEX) standard to track risk across hardware and software tiers alike.
Community & Interactive Sessions
Not everything on the schedule is a deep technical dive. At 15:15 CEST, OpenSSF’s Adrianne Marcum and CRob return with GAME SHOW!! Part Dva!! for a lighter, interactive take on community learning. And closing out the day at 17:10 CEST, Ejiro Oghenekome, Victoria Ottah, Sal Kimmich (OpenUK), CRob (OpenSSF), and Amir Montazery (OSTIF) come together for Securing Africa’s Open Source Ecosystem, a conversation about maintainer health, regional ecosystem growth, and what global collaboration actually looks like in practice. Security, after all, isn’t something any single region or company can solve alone.
Why Attend?
OpenSSF Community Day has never been about product pitches from a stage. It’s built to be collaborative, which means the value comes from the conversations as much as the talks themselves. You’ll get face-to-face time with the maintainers behind projects like gittuf, Sigstore, OpenBao, and Gemara, and you’ll hear real production lessons from speakers willing to talk about what didn’t work, not just what did. If you’ve been looking for an entry point into an OpenSSF Working Group or a security project you want to contribute to, this is about as easy a starting point as you’ll find. Discover what a first-time attendee can expect by hearing directly about Hannah’s personal journey at the event.
How to Join
Register for the event to reserve your spot alongside your Open Source Summit EU registration, view the full schedule to read speaker bios and build your own agenda, or sponsor the event to support open source security community events like this one. See you in Prague!Â
About the Author
Angelah Liu is the Communications & Marketing Manager at the Linux Foundation, driving marketing initiatives across multiple open source projects, including OpenSSF, the Confidential Computing Consortium, Overture Maps, and AOUSD. A creative at heart, she thrives on bridging the gap between technical communities and the wider world. As a dedicated advocate for “Open Source for Good,” she uses digital storytelling to ensure open source breakthroughs drive a lasting, positive influence far beyond the tech ecosystem.