Guest blog opportunities are open to members, working groups in collaboration, and with limited exceptions for active contributors and thought leaders. Share your insights on open source security with our community.
OpenSSF Blog
Aug 11, 2026 |
CRA Readiness: A Practitioner’s Guide to Compliance
The EU Cyber Resilience Act (CRA) is no longer a future regulatory discussion; it is an immediate operational reality. With the September 2026 reporting deadline rapidly approaching and full compliance required by December 2027, software manufacturers, commercial entities, open source stewards, and foundations must establish a clear, pragmatic path forward.… Read more.
Aug 6, 2026 |
Announcing OpenBao v2.6!
We are thrilled to announce the availability of OpenBao v2.6, adding per-namespace sealing and the new workflow engine for cross-plugin communication! Read more.
Jul 29, 2026 |
In Blog
OpenSSF Community Day Europe 2026: Schedule Highlights & What to Expect
OpenSSF Community Day Europe 2026 (October 6 in Prague), focuses on open source software security, regulatory compliance like the EU CRA, and AI supply chain risks. The one-day event features technical sessions on tools like VEX, Gemara, and Sigstore, offering direct collaboration with maintainers and security experts. Read more.
Jul 28, 2026 |
What Is a Dependency Firewall?
A dependency firewall is a security checkpoint that evaluates open source packages before they are installed. It can protect developer workstations, build environments, CI/CD pipelines, and AI coding agents by blocking packages that appear malicious, suspicious, or inconsistent with organizational policy. Read more.
Jul 22, 2026 |
OpenSSF Community Day North America (NA) First-time Experience
My recent experience in Minneapolis revealed that these gatherings are more than simple meetings; they are collaborative ecosystems. Whether you are a maintainer or a first-time contributor, attending provides invaluable insights, fosters transparency, and accelerates project development. Read more.
Jul 21, 2026 |
Representing OpenSSF at AfricaCyberFest
Open source software is playing an important role in Africa's digital growth. Across the continent, more organizations, developers, and communities are adopting open source to build technology and solve local challenges. Read more.
Jul 16, 2026 |
In Blog
Navigating The OpenSSF is as Easy as Floating Down A Lazy River
Navigating the vast ecosystem of the Open Source Security Foundation (OpenSSF) is now as easy as floating down a lazy river. Discover our newly curated, role-based User Journeys designed to seamlessly guide developers, security engineers, OSPO leaders, marketers, and executives to the exact tools, resources, and communities they need. Read more.
Jun 25, 2026 |
The CRA Readiness Reality: What Changed (and What Didn’t) Between 2025 and 2026?
In 2025, Linux Foundation Research, Linux Foundation Europe, and Open Source Security Foundation (OpenSSF) published Unaware and Uncertain: The Stark Realities of Cyber Resilience Act Readiness in Open Source. It took a survey-based look at how prepared the open source ecosystem was for the European Union's Cyber Resilience Act (EU… Read more.
Jun 23, 2026 |
Bridging the Gap Between Code and Research: Why SCORED ’26 Matters for Open Source Security
Let’s be completely honest about how we’ve historically handled security research: academia and open source practitioners have basically been living on two different planets. That’s why we created SCORED (the Workshop on Software Supply Chain Offensive and Defensive Research). It’s a complete reimagining of the traditional academic model. Read more.
Jun 10, 2026 |
Mini Shai-Hulud: Where SLSA’s Boundaries Fall
The “Mini Shai-Hulud” attack chained a GitHub Actions workflow misconfiguration, cache poisoning, and OIDC token extraction to publish malicious packages through legitimate CI/CD pipelines. Read more.