Discover how the OpenSSF Gemara project clarifies the complex world of security attestations, streamlines software supply chain evaluations, and helps organizations confidently meet EU Cyber Resilience Act (CRA) due diligence…
Read More
AI has gotten good at finding software vulnerabilities, and attackers are already using it. For example, “AI-enabled adversaries increased attacks by 89% year-over-year” according to the CrowdStrike 2026 Global Threat…
Read More
Learn how GitHub integrated OpenSSF's malicious-package data into its Advisory Database to expand Dependabot malware alerts across eight ecosystems.
Read More
Discover Privateer, a new plugin-based, AI-assisted security and compliance evaluation framework that has officially joined the OpenSSF Sandbox under the ORBIT Working Group.
Read More
The OpenSSF announced expanded membership during its Community Day Europe, welcoming four new members: A-Team Systems, Emphere, DACHS IT GMBH, and JetBrains. The Foundation also released significant CRA resources to…
Read More
September brings a commitment to sustainable package registries, practical Cyber Resilience Act (CRA) guidance, new community security work, and three conversations on AI, regulation, and dependency risk. Join us in Prague for OpenSSF Community Day Europe on October 6.
TL;DR
- 🏗️ Sustainable Package Registries → OpenSSF’s Governing Board supports durable funding models for public registries.
- 🌱 Grow CRA Readiness → A role-specific community garden journey for maintainers, stewards, and manufacturers.
- 🔐 Security Slam 2026 → OpenSSF and CNCF TAG Security team up for a fall security challenge.
- 🎙️ Podcast: Three September Episodes → CRA guidance with Madalin Neag, AI and security with Mark Russinovich, and dependency debt with Abby Kearns.
- 🛠️ Project Releases → Updates from OpenSSF Scorecard, OpenBao, gittuf, Zarf, protobom, Gemara, and Sigstore.
- 📅 OpenSSF Community Day Europe → Join us October 6 in Prague; project demos and booth volunteers are welcome.
5 min read
We’re In: Enterprise Commitment to Sustainable Package Registries
Public package registries face rising security and operating costs. OpenSSF’s Governing Board commits to supporting sustainable funding models as enterprise customers while keeping access available to individual developers. Read the commitment.
Case Study: How Does IBM Turn Open Source Participation Into Enterprise and Career Value?
IBM Enterprise Security Executive Jamie Thomas discusses how IBM’s historical journey with Java, Linux, and Red Hat shaped its strategy for turning open source software consumption into intentional stewardship, enterprise value, and career growth for developers. Through OpenSSF, that participation brings enterprise experience into a community working to secure the software upon which everyone depends. Learn more.
Security Slam 2026 – Fall Edition
OpenSSF and CNCF TAG Security are partnering on the fall Security Slam around KubeCon + CloudNativeCon North America. Learn how projects and contributors can take part.
Summer Mentorship Showcase
Meet emerging developers contributing to stronger software supply chain security through OpenSSF’s summer mentorship program. Read their stories.
Grow CRA Readiness: Find Your Path Through the European Union Cyber Resilience Act
OpenSSF’s community garden journey helps maintainers, open source software stewards, and manufacturers identify the CRA guidance and resources relevant to their roles. Explore the journey and the community guide to the September 11 manufacturer reporting deadline.
Empowering Open Source Security with Scalable Infrastructure
AWS describes how funding and scalable compute can support maintainers’ CI, fuzzing, testing, and artifact distribution. Read the guest blog.
A Community Guide to the EU CRA September 11 Deadline for Manufacturers
Discover key insights into the European Union Cyber Resilience Act (CRA) September 11, 2026 reporting obligations for manufacturers, alongside practical guidance enabling open source maintainers and stewards to streamline security response workflows. Read the community guide.
Open by Default After AI: The GDS Guidance and the Enforcement Question
The Government Digital Service (GDS) issued guidance reaffirming that public sector code should remain “open by default,” refuting NHS England’s decision to hide GitHub repositories over AI-driven vulnerability concerns by clarifying that opacity is not a valid substitute for proper security hygiene and rapid patching. Read here
What’s in the SOSS? An OpenSSF Podcast
#71 – S3E23 Navigating the New Era: The EU Cyber Resilience Act Explained with Madalin Neag
OpenSSF EU Policy Advisor Madalin Neag demystifies the EU Cyber Resilience Act (CRA). Learn how the CRA establishes a horizontal cybersecurity baseline for digital products. Listen now
Join Azure CTO and OpenSSF Board Chair Mark Russinovich as he discusses AI’s impact on software engineering, supply chain security, and vulnerability management. Listen now
In this episode of What’s in the SOSS, ActiveState CEO Abby Kearns breaks down the rapidly evolving open source security landscape. Listen now
News from OpenSSF Community Meetings and Projects
- Contribute in Prague: Project maintainers and contributors can lead 30-minute Lightning Learning sessions during OpenSSF Community Day Europe on October 6. Sign up for a session.
- Volunteers at Open Source Summit Europe can take short shifts at the OpenSSF booth for demos and questions. Sign up for a booth shift.
- OpenSSF Scorecard migrated its public infrastructure with AboutCode to AWS and published the scorecard-infra repository. Community-hosted Allstar ended in August; users should move to self-hosted Allstar.
- Self-hosted Allstar instructions.
- The TAC approved the sandbox application for a new SBOM & VEX Working Group. Read the application.
- OpenBao released v2.7.0 beta with external KMS-backed keys, post-quantum support, and PostgreSQL read scalability; v2.6.2 includes security fixes. Beta release; stable release.
- OpenBao v2.6.2 release.
- gittuf v0.16.0 adds SHA-256 repository support, storage and TUI improvements, and key inspection tools. Release notes.
- Zarf v0.85.0 adds v1beta1 component config publishing, OCI source prefixing, and Helm retry controls. Release notes.
- Protobom v0.6.0 expanded SPDX support and serialization; v0.6.1 followed. v0.6.0; v0.6.1.
- Gemara released go-gemara v0.10.0 and established repositories for GRC Store capabilities. Explore Gemara.
- The Securing Software Repositories WG discussed npm’s post-quantum package-signature plans with Sigstore. Sigstore also released Rekor v1.5.4, including a hashedrekord CLI default and request hardening. Rekor release.
- The AI/ML Security and Best Practices WGs completed an initial draft of Finding and Fixing Vulnerabilities using AI (LFD126). Course draft.
- Security Insights launched a web-based Form & Wizard Editor for maintainers. Open the editor.
- Model Signing merged its Open Model Signing Conformance Suite and is developing dataset-signing and multi-signature logging proposals.
- Alpha-Omega continues its Security Engineer in Residence work with the Apache Software Foundation, Erlang Ecosystem Foundation, and OSTIF. ASF update; Erlang update; OSTIF update.
- OpenSSF’s CRA community garden journey offers role-specific paths for maintainers, stewards, and manufacturers. Explore it.
- Recap and resources from the recent Global Cyber Policy Working Group’s CRA Tech Talk:
- Access the recording on-demand.
- Review presentation decks:
- Upcoming community meetings.
Cybersecurity Policy & Regulatory Updates
- The European Commission updated subchapter 5.5 of its FAQ, confirming that the September 11, 2026 CRA reporting deadline applies exclusively to manufacturers. For open source software stewards, compliance obligations start December 11, 2027. Review OpenSSF’s steward guide and manufacturer checklist for details.
- Several national cybersecurity authorities published guidance regarding CRA reporting requirements:
- Ireland NCSC: National CRA Guidelines
- Belgium CCB: European Reporting Obligations
- Germany BSI: Single Reporting Platform Platform Overview
- ENISA released new resources for September reporting obligations:
- Updated FAQ, Glossary, and SRP User Manual.
- Published the ENISA Threat Landscape 2026 report.
- Launched an MSME CRA investment survey examining cybersecurity planning.
- Opened public consultation on its draft Technical Advisory on AI-assisted development. Share input in the Feedback for the Open Consultation on the ENISA’s Technical Advisory on AI-assisted software development .
- The Linux Foundation released a readiness guide covering CRA preparation steps for hosted projects.
- Review the CRA Expert Group agenda for the upcoming meeting.
- The ECCC announced a Digital Europe call for proposals.
- Politico highlighted the EU’s initial findings on code vulnerabilities identified with AI frontier models.
Meet OpenSSF at These Upcoming Events!
- OpenSSF Community Day Europe — October 6, Prague. Event details and registration.
- Open Source Summit Europe — October 7–9, Prague. Event page.
- Join the OpenSSF Global Cyber Policy Working Group for an interactive workshop (and boxed lunch!) at Open Source Summit Europe + Embedded Linux Conference, Friday October 9, 2026 12:45 – 14:00 CEST | Chamber Hall (Floor 3)
- AGNTCon + MCPCon North America — October 20–23, San Jose. OpenSSF preview.
- Open Source SecurityCon North America — November 9, Salt Lake City. Event page.
- KubeCon + CloudNativeCon North America — November 9–12, Salt Lake City. Security Slam preview.
- Meet OpenSSF & Zarf at Zarfest — November 11 | 6:30–9:30 p.m. Register
Ways to Participate
There are a number of ways for individuals and organizations to participate in OpenSSF. Learn more here.
You’re invited to…
Join a Working Group or Project
Chat with us on Slack
Follow us on X, Mastodon, Bluesky, and LinkedIn
See You Next Month!
Missed an issue? Browse the newsletter archive. Send ideas for next month to marketing@openssf.org.
Regards,
The OpenSSF Team
IBM’s Jamie Thomas explains how intentional participation in open source communities and OpenSSF drives business strategy, improves software supply chain security, and creates career growth opportunities.
Read More
At OpenSSF, securing the open source software supply chain isn’t just about writing code or establishing policies. It is about growing the community of developers who build, maintain, and innovate…
Read More
The Open Source Security Foundation (OpenSSF) is partnering with the Cloud Native Computing Foundation (CNCF) Security Technical Advisory Group (TAG Security) to support the 2026 Security Slam at KubeCon +…
Read More
The OpenSSF Governing Board and major tech enterprises are partnering to support sustainable funding models for public package registries. This commitment aims to secure and scale the global software supply…
Read More