Guest blog opportunities are open to members, working groups in collaboration, and with limited exceptions for active contributors and thought leaders. Share your insights on open source security with our community.
OpenSSF Blog
Nov 9, 2026 |
The AI Security Gap Hiding in Routine Maintenance
AI coding tools are speeding up software development and adding external dependencies faster than teams can review them. Discover why routine maintenance and component updates have become the hidden security gap for organizations today. Read more.
Nov 9, 2026 |
OpenSSF Welcomes New Members and Expands AI Security Resources
The OpenSSF announced expanded membership at Open Source SecurityCon North America and broadened its AI security resources, including a new guide to finding and fixing vulnerabilities using AI. Read more.
Nov 9, 2026 |
Announcing Zarf 1.0: Security and Stability for Airgap Software Delivery
Zarf 1.0 is here, bringing the v1beta1 schema, stronger package signing, and improved stability for air-gapped and constrained software delivery environments. Read more.
Nov 6, 2026 |
In Blog
OpenSSF Community Day Europe 2026: Driving Systemic Security and Operational Resilience in Open Source
At OpenSSF Community Day Europe 2026 in Prague, more than 200 attendees gathered onsite as practitioners, maintainers, policymakers, and security leaders came together across two distinct tracks: the Main Track (South Hall 3B) focusing on core community strategy, policy, and tooling, and the dedicated SCORED Track (South Hall 3A) highlighting… Read more.
Nov 6, 2026 |
From Sigstore to CRA readiness: Sylva’s journey with OpenSSF
Sylva’s security work relies heavily on the OpenSSF ecosystem. From supply chain tooling with Sigstore and SLSA to adopting OpenSSF Scorecard and Best Practices badges, learn how Sylva is approaching EU Cyber Resilience Act (CRA) readiness and building verifiable trust for downstream operators. Read more.
Nov 5, 2026 |
Case Study: Kubescape Completes All Six Security Slam Badges with OpenSSF
Kubescape completed all six project-level badges in the Fall 2026 Security Slam, bringing maintainers and community contributors together to strengthen security across its open source Kubernetes platform. Learn how 150+ hours of community contribution helped achieve OSPS Baseline Level Two status and harden 12+ repositories. Read more.
Nov 3, 2026 |
The PHP Security Wake-Up Call: Fixes Are Only the Beginning
By Jeff Borek and Mike LinksvayerRecent PHP vulnerabilities highlight why open source security requires sustained investment and action from everyone who builds on it. PHP, an open source programming language, powers roughly 70% of websites whose server-side language is known. On October 21, 2026, the project released security updates for… Read more.
Oct 30, 2026 |
New LF Research Survey Shows Generative AI Cuts Open Source Coding Time in Half, but 25% of Incoming Pull Requests are Considered AI Slop
While Generative AI boosts developer productivity and lowers barriers to entry, a new Linux Foundation Research report reveals it also increases maintainer workloads. With 25% of incoming pull requests now considered "AI slop," the findings highlight an urgent need for stronger open source project governance. Read more.
Oct 23, 2026 |
In Blog
New OpenSSF Tech Talk: How Upstream Contribution Minimizes Technical Debt & Streamlines CRA Reporting
Maintaining private forks of open source software (OSS) comes with a hidden tax, costing organizations an average of 5,160 labor hours per release cycle in maintenance and engineering overhead. Beyond the accumulating technical debt and security risks, passive open source consumption is no longer sustainable under emerging regulatory frameworks like… Read more.
Oct 22, 2026 |
Who Checked It? Attestations, Gemara, and CRA Due Diligence
Discover how the OpenSSF Gemara project clarifies the complex world of security attestations, streamlines software supply chain evaluations, and helps organizations confidently meet EU Cyber Resilience Act (CRA) due diligence requirements. Read more.