October brought four new members and fresh CRA resources from Prague, a practical guide to finding and fixing vulnerabilities with AI, and a new Sandbox project. Next stop: Salt Lake…
Read More
Public package registries face rising security and operating costs. OpenSSF’s Governing Board commits to supporting sustainable funding models as enterprise customers while keeping access available to individual developers. 
OpenSSF and CNCF TAG Security are partnering on the fall Security Slam around KubeCon + CloudNativeCon North America. 
Meet emerging developers contributing to stronger software supply chain security through OpenSSF’s summer mentorship program. 
OpenSSF’s community garden journey helps maintainers, open source software stewards, and manufacturers identify the CRA guidance and resources relevant to their roles. 
AWS describes how funding and scalable compute can support maintainers’ CI, fuzzing, testing, and artifact distribution. 
Discover key insights into the European Union Cyber Resilience Act (CRA) September 11, 2026 reporting obligations for manufacturers, alongside practical guidance enabling open source maintainers and stewards to streamline security response workflows. 
The Government Digital Service (GDS) issued guidance reaffirming that public sector code should remain “open by default,” refuting NHS England’s decision to hide GitHub repositories over AI-driven vulnerability concerns by clarifying that opacity is not a valid substitute for proper security hygiene and rapid patching. 
TL;DR:
🇳🇱 Open Source SecurityCon Europe → Agenda live and registration open
🎙️ Securing Agentic AI in Practice → March 17 Tech Talk on AI/ML security in action
📖 Compiler Annotations Guide → Practical C/C++ hardening without rewrites
🏆 Security Slam 2026 → 30-day challenge to level up project security
🇪🇺 CRA in Practice @ FOSDEM → Turning regulation into actionable steps
📦 Package Repository Security Forum → Cross-ecosystem collaboration in action
🎙️ What’s in the SOSS? → CFP tips and a 4-part AIxCC deep dive
6 min read
Join Us at Open Source SecurityCon Europe 2026 in Amsterdam
Planning to attend KubeCon + Cloud Native Con Europe in March? Don’t miss OpenSSF’s co-located 1-day event! This gathering will bring together a diverse community, including software developers, security engineers, public sector experts, CISOs, CIOs, and tech pioneers, to explore challenges and opportunities in modern security. Collaborate with peers and discover the essential tools, knowledge, and strategies needed to ensure a safer, more secure future.
The agenda is live! Read the blog to learn what not to miss in Amsterdam and to see highlights from SecurityCon North America.
Read the blog | Register now | View the agenda
Mark Your Calendar For the Upcoming Tech Talk: Securing Agentic AI in Practice: From OpenSSF Guidance to Real-World Implementation
Join us for the first OpenSSF Tech Talk of the year, focusing on agentic artificial intelligence (AI) security.
In this session, we will explore how the OpenSSF AI/ML Security Working Group is developing open guidance and frameworks to help secure AI and machine learning systems, and how that work translates into real-world practice. Using SAFE MCP and other solutions from OpenSSF member companies as examples, we will highlight community-driven efforts to improve the security of agentic AI systems, the problems they address, the design tradeoffs involved, and the lessons learned so far.
We will also feature OpenSSF’s free course, Secure AI/ML Driven Software Development (LFEL1012), which gives attendees a clear path to build practical skills and contribute to this rapidly evolving field.
Register and mark your calendar for March 17 at 1:00 p.m. ET. Additional speaker information will be shared soon.
Fill Out All The Margins 📖: OpenSSF Releases Compiler Annotations Guide for C and C++
OpenSSF has released a new Compiler Annotations Guide for C and C++ to help developers improve memory safety, diagnostics, and overall software security by using compiler-supported annotations. The guide explains how annotations in GCC and Clang/LLVM can make code intent explicit, strengthen static analysis, reduce false positives, and enable more effective compile-time and run-time protections. As memory-safety issues continue to drive a significant share of vulnerabilities in C and C++ systems, the guide offers practical, real-world guidance for applying low-friction hardening techniques that improve security without requiring large-scale rewrites of existing codebases.
Security Slam 2026
Security Slam 2026 is a 30-day security hygiene challenge running from February 20 to March 20, culminating in an awards ceremony at KubeCon + CloudNativeCon Europe. Hosted by OpenSSF in partnership with CNCF TAG Security & Compliance and Sonatype, the event encourages projects to use practical security tools, including OpenSSF resources, to strengthen their security posture based on their maturity level. Participants can earn recognition, badges, and plaques for completing milestones, reinforcing a community-driven effort to improve open source software security at scale.
Read the blog to learn more | Register now to receive reminders and instructions
EU Cyber Resilience Act (CRA) in Practice @ FOSDEM 2026: From Awareness to Action
At FOSDEM 2026, the CRA in Practice DevRoom brought together open source and industry leaders to turn the EU Cyber Resilience Act from policy discussion into practical action. Through case studies and panels, speakers shared concrete approaches to vulnerability management, SBOMs, VEX, risk assessment, and the steward role.
Advancing Package Repository Security Through Collaboration
On February 2, OpenSSF convened the Package Manager Security Forum, bringing together maintainers and registry operators from major ecosystems to address shared challenges in package repository security. Discussions highlighted common concerns around identity and account security, governance and abuse handling, transparency, and long-term sustainability. The session reinforced that package ecosystem risks are interconnected and that improving security requires cross-ecosystem coordination, shared frameworks, and continued collaboration through OpenSSF’s neutral convening role.
Getting an OpenSSF Baseline Badge with the Best Practices Badge System
Is your open source project meeting the “minimum definition” of security? The OpenSSF has officially integrated the Open Source Project Security Baseline (OSPS Baseline) into its Best Practices Badge Program.
In our latest blog, David A. Wheeler explains how you can quickly identify and meet essential security requirements to earn a Baseline Badge.
What’s in the SOSS? An OpenSSF Podcast:
#50 – S3E2 Demystifying the CFP Process with KubeCon North America Keynote Speakers
Stacey Potter and Adolfo “Puerco” García Veytia share practical, behind-the-scenes advice on submitting conference talks, fresh off their KubeCon keynote. They break down how CFP review committees work, what makes an abstract stand out, common mistakes to avoid, and why authenticity matters more than polish. The episode also tackles imposter syndrome and encourages new and diverse voices to shape the future of open source through speaking.
#51 – S3E3 AIxCC Part 1: From Skepticism to Success with Andrew Carney
Andrew Carney from DARPA explains the vision and results behind the two-year AI Cyber Challenge (AIxCC), which tasked teams with building AI systems that can automatically find and patch vulnerabilities in open source software. Despite early skepticism, competitors identified more than 80% of seeded vulnerabilities and generated effective patches at surprisingly low compute costs. The episode looks at what comes next as these cyber reasoning systems move from competition to real-world adoption.
#52 – S3E4 AIxCC Part 2: How Team Atlanta Won by Blending Traditional Security and LLMs
Professor Taesoo Kim of Georgia Tech describes how Team Atlanta combined fuzzing, symbolic execution, and large language models to win AIxCC. Initially skeptical of AI, the team shifted its strategy mid-competition and discovered that hybrid approaches produced the strongest results. The conversation also covers commercialization efforts, integration with OSS-Fuzz, and how the experience reshaped academic security research.
#53 – S3E5 AIxCC Part 3: Trail of Bits’ Hybrid Approach with Buttercup
Michael Brown of Trail of Bits discusses Buttercup, the second-place AIxCC system that pairs large language models with conventional software analysis tools. The team focused on using AI for well-scoped tasks like patch generation while relying on fuzzers for proof-of-vulnerability. Now fully open source and able to run on a laptop, Buttercup is actively maintained and positioned for broader enterprise and community use.
#54 – S3E6 AIxCC Part 4: Cyber Reasoning Systems in the Real World
CRob and Jeff Diecks wrap up the AIxCC series by exploring how competition teams are applying their systems to real open source projects such as the Linux kernel and CUPS. They introduce the OSS-CRS initiative, which aims to standardize and combine components from multiple cyber reasoning systems, and share lessons learned about responsibly reporting AI-generated findings. The episode highlights how collaboration through OpenSSF’s AI/ML Security Working Group and Cyber Reasoning Systems SIG is shaping the next phase of AI-driven security.
News from OpenSSF Community Meetings and Projects:
- The ORBIT, AI / ML Security, and Securing Critical Projects working groups presented quarterly updates to the TAC.
- A new paper “Forecasting the Maintained Score from the OpenSSF Scorecard for GitHub Repositories linked to PyPI libraries” was presented at the Scorecard community meeting.
- The latest developments on EU CRA standards and CRA implementation steps were presented at the Standardization SIG meeting.
- The ORBIT WG has created a new special interest group in collaboration with the Global Cyber Policy WG. The ORBIT Launchpad SIG held its first meeting on Friday, Feb 6 and hosted a CRA Tech Talk.
- The E2E Model Provenance SIG has started a draft specification.
- The Global Cyber Policy WG gave an overview of CRA Stewardship in its monthly CRA Tech Talk.
- Zarf released version v0.70.1 including support for image volumes on supported clusters.
- Gemara published its 2026 Roadmap.
- The SAFE-MCP SIG is seeking input on the project’s name and branding.
- The TAC elected Zach Steindler as 2026 Chair and Bob Callaway as Vice-Chair.
- The Open Source Summit North America CFP closed on Feb 9 and the CFP for OpenSSF Community Day North America closed on Feb 15.
- SLSA is now a graduated project of OpenSSF.
- OSPS Security Baseline released v2026.02.19 with several new and updated controls, and mappings to BSI-TR-03185-2.
- The Vulnerability Disclosures WG is working on best practices guidelines for open source projects impacted by AI Slop.
- Participants in the AIxCC competition have published an SoK paper on Cyber Reasoning Systems.
- The AI/ML Security WG has established a new bi-weekly meeting for collaboration on AI security work with representatives from OpenSSF, CoSAI, AGNTCY, NIST, SPDX, OWASP and more.
- Alpha-Omega’s Michael Winser was featured in The Register about open source package registries facing severe financial pressure.
- The Securing Software Repositories and Supply Chain Integrity working groups presented quarterly updates to the TAC.
In the News:
- The OpenSSF was featured in a Technology Magazine Q&A. CRob discusses OpenSSF’s goals, OSSAfrica, the BEAR Working Group, Security Baseline, and much more. This conversation was also covered by AI Magazine.
Meet OpenSSF at These Upcoming Events!
Connect with the OpenSSF Community at these key events:
- FOSS Backstage – March 16 & 17, 2026
- Open Source SecurityCon Europe – March 23, 2026
- KubeCon + CloudNativeCon Europe – March 23 – 26, 2026
- Open Source Summit North America – May 18 – 20, 2026
- OpenSSF Community Day North America – May 21, 2026
Ways to Participate:
There are a number of ways for individuals and organizations to participate in OpenSSF. Learn more here.
You’re invited to…
- Join a Working Group or Project
- Chat with us on Slack
- Follow us on X, Mastodon, Bluesky, and LinkedIn
See You Next Month!
We want to get you the information you most want to see in your inbox. Missed our previous newsletters? Read here!
Have ideas or suggestions for next month’s newsletter about the OpenSSF? Let us know at marketing@openssf.org, and see you next month!
Regards,
The OpenSSF Team
As cybersecurity legislation such as the 
Curious about what security topics will shape the open source world in 2026 and how you can be part of it? 
What does good security actually look like for open source projects? This new blog walks through the community-developed OSPS Baseline, a catalog of practical security controls that helps projects understand expectations, improve over time, and meet users where they are. With FOSS in up to 96% of modern codebases and relied on across nearly every industry, the blog explains why shared security practices matter and how the Baseline connects to standards like NIST SSDF, the EU Cyber Resilience Act, and ISO 27001. It also links to keynotes, a tech talk, a podcast, a real project case study, and FAQs so you can see how the Baseline works in practice.