Join us at Open Source SecurityCon Europe on March 23, 2026

Tag

Events

Nov 25
Love0
November Newsletter - OpenSSF

OpenSSF Newsletter – November 2025

By Newsletter

Welcome to the November 2025 edition of the OpenSSF Newsletter! Here’s a roundup of the latest developments, key events, and upcoming opportunities in the Open Source Security community.

TL;DR:

✅ Cyber week: Free + discounted security courses to level up fast

✅ EU CRA insights and OSS security guidance from Open Source Security Week in Belgium

✅ OSS security best practices for finance from OSFF NYC

✅ New OpenSSF members, awards, and project milestones

✅ New podcast episodes (#44-45): OSPS Security Baseline and SBOM Chaos and Software Sovereignty

✅ SBOM Coffee Club reviewed OWASP AIBOM

✅ Zarf v0.65.1 adds broader K8s support & hosts Tech talk

✅ OpenBao advancing read-replication

✅ Upcoming events: FOSDEM (31 Jan & 1 Feb 2026), Open Source SecurityCon (23 March 2026), KubeCon+CloudNativeCon Europe (23-26, March 2026)

Level Up Your Open Source Security Skills for Cyber Week

Cyber week - OpenSSF

OpenSSF and Linux Foundation Education are committed to making world-class security training accessible to everyone. Whether you are securing critical open source projects, preparing for new regulations, or building foundational expertise, you can start today with free e-learning courses and earn digital badges along the way. Explore offerings like Developing Secure Software (LFD121), Security for Software Development Managers (LFD125), Understanding the EU Cyber Resilience Act (LFEL1001), Secure AI/ML-Driven Software Development (LFEL1012), and many others designed to strengthen software resilience across the ecosystem.

If you are ready to go deeper, Cyber Week kicks off December 1. This brings the biggest savings of the year from Linux Foundation Education. From certification bundles to instructor-led courses and subscription packages, you can save up to 65 percent and accelerate your career heading into 2026.

Visit LF Education starting on December 1st to grab the best savings of the year!

Start learning for free. Level up for less. Strengthen the security of the open source world.

Blogs: What’s New in the OpenSSF Community?

Recap: Open Source Security Week in Belgium – Highlights from Ghent to Brussels

Open Source Security events in Belgium - October

At the end of October, Linux Foundation Europe, OpenSSF, and CEPS hosted a week of open source security activities across Ghent and Brussels. Developers, maintainers, policymakers, and security experts came together to break down the Cyber Resilience Act, share practical readiness guidance, and align on how Europe can strengthen software security without slowing open collaboration. From technical workshops to policy-driven discussions, the week highlighted both the challenges ahead and the growing support available to the community. Read the full recap for key takeaways, reflections, and ways to get involved.

Building Security in Open Source for Financial Services: OpenSSF at Open Source Finance Forum (OSFF) NYC

OpenSSF at Open Source in Finance Forum - New York 2025 - Recap blog

OpenSSF joined the Open Source in Finance Forum (OSFF) NYC to highlight how financial institutions can confidently rely on open source while managing real security risks. Through sessions on AI security, project security baselines, and stabilizing vulnerability data pipelines, OpenSSF showed how collaboration between maintainers, regulators, and industry engineers leads to practical solutions that strengthen the software powering today’s financial systems. Read the full recap to explore the key takeaways and resources shared at OSFF.

Tech Talk Recap: Simplifying DevSecOps in Air-Gapped Environments with Zarf

Tech Talk Recap: Simplifying DevSecOps in Air-Gapped Environments with Zarf

In the latest OpenSSF Tech Talk, we focused on a significant hurdle in software supply chain security: managing software delivery and upkeep within air-gapped and restricted network environments. You can now view the recording on the OpenSSF YouTube channel, and the presentation slides are accessible here.

OpenSSF Announces Key Membership Growth and Golden Egg Award Winners at Open Source SecurityCon North America

The Open Source Security Foundation (OpenSSF) announced new and expanded memberships at Open Source SecurityCon North America, welcoming Target Corporation and Thread AI, and celebrating OSTIF’s upgrade to general member status. The community also recognized standout contributors with the latest Golden Egg Awards and highlighted recent progress across learning resources, tooling, and global events. Read the blog to learn more about the membership updates, award winners, and milestones from the past quarter.

Here you will find a snapshot of what’s new on the OpenSSF blog. For more stories, ideas, and updates, visit the blog section on our website.

What’s in the SOSS? An OpenSSF Podcast:

#44 – S2E21 A Deep Dive into the Open Source Project Security (OSPS) Baseline

In this episode of What’s in the SOSS? CRob, Ben Cotton, and Eddie Knight take a practical look at the Open Source Project Security (OSPS) Baseline, a shared security checklist designed to help maintainers communicate the current state of their project’s security practices. They break down how the baseline fits into real workflows, why clear documentation builds trust, and how downstream users benefit when expectations are aligned. The conversation also explores integrations with other OpenSSF efforts, lessons from the GUAC case study, and what’s ahead as the community continues to refine the framework and expand tooling support.

#45 – S2E22 SBOM Chaos and Software Sovereignty with Canonical’s Stephanie Domas

In this episode of What’s in the SOSS, CRob talks with Stephanie Domas, Chief Security Officer at Canonical, about the hidden challenges shaping today’s open source ecosystem. Stephanie breaks down why third party patches disrupt SBOM accuracy, how software sovereignty is influencing global procurement, and what the EU CRA means for enterprises working with upstream dependencies. She also shares insights on memory safe upgrades in Ubuntu’s next LTS and why transparency, collaboration, and community support are critical to building trust in open source.

News from OpenSSF Community Meetings and Projects:

In the News:

Meet OpenSSF at These Upcoming Events!

Connect with the OpenSSF Community at these key events:

Ways to Participate:

There are a number of ways for individuals and organizations to participate in OpenSSF. Learn more here.

You’re invited to…

See You Next Month!

We want to get you the information you most want to see in your inbox. Missed our previous newsletters? Read here!

Have ideas or suggestions for next month’s newsletter about the OpenSSF? Let us know at marketing@openssf.org, and see you next month! 

Regards,

The OpenSSF Team

Sep 05
Love0

OpenSSF Community Day Korea 2025 Agenda Live!

By Blog

We’re excited to announce that the agenda for OpenSSF Community Day Korea is now live! Join the community on November 4, 2025, in Seoul, South Korea, co-located with Open Source Summit Korea. Join us for a full day of collaboration, hands-on learning, and future-focused conversations about securing open source software.

The OpenSSF Community Day Korea features a dynamic mix of keynotes, lightning-style talks, and technical sessions spanning software supply chain security, AI/ML security, SBOM quality and policy, and practical OSS tooling. You’ll gain networking time to connect with maintainers, contributors, and adopters from across South Korea and the broader APAC region.

👉 Register now to secure your spot.
 🕘 All sessions are listed in Korea Standard Time (KST).

Agenda Highlights

09:30 KST – Registration + Badge Pick-up
 Kick off the day by picking up your badge and connecting with fellow attendees in the foyer.

11:30 KST – Welcome & Opening Remarks

  • Steve Fernandez, General Manager, OpenSSF

11:50 KST – Keynote Sessions

  • Featured speakers to be announced soon.

12:40 KST – Containers, Code, and Chaos: Securing the CI/CD Supply Chain

  • Aditya Soni, Forrester Research
  • Anshika Tiwari, Amazon Web Services, Inc.

13:00 KST – DepConfuse: SBOM-first Detection of Dependency Confusion

  • Akhil Mahendra, Scapia
  • Harsh Vairagya, CRED

13:20 KST – OSS Risk Scoring Is Broken. We Tried To Build Our Own With Sigstore and Scorecard

  • Prerit Munjal, InfraOne

13:40 KST – Break & Networking

14:15 KST – Securing the Real-Time Linux Kernel: Fortifying PREEMPT_RT With Syzkaller Fuzzing

  • Yunseong Kim, Ericsson
  • Shung-Hsi Yu, SUSE

14:45 KST – The Migration To Post-Quantum Cryptography: Open-Source Innovations and Interoperability

  • Tony Chen, Keyfactor

15:10 KST – License to Inspect: Auditing ML Pipelines for Open Source – A Guide

  • Aroma Rodrigues, Former Microsoft, Intuit, JP Morgan Chase, Fidelity Investments

15:35 KST – Highlighting the Uniqueness and Prevalence of OSS AI/ML Vulnerabilities

  • Jessy Ayala, University of California, Irvine

15:50 KST – Standardizing the Unstandardized: Securing AI Supply Chain With Model-Spec and Kitops

  • Prasanth Baskar, 8gears

16:05 KST – Enabling Verifiable AI Transparency With Confidential Computing With ManaTEE

  • Yonggil Choi, TikTok

Why Attend

  • Learn: Practical strategies for securing open source, from kernel fuzzing to SBOM-driven dependency protection.
  • Connect: Meet experts from companies like AWS, Ericsson, Keyfactor, TikTok, SUSE, and more.
  • Contribute: Engage directly with OpenSSF projects and working groups making OSS safer for everyone.

Plan Your Day

👉 Register here to attend OpenSSF Community Day Korea.

Keep the Momentum Going

From Denver to Hyderabad to Tokyo, OpenSSF Community Days are uniting the global open source community around one shared goal: making OSS secure for everyone. We’re thrilled to bring this energy to Seoul and can’t wait to build with you.

See you on November 4 in Seoul!

Jul 30
Love0

OpenSSF Newsletter – July 2025

By Newsletter

Welcome to the July 2025 edition of the OpenSSF Newsletter! Here’s a roundup of the latest developments, key events, and upcoming opportunities in the Open Source Security community.

TL;DR:

Submit Your Proposal: OpenSSF Community Day Korea

The Call for Proposals for OpenSSF Community Day Korea is closing Aug 3! If you have insights, tools, research, or community stories to share around open source software security, now is the time to submit your talk. The event takes place on November 4, 2025, in Seoul, South Korea, and brings together developers, researchers, and security professionals from across the open source and security ecosystems.

Whether your focus is on AI and security, vulnerability management, education, or tooling, we welcome submissions in a variety of formats, from quick 5-minute talks to extended 20-minute sessions. Deadline to submit: August 3, 2025, at 23:59 KST / 06:59 PST.

Share your expertise and help shape the future of open source security. We look forward to seeing you in Seoul!

Blogs:

New: Cyber Resilience Act (CRA) Brief Guide for OSS Developers

In our recent blog post, David A. Wheeler introduces the Cyber Resilience Act (CRA) Brief Guide for OSS Developers, a practical overview created by the OpenSSF to help open source developers understand and prepare for the EU’s new cybersecurity regulation. Although the CRA officially applies only within the EU, its global impact is significant due to the international nature of software distribution. The blog clarifies when the CRA does or does not apply to OSS, outlines potential risks for non-compliance, and highlights available resources including free training and community support to help developers build secure, compliant software. Read the full blog.

Recap: OpenSSF Community Day Japan 2025

OpenSSF Community Day Japan 2025 brought together developers, researchers, government, and industry leaders in Tokyo to advance open source software security. The event featured keynotes, technical sessions, and a live incident response exercise focused on secure development, tool adoption, and supply chain integrity.

Read the full blog for session videos, slides, and key takeaways.

Recap: OpenSSF Community Day North America 2025

OpenSSF Community Day NA 2025 brought together a diverse open source security community in Denver for a packed day of insights, tools, and collaboration. From real-world deployments of SBOM, Sigstore, and GUAC to securing AI pipelines and exploring the new AStRA control plane framework, sessions moved beyond awareness into action. 

Read the full blog for recordings, slides, key takeaways and ways to get involved.

On-Demand Webinar: Cybersecurity Skills, Simplified

The on-demand webinar Cybersecurity Skills, Simplified: A Framework That Works brings together experts from IBM, Intel, Linux Foundation Education, and OpenSSF to address a critical challenge: making cybersecurity a shared responsibility across all roles. The panel introduces the Cybersecurity Skills Framework, an open, flexible tool that helps teams identify, map, and improve security skills organization-wide. With insights on setting security OKRs, scaling training, and creating accessible learning pathways, this webinar offers practical guidance for anyone looking to strengthen their team’s security posture. Learn more.

What’s in the SOSS? An OpenSSF Podcast:

#35 – S2E12 Building India’s Open Source Security Community: From Developer Nation to Security Champions

In this episode of What’s in the SOSS?, host CRob sits down with Ram Iyengar, OpenSSF’s India community representative, to explore the evolving landscape of open source security in India. Ram shares his journey from professor to evangelist, the launch of LF India, and the challenges of inspiring a security-first mindset in one of the world’s largest developer populations. The episode covers everything from building local community momentum to hosting regional events and video series, offering listeners both practical insights and a personal look at the passionate effort behind India’s growing open source security movement.

#34 – S2E11 From Lockpicking to Leadership: Tabatha DiDomenico on Security, Open Source, and Building Community

In this episode of What’s in the SOSS? host Yesenia Yser sits down with Tabatha DiDomenico, open source security engineer, community leader, and president of BSides Orlando for a compelling conversation about her unconventional path into open source, the power of community, and the often-overlooked impact of DevRel. From her first experience with Netscape to shaping security strategy at G-Research and OpenSSF, Tabatha reflects on how curiosity, volunteering, and intentional advocacy have fueled her journey. Whether you are new to open source or a longtime contributor, this episode offers heartfelt insights, practical advice, and a powerful reminder: community is everything.

Education:

The Open Source Security Foundation (OpenSSF), together with Linux Foundation Education, provides a selection of free e-learning courses to help the open source community build stronger software security expertise. Learners can earn digital badges by completing offerings such as:

These are just a few of the many courses available for developers, managers, and decision-makers aiming to integrate security throughout the software development lifecycle.

News from OpenSSF Community Meetings and Projects:

  • The Security-Focused Guide for AI Code Assistant Instructions that is being developed by the Best practices and the AI/ML WGs is now in final draft, under PR here.
  • Zarf released version v0.58.0 including image push & pull and SDK enhancements.
  • OpenBao recently released v2.3.1 with support for namespaces, CEL for JWT authentication and PKI issuance, and SSH multi-issuer support. The community is making progress on per-namespace sealing, HSM/KMS backed key material, and horizontal scalability, and just kicked off a UI working group.

In the News:

Meet OpenSSF at These Upcoming Events!

Join us at OpenSSF Community Day Events in India, Japan, Korea and Europe!

OpenSSF Community Days bring together security and open source experts to drive innovation in software security.

Connect with the OpenSSF Community at these key events:

Ways to Participate:

There are a number of ways for individuals and organizations to participate in OpenSSF. Learn more here.

You’re invited to…

See You Next Month! 

We want to get you the information you most want to see in your inbox. Missed our previous newsletters? Read here! Have ideas or suggestions for next month’s newsletter about the OpenSSF? Let us know at marketing@openssf.org, and see you next month! 

Regards,

The OpenSSF Team