# open-source-security The discipline of securing the development, maintenance, distribution, and consumption of open source software. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Open Secure AI Alliance Joins the Linux Foundation to Build a Shared, Open Defense Stack for the AI Era DevFeed: [Open Secure AI Alliance Joins the Linux Foundation to Build a Shared, Open Defense Stack for the AI Era]() Original publisher: [Read original article]() Author: andrewb@proximabiz.com (The Linux Foundation) Published: 2026-09-14T16:00:00Z Content type: news Language: en Sources: [Linux Foundation - Blog]() Topics: [Linux](), [Artificial Intelligence](), [Securing AI](), [open-source-security](), [Cybersecurity](), [Security](), [Resilience](), [Inference]() Tags: [ai](), [ai-security](), [collaboration](), [cybersecurity](), [governance](), [infrastructure](), [linux](), [models](), [nvidia](), [open-source](), [open-source-security](), [open-source-software](), [resilience](), [security](), [september-2026](), [standards]() ### AI overview The Open Secure AI Alliance has joined the Linux Foundation under neutral governance. It aims to help organizations collaborate on open AI security tools, research, shared standards, and verifiable defenses spanning models, inference, agents, identity, policy, enforcement, containment, and infrastructure. ### Source excerpt Originally founded by dozens of enterprise leaders and NVIDIA, the Alliance moves to neutral governance to expand industry collaboration on open AI security tools, research and shared defenses ## LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program DevFeed: [LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program]() Original publisher: [Read original article]() Author: Harold Fritts Published: 2026-09-11T16:35:51Z Content type: news Language: en Sources: [StorageReview.com]() Topics: [ibm](), [open-source-security](), [supply-chain-security](), [Security](), [vulnerability](), [DevSecOps](), [Deployment](), [Open Source](), [Artificial Intelligence]() Tags: [ai](), [deployment](), [devsecops](), [enterprise](), [ibm](), [open-source](), [open-source-software](), [red-hat](), [security](), [software-supply-chain](), [testing](), [vulnerability]() ### AI overview LTM is developing a remediation services practice around IBM and Red Hat's Lightwell program, which provides AI-generated, vendor-validated fixes for open-source software vulnerabilities. The offering is intended to help customers plan, prioritize, test, validate, and deploy patches at scale. ### Source excerpt LTM, the Larsen & Toubro Group services company that was LTIMindtree until its February rebrand, is building a Lightwell remediation services practice around the $5 billion IBM and Red Hat program for securing open-source software with AI-generated, vendor-validated fixes. IBM's clearinghouse produces validated, production-ready patches for open-source dependencies; LTM's job is getting them into customer The post LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program appeared first on StorageReview.com. ## Prepare for the Cyber Resilience Act's 24-hour reporting deadline DevFeed: [Prepare for the Cyber Resilience Act's 24-hour reporting deadline]() Original publisher: [Read original article]() Author: Amit Shalem Published: 2026-09-10T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [Vulnerabilities](), [open-source-security](), [Incident response]() Tags: [compliance](), [cybersecurity](), [europe](), [features](), [sbom](), [security](), [supply-chain](), [supply-chain-security](), [vulnerabilities]() ### AI overview The article explains the Cyber Resilience Act requirement for manufacturers to report actively exploited product vulnerabilities within 24 hours of becoming aware of them. It presents continuous software supply-chain detection, dependency scanning, SBOM monitoring, KEV status, EPSS scores, and container scanning as ways GitLab can help organizations identify and prioritize reportable risks. ### Source excerpt Starting on September 11, 2026, many businesses that place software on the European Union (EU) market will have 24 hours to file a report once they learn that a vulnerability in one of their products is being actively exploited. This is a new requirement under the Cyber Resilience Act (CRA), the EU law that sets cybersecurity requirements for products with digital elements sold in Europe, put in place to ensure those products are secure by design and supported against new threats. The most stringent requirements under the CRA apply to the manufacturers that make those products, from large software vendors to companies shipping connected hardware. The challenge a business faces to stay compliant is not the filing itself. It is finding out fast enough that a vulnerability in something you shipped is being actively exploited in your software supply chain. The 24-hour clock starts the moment you become aware, this is why detection is so important. Continuous detection is an engineering solution rather than a one-off compliance one. GitLab's software supply chain security capabilities are built to help you find active exploitation in what you shipped, automatically and continuously. This article walks through four questions you should ask yourself about your own pipeline's continuous detection solution today. Reporting requirement starts in September 2026 Beginning September 11, 2026, manufacturers have to report an actively exploited vulnerability within 24 hours of becoming aware of it. The reporting runs in three stages each submitted simultaneously to the European Union Agency for Cybersecurity (ENISA) and to the Computer Security Incident Response Team (CSIRT) designated as coordinator. Early warning, within 24 hours of becoming aware of the actively exploited vulnerability. A short first alert that exploitation is happening. You are not expected to know the full scope of impact or the fix yet. Notification, within 72 hours. A fuller account, covering what is affect ## How OSPOs Are Preparing Organizations for the EU Cyber Resilience Act DevFeed: [How OSPOs Are Preparing Organizations for the EU Cyber Resilience Act]() Original publisher: [Read original article]() Author: andrewb@proximabiz.com (The Linux Foundation) Published: 2026-09-09T19:11:24Z Content type: article Language: en Sources: [Linux Foundation - Blog]() Topics: [cyber resilience act](), [Security](), [Vulnerabilities](), [open-source-security](), [supply-chain-security]() Tags: [2026](), [cyber-resilience-act](), [eu](), [linux-foundation](), [open-source](), [openssf](), [regulatory](), [security](), [supply-chain-security](), [vulnerabilities]() ### AI overview This Linux Foundation post explains how Open Source Program Offices can help organizations prepare for the EU Cyber Resilience Act, including identifying affected products and dependencies, coordinating legal, security, engineering and procurement teams, and responding to vulnerability and incident reporting obligations. ### Source excerpt For organizations offering products with digital elements in the EU, the next major Cyber Resilience Act (CRA) deadline arrives on 11 September 2026. From that date, organizations covered by the reporting obligations must be ready to assess actively exploited vulnerabilities and severe security incidents, coordinate an internal response and submit notifications within the required timelines. ## Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI DevFeed: [Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI]() Original publisher: [Read original article]() Author: Mark Beblow Published: 2026-09-09T13:00:00Z Content type: article Language: en Sources: [Tenable Blog]() Topics: [Securing AI](), [Cybersecurity](), [Large Language Model](), [open-source-security](), [Model Context Protocol (MCP)]() Tags: [agentic-ai](), [cybersecurity](), [mcp](), [open-source](), [openai](), [review](), [securing-ai]() ### AI overview Tenable introduces the CyberAgents Exchange AI Inspector, a security-review process for submissions to its registry of AI agents, skills, MCP servers, and multi-agent playbooks. It combines GPT Cyber models, Tenable security expertise, and human oversight to apply deeper review to higher-risk submissions. ### Source excerpt Open-source registries for AI agents are only effective when they include a rigorous, transparent security review process for community submissions. That's why for its new CyberAgents Exchange registry, Tenable paired its exposure management expertise with OpenAI GPT Cyber models to create the CyberAgents Exchange AI Inspector. Key takeaways The Exchange Inspector combines Tenable's exposure detection with OpenAI's GPT Cyber models and with human oversight to rigorously vet submissions made to the CyberAgents Exchange. Securing AI agents requires analyzing a broad attack surface that includes LLM instructions, tool-chaining permissions, and prompt injection risks, going far beyond traditional software security. The CyberAgents Exchange inspection process dynamically matches the appropriate AI model tier to each submission's risk level, ensuring comprehensive vetting without excessive computational overhead. Recently at OpenAI's "Intelligence at Work: Cyber Summit," Tenable and OpenAI announced a groundbreaking review process to vet the security of open-source AI agents, skills, MCP servers, and multi-agent playbooks, building on our June partnership. The new CyberAgents Exchange AI Inspector, which is built into our CyberAgents Exchange registry, will help security teams adopt agentic AI quickly and confidently. Powered by Tenable, the CyberAgents Exchange is a purpose-built, cybersecurity-native registry for AI agents, skills, MCP servers, and multi-agent playbooks. Launched in August as an open source and vendor-agnostic registry, the CyberAgents Exchange has already grown to host more than 100 AI listings, including a wave of contributions created at Tenable's SWARM build event at Black Hat USA. From the CyberAgents Exchange's inception, we understood the importance of a rigorous, comprehensive review process for agents submitted by contributors. Every submission to the CyberAgents Exchange gets a baseline review prior to being listed. Now, we are further strengt ## How financial services companies can modernize their software supply chain DevFeed: [How financial services companies can modernize their software supply chain]() Original publisher: [Read original article]() Published: 2026-09-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [open-source-security](), [Security](), [Vulnerabilities](), [Business Security]() Tags: [cve](), [dependency](), [financial-services](), [legacy](), [security](), [software-supply-chain-security](), [vulnerabilities]() ### AI overview This article argues that financial services organizations should modernize software supply chain security while preserving business-critical systems. It explains that legacy infrastructure, regulatory obligations, and downtime concerns have encouraged deferred vulnerability remediation, but AI-assisted exploitation is making that risk increasingly dangerous. ### Source excerpt Modernize your financial software supply chain without disrupting critical systems. See how trusted open source reduces risk without major migrations. ## MinIO End of Life: How to Stay Patched and Audit-Ready with Docker ELS DevFeed: [MinIO End of Life: How to Stay Patched and Audit-Ready with Docker ELS]() Original publisher: [Read original article]() Author: Vishrut Iyengar Published: 2026-08-24T13:00:00Z Content type: article Language: en Sources: [Docker]() Topics: [Docker Hardened Images](), [open-source-security](), [Security](), [migration](), [Docker](), [Open Source](), [Go]() Tags: [community](), [docker](), [docker-hardened-images](), [enterprise](), [go](), [migration](), [open-source](), [open-source-security](), [production](), [products](), [releases](), [security](), [solutions]() ### AI overview Docker's Extended Lifecycle Support keeps MinIO patched and audit-ready after the project's upstream end of life. The article explains how Docker maintains hardened images, tracks CVEs across MinIO and its Go dependencies, backports fixes, and supports teams that cannot immediately migrate their production object storage. ### Source excerpt MinIO reached end of life in February 2026. Docker Extended Lifecycle Support (ELS) keeps end-of-life software like it patched, compliant, and audit-ready for up to five years, covering versions upstream no longer supports all the way up to entire projects. ## How we use /goal to find bugs in Patch the Planet DevFeed: [How we use /goal to find bugs in Patch the Planet]() Original publisher: [Read original article]() Author: "Trail of Bits" Published: 2026-07-28T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [codex](), [bug](), [Open Source](), [open-source-security](), [cURL](), [Rust](), [OpenAI]() Tags: [analysis](), [blog](), [bugs](), [code](), [codex](), [machine-learning](), [open-source](), [openai](), [patch-the-planet](), [software](), [tool](), [vulnerabilities]() ### AI overview The article describes how Trail of Bits used Codex's /goal feature in Patch the Planet to find bugs in open-source software. It highlights results involving Rust, curl, Semgrep-based variant analysis, and potential Keycloak privilege-escalation issues, then discusses goal and prompt design techniques. ### Source excerpt Codex's /goal feature amplifies bug hunting, but getting good results requires the right prompt, the right scope, and the right number of outcomes per run. For Patch the Planet, our joint initiative with OpenAI to find and fix bugs in open-source software, we pointed Codex at some of the most widely used, heavily audited codebases in the world, like Rust, curl, and zlib. One tool came up again and again in our internal bug-report channels: /goal, which hands Codex an open-ended objective and lets it work independently toward a success condition. Here are a few highlights: /goal found every Rust bug we submitted, including a soundness hole and a miscompilation now patched in Rust 1.98, from a single variant-analysis pipeline. It turned every project's past CVEs into Semgrep rules that had to fire on the vulnerable version and stay silent on the patched one, then flagged 11 variant hits across multiple projects. It uncovered two potential high-severity privilege-escalation bugs in Keycloak's SAML component during a discovery run. Over the first few weeks of Patch the Planet, our engineers independently converged on three techniques for using /goal. We found that getting the most out of /goal means treating the prompt as a set of specific success criteria, not a set of instructions. (Note that this blog post uses /goal to refer to goal-based prompting in general. Codex can also set goals for itself through a tool call, and that's how we recommend everyone use it; we rarely type the slash command ourselves.) 1. Let Codex write the goal The art of using /goal is prompt design, and we found that Codex knows Codex the best. Internally, our single most repeated /goal tip was to use Codex to help write each /goal prompt. We hand Codex threat model files and the context about what we're looking for, and then tell it to write the goal prompt. As mentioned before, /goal is a tool Codex can invoke on itself, and a few engineers stopped typing goals by hand entirely. $goal-prompt ## Growing up the hard way DevFeed: [Growing up the hard way]() Original publisher: [Read original article]() Published: 2026-07-22T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [open-source-security](), [ai regulation](), [Artificial Intelligence](), [Security]() Tags: [chainguard-software-supply-chain-security](), [open-source](), [open-source-security](), [open-source-software](), [oss](), [security](), [shai-hulud](), [software-supply-chain-security](), [solarwinds](), [supply-chain](), [teampcp]() ### AI overview This opinion argues that open source is entering a difficult transition after supply-chain incidents, regulatory pressure, and the industrialization of malware. It forecasts that the Open Source definition will remain intact while enterprise and regulatory requirements change which open source software organizations are willing or permitted to consume, with AI-driven vulnerability discovery and poisoned distribution channels creating pressure on both fronts. ### Source excerpt Open source is growing up. Explore why AI, regulation, and enterprise security are reshaping how organizations consume open source software. ## Booz Allen Hamilton signs enterprise license agreement with Chainguard DevFeed: [Booz Allen Hamilton signs enterprise license agreement with Chainguard]() Original publisher: [Read original article]() Published: 2026-07-21T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [chainguard libraries](), [open-source-security](), [Security](), [Vulnerabilities](), [Open Source](), [Development]() Tags: [announce](), [ato](), [authority-to-operate](), [booz-allen-hamilton](), [booz-allen-hamilton-engineering](), [booz-chainguard-partnership](), [chainguard](), [chainguard-booz](), [chainguard-containers](), [chainguard-libraries](), [compliance](), [container-images](), [development](), [enterprise](), [government](), [partner](), [secure-by-default](), [security](), [supply-chain](), [trust](), [us](), [vulnerabilities]() ### AI overview Booz Allen Hamilton has signed an enterprise license agreement with Chainguard, giving more than 6,000 engineers access to Chainguard Containers and Chainguard Libraries across U.S. government programs. The agreement is intended to support secure-by-default software delivery, vulnerability remediation, compliance, and software supply chain requirements. ### Source excerpt Booz Allen and Chainguard partner to help 6,000+ engineers deliver secure-by-default software across U.S. government programs. ## Capital One Announces Open-Source VulnHunter Agentic AI Code Security Tool DevFeed: [Capital One Announces Open-Source VulnHunter Agentic AI Code Security Tool]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-17T17:01:41Z Content type: release Language: en Sources: [Capital One Tech]() Topics: [open-source-security](), [code security](), [Artificial Intelligence](), [Open Source](), [Vulnerabilities](), [Tooling](), [Developer experience]() Tags: [agentic-ai-security](), [ai-code-security](), [ai-security](), [build](), [claude-code](), [code-vulnerability](), [developer](), [developer-experience](), [developers](), [exploit](), [generative-ai-tools](), [open-source](), [vulnerabilities]() ### AI overview Capital One announces the open-source release of VulnHunter, an agentic AI security tool that analyzes source code from an attacker's perspective. It is designed to identify potentially exploitable defects, map prospective attack paths, and propose targeted code remediations. ### Source excerpt Capital One's open-source, agentic AI code security tool. The rules of software security are changing faster than most defenders can keep pace. Advanced AI models have dramatically lowered the barrier for bad actors to discover and exploit vulnerabilities in software. What once required significant skill and time can now be automated, accelerated, and scaled. The world faces an increasingly short window of time before highly sophisticated, next-generation AI attack capabilities become affordable and accessible to virtually every adversary. Across the industry, organizations are racing to prepare for this paradigm shift. Traditional environmental protections like network segmentation, identity controls, and monitoring remain essential, but are no longer sufficient on their own. The ultimate defense in this new reality requires a shift in approach: organizations need to consider and detect the vulnerabilities in their code and fix them before adversaries can deploy advanced models to discover and exploit them. At Capital One, we decided that the right response to AI-enabled threats wasn't to wait, but to build cutting-edge AI-driven defenses and put them in the hands of defenders everywhere. That's why we are announcing today the open-source release of VulnHunter, an advanced agentic AI security tool designed to apply proactive, attacker-perspective analysis directly to the source code. Developed internally at Capital One, VulnHunter is not a traditional, passive vulnerability scanner. It represents a shift in defensive tooling with an agentic reasoning workflow to identify potentially exploitable defects, map prospective attack paths, and propose highly targeted code remediations. Built for the developer experience To fully unlock the utility of VulnHunter, we knew ease of use mattered. A persistent challenge with traditional security tools is that they are often built primarily to enforce rigid cybersecurity practices, without much consideration for a developer's ac ## Expanding Athena DevFeed: [Expanding Athena]() Original publisher: [Read original article]() Published: 2026-07-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [open-source-security](), [Frontier AI](), [AI Models](), [Artificial Intelligence](), [Security](), [Maintainers](), [Parser](), [Library]() Tags: [ai](), [akrites](), [athena](), [chainguard-clearinghouse](), [chainguard-libraries](), [frontier-ai](), [library](), [maintainers](), [open-source](), [parsing](), [secure-open-source](), [secure-oss](), [security](), [vulnerabilities]() ### AI overview Chainguard describes Athena, an industry coalition coordinating the discovery, remediation, protection, disclosure, and upstream fixing of vulnerabilities in open source software. The article reports that Athena has processed more than 40,000 vulnerabilities and emphasizes that frontier AI models can identify latent flaws and chain lower-severity bugs into serious attacks. ### Source excerpt See how Athena is helping secure open source by coordinating AI-discovered vulnerabilities, partner protections, and upstream fixes at scale. ## NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence DevFeed: [NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence]() Original publisher: [Read original article]() Author: Michelle Ginzburg; Noa Yaffe-Ermoza Published: 2026-06-25T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [open-source-security](), [Security](), [data]() Tags: [ai](), [article](), [awareness](), [developer](), [devops](), [interest](), [open-source](), [open-source-security](), [security](), [snyk-open-source](), [snyk-security-intel](), [software](), [supply-chain-security](), [technology](), [vulnerability](), [vulnerability-insights]() ### AI overview The article explains why vulnerability intelligence is moving beyond reliance on the National Vulnerability Database. It describes NIST's shift toward prioritized triage and presents Snyk's multi-source approach, combining vulnerability advisories, analyst validation, internal enrichment, open-source context, and multiple risk assessments to help teams prioritize remediation. ### Source excerpt NIST's shift to risk-based enrichment makes one thing clear: modern security teams need more than a single public source. In the AI era, trusted vulnerability intelligence depends on multiple signals, human validation, and clear context. ## Everything we announced during AI Readiness Innovation Week DevFeed: [Everything we announced during AI Readiness Innovation Week]() Original publisher: [Read original article]() Published: 2026-06-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Artificial Intelligence](), [ai-coding](), [supply-chain-security](), [chainguard](), [open-source-security](), [Vulnerabilities](), [Security](), [chainguard libraries](), [chainguard containers](), [CI/CD](), [Frontier AI](), [GitHub]() Tags: [ai](), [ai-readiness](), [athena](), [aws-kiro](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [ci-cd](), [containers](), [cursor](), [frontier-ai-models](), [gartner-magic-quadrant](), [github](), [innovation](), [open-source](), [security](), [software-supply-chain](), [software-supply-chain-security](), [speed](), [vulnerabilities]() ### AI overview Chainguard summarizes announcements from AI Readiness Innovation Week, covering supply-chain security advances for containers, libraries, CI/CD pipelines, AI agent skills, IDE integrations, partnerships, and an industry coalition. The article highlights Athena, a coalition designed to coordinate defense against vulnerabilities discovered by frontier AI models. ### Source excerpt Read about everything Chainguard announced during AI Readiness Innovation Week, including new features for Chainguard Libraries and Chainguard Containers. ## Patch the Planet: a Daybreak initiative to support open source maintainers DevFeed: [Patch the Planet: a Daybreak initiative to support open source maintainers]() Original publisher: [Read original article]() Published: 2026-06-22T10:00:00Z Content type: article Language: en Sources: [OpenAI News]() Topics: [Vulnerabilities](), [open-source-security](), [AI-assisted coding](), [CI/CD]() Tags: [ai](), [ci-cd](), [codex](), [maintainers](), [open-source](), [patch-the-planet](), [review](), [security](), [vulnerabilities]() ### AI overview Patch the Planet is a Daybreak initiative that combines AI-assisted security research with expert review to help open-source maintainers validate vulnerabilities, develop patches, test fixes, and coordinate disclosure. ### Source excerpt OpenAI introduces Patch the Planet, a Daybreak initiative helping open-source maintainers find, validate, and fix vulnerabilities with AI and expert review. ## The full Snyk AI Security Platform, free for open source maintainers DevFeed: [The full Snyk AI Security Platform, free for open source maintainers]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-06-18T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Maintainers](), [Open Source](), [Security](), [vulnerability](), [open-source-security](), [Artificial Intelligence](), [Frontier Model](), [Remote Access Trojan](), [AI Infrastructure]() Tags: [agent](), [ai](), [ai-infrastructure](), [ai-security](), [article](), [awareness](), [bugs](), [developer](), [enablement](), [engineering](), [frontier-model](), [interest](), [maintainers](), [open-source](), [open-source-security](), [remote-access-trojan](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-team](), [software](), [supply-chain-security](), [vulnerability](), [vulnerability-insights]() ### AI overview Snyk's Secure Developer Program gives qualifying open source projects free access to the Snyk AI Security Platform. It is designed to help maintainers prioritize real vulnerability reports and produce validated, merge-ready fixes through the Snyk Remediation Agent. ### Source excerpt Open source maintainers are drowning in real vulnerability reports and need help prioritizing, fixing, and shipping remediation faster. Snyk's Secure Developer Program gives qualifying projects free access to the Snyk AI Security Platform. ## Strengthening Snow for the open source community DevFeed: [Strengthening Snow for the open source community]() Original publisher: [Read original article]() Author: info@1password.com (Daryl Martin and Christian Rask) Published: 2026-06-16T00:00:00Z Content type: article Language: en Sources: [Blog on 1Password Blog]() Topics: [open-source-security]() Tags: [building-1password](), [contributors](), [cryptographic](), [developers](), [open-source](), [pull-requests](), [review](), [rust](), [security](), [testing]() ### AI overview 1Password funded and published an independent security assessment of Snow, an open-source Rust implementation of the Noise Protocol Framework. The review found 10 issues; eight, including a nonce-handling flaw and an invalid-PSK panic, have been resolved and validated. ### Source excerpt At 1Password, we regularly invite outside experts to challenge our assumptions and strengthen our security. We encourage security researchers to participate in our bug bounty programs, and have spent years building a collaborative research environment. We also believe in the benefit of open source software and standards, which raise the bar for the industry as a whole, while ultimately benefiting our 1Password customers. That's why we funded an independent security assessment of the open source library Snow, worked closely with the maintainer on remediation, and are making the results publicly available for anyone to review. Where to read the report The results of the independent security assessment are available now for anyone who wants to learn more. Read the report Why we invested in Snow Snow is a Rust implementation of the Noise Protocol Framework, a system for building secure channels using customizable cryptographic handshake patterns based on Diffie-Hellman key exchange. We rely on Noise-protected channels in parts of 1Password. Since Snow gives Rust developers an implementation of that framework, that makes it, for us, part of the security foundation we care about getting right. Funding validation on Snow allows us to improve something we care deeply about while giving back to the open source community that helps make 1Password possible. We are active contributors to Snow. The pull requests we've opened and the independent security assessment we funded reflect our commitment to helping strengthen the project. What Trail of Bits found Trail of Bits reviewed Snow through a combination of manual review and automated testing over four engineer-weeks. Their report identified 10 findings in total: one medium-severity issue, one low-severity issue, and eight informational findings. The most important issue discovered was a nonce-handling bug that could let an attacker permanently disrupt an encrypted channel without knowing any cryptographic secrets. Another findi ## Come join us at the next SQGNE Meeting! Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats - June 17, 2026 DevFeed: [Come join us at the next SQGNE Meeting! Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats - June 17, 2026]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-06-02T02:34:08Z Content type: news Language: en Sources: [T.J. Maher]() Topics: [open-source-security](), [supply-chain-security](), [Malware](), [npm](), [PyPI](), [GitHub](), [software composition analysis](), [Security]() Tags: [github](), [malware](), [npm](), [open-source](), [pypi](), [sca](), [security](), [software-supply-chain](), [sqgne](), [supply-chain](), [supply-chain-attacks]() ### AI overview The Software Quality Group of New England will host a June 17, 2026 meeting featuring Bryan Whyte of Sonatype on open-source malware and software supply chain defense. The session will cover threats targeting npm, PyPI, GitHub, and development pipelines; differences between open-source malware and traditional malware or vulnerabilities; and common tactics used in software supply chain attacks. ### Source excerpt "Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats" will be the topic of the next Software Quality Group of New England (sqgne.org) meeting. Speaker: Bryan Whyte, CISSP Director, Solutions Engineering @Sonatype Date: June 17, 2026 @ 6:00 pm Join us on Zoom or in person at Burlington, MA ( Register Here ) "Bryan Whyte breaks down the latest wave of open source malware, explains how these threats diverge from traditional vulnerabilities, and shares actionable steps for organizations to defend mission-critical software. "As organizations deepen their reliance on open-source software, evolving security threats are reshaping the landscape at an unprecedented pace. "Threat actors are now increasingly targeting development pipelines and trusted ecosystems like npm to orchestrate supply chain attacks with significant downstream impact. Incidents such as the 2025 Shai-Hulud npm campaign, the XZ Utils backdoor, and the widespread compromise of over 23,000 GitHub repositories illustrate how open-source malware has quickly become a critical, top-tier threat built to evade legacy scanning and exploit trust woven into modern delivery pipelines. "--The shifting tactics of threat actors targeting npm, PyPi, GitHub, and development pipelines "--Key differences between open-source malware and traditional malware or vulnerabilities "--The most prevalent malware types and tactics driving today's software supply chain attacks "After spending 20 years in software development, Bryan started his journey into Application Security in 2015 with the AppScan tool suite for Static, Dynamic and Mobile Application Security Testing. In 2018, he expanded his Cybersecurity proficiency, earning the Certified Information Systems Security Professional (CISSP). In 2019, he was excited to join Sonatype due to the explosive growth of open-source software, which has made Software Composition Analysis (SCA) a critical aspect of Application Security". See you there! Happy Testing ## AI-driven zero-day combinations are challenging software security and open-source consumption DevFeed: [AI-driven zero-day combinations are challenging software security and open-source consumption]() Original publisher: [Read original article]() Published: 2026-05-28T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Artificial Intelligence](), [open-source-security](), [Security](), [Open Source](), [Machine Learning, Security Attacks](), [Critical Infrastructure](), [openssf](), [sigstore]() Tags: [ai](), [anthropic-mythos](), [chainguard-containers](), [critical-infrastructure](), [fork](), [mfa](), [mythos](), [open-source](), [open-source-security](), [openssf](), [oss](), [project-glasswing](), [rust](), [sast](), [secure-open-source](), [security](), [sigstore]() ### AI overview The article argues that Mythos represents a potential new class of software-security threat: AI-driven combinations of existing issues that can produce more serious attacks than individual scanner findings. It discusses the limits of government regulation and calls for stronger trust infrastructure, coordinated disclosure, and safer open-source consumption. ### Source excerpt Mythos is changing software security fast. AI-driven zero-days demand new trust infrastructure, coordinated disclosure, and secure open source consumption. ## Preparing for Mythos: Practical advice for engineering teams DevFeed: [Preparing for Mythos: Practical advice for engineering teams]() Original publisher: [Read original article]() Published: 2026-05-26T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [ai security](), [Security](), [anthropic](), [exploit chaining](), [Vulnerabilities](), [open-source-security](), [cURL]() Tags: [advice](), [ai](), [ai-security](), [ai-vulnerability-remediation](), [anthropic](), [article](), [chainguard-containers](), [chainguard-for-ai](), [chainguard-libraries](), [engineering](), [exploit-chaining](), [exploits](), [mythos](), [secure-by-default](), [security](), [vulnerabilities](), [work]() ### AI overview This opinion assesses the security implications of Anthropic's Mythos model and argues that defenders should use AI-assisted methods to identify and remediate vulnerabilities. It says Mythos appears especially capable at exploiting vulnerabilities and chaining exploits, while a test on curl found one new non-critical vulnerability. ### Source excerpt Anthropic's Mythos raises the stakes for software security. Learn how to survive faster exploits with secure-by-default supply chains and AI-assisted defense. ## Building the business case for a secure open source supply chain DevFeed: [Building the business case for a secure open source supply chain]() Original publisher: [Read original article]() Published: 2026-05-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [open-source-security](), [vulnerability management](), [cloud-infrastructure](), [CI/CD](), [distributed-systems](), [container images](), [engineering-culture]() Tags: [chainguard-assemble](), [chainguard-containers](), [chainguard-customers](), [cloud-infrastructure](), [cloud-native](), [compliance](), [container-images](), [continuous-delivery](), [cves](), [dependencies](), [distributed-systems](), [kyndryl](), [kyndryl-open-source](), [open-source](), [productivity](), [resilience](), [secure-open-source](), [software-supply-chain-security](), [supply-chain](), [vulnerabilities]() ### AI overview The article explains how organizations can build a business case for a secure open source supply chain. It describes a shift from framing open source security solely around CVEs, scanner results, and patching toward presenting trusted open source as a driver of productivity, resilience, and delivery speed. It also explains why traditional vulnerability management struggles with continuous delivery, distributed systems, frequently rebuilt container images, changing dependencies, and global cloud infrastructure. ### Source excerpt Learn how Kyndryl reframed open source security as a business driver -- reducing risk, lowering costs, and accelerating developer productivity. ## Accelerating the cyber defense ecosystem that protects us all DevFeed: [Accelerating the cyber defense ecosystem that protects us all]() Original publisher: [Read original article]() Published: 2026-04-16T00:00:00Z Content type: article Language: en Sources: [OpenAI News]() Topics: [OpenAI](), [Cybersecurity](), [supply-chain-security](), [open-source-security](), [Vulnerabilities](), [Critical Infrastructure](), [Open Source](), [API](), [Cloudflare](), [Nvidia]() Tags: [api](), [critical-infrastructure](), [cybersecurity](), [developers](), [enterprise](), [global](), [gpt](), [infrastructure](), [open-source](), [open-source-security](), [openai](), [security](), [vulnerabilities]() ### AI overview OpenAI describes Trusted Access for Cyber, a program intended to expand access to advanced cybersecurity capabilities according to trust, validation, and safeguards. It is providing $10 million in API credits through a Cybersecurity Grant Program to help security teams, vulnerability researchers, maintainers, enterprises, and other defenders strengthen software supply chain security and vulnerability research. ### Source excerpt Leading security firms and enterprises join OpenAI's Trusted Access for Cyber, using GPT-5.4-Cyber and $10M in API grants to strengthen global cyber defense. ## Chainguard Libraries is now free until June 30, 2026 -- no commitment required DevFeed: [Chainguard Libraries is now free until June 30, 2026 -- no commitment required]() Original publisher: [Read original article]() Published: 2026-04-09T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [open-source-security](), [Security](), [Malware](), [Java](), [JavaScript](), [Python]() Tags: [2026](), [article](), [attacks](), [axios](), [chainguard-console](), [chainguard-libraries](), [chainguard-repository](), [code](), [dependency](), [free](), [install](), [java](), [javascript](), [libraries](), [library](), [litellm](), [malicious-packages](), [malware](), [open-source](), [open-source-packages](), [open-source-security](), [packages](), [rebuilds](), [software-supply-chain-security](), [telnyx](), [trivy-attack]() ### AI overview Chainguard Libraries is free for Chainguard console users until June 30, 2026, with no paid commitment required. It rebuilds Python, Java, and JavaScript packages from verified source in isolated environments and excludes libraries that use install-time scripts, helping reduce malware and software supply-chain risk. ### Source excerpt Open source attacks are rising. Chainguard Libraries rebuilds packages from verified source to block malware--now free until June 30, 2026. ## How to protect your organization from the telnyx PyPI compromise DevFeed: [How to protect your organization from the telnyx PyPI compromise]() Original publisher: [Read original article]() Published: 2026-03-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Malware](), [open-source-security](), [SDKs](), [C2](), [Python](), [API keys](), [Encryption](), [Open Source](), [chainguard](), [ssh](), [GitHub Actions]() Tags: [api-keys](), [c2](), [chainguard](), [chainguard-libraries](), [encryption](), [github-actions](), [malware](), [open-source-security](), [pypi](), [pypi-attack](), [pypi-compromise](), [rsa](), [security](), [ssh](), [supply-chain](), [teampcp](), [telnyx](), [telnyx-attack](), [telnyx-compromise](), [trivy]() ### AI overview The article explains that malicious versions 4.87.1 and 4.87.2 of the Telnyx Python SDK were published to PyPI after publishing credentials were compromised. The malware executes at module scope, downloads from a remote C2 server, and uses a WAV file to conceal a Windows persistence binary or credential harvester for Linux and macOS. It recommends immediate removal, version pinning, credential rotation, and persistence checks. The article also attributes the attack to TeamPCP and connects it to a broader coordinated supply chain campaign. ### Source excerpt Malicious telnyx versions hit PyPI in a wider supply chain attack. Chainguard customers stayed protected by using source-built, verified libraries. [Next page]()