If you follow open source vulnerabilities AISLE is a name you’ve seen popping up recently. We aim to grow an active, healthy community of contributors, reviewers, and code owners. OpenSSF is committed to working both upstream and with existing communities to advance open source security for all. CVE Lite CLI, a fast open source dependency vulnerability scanner for JavaScript and TypeScript projects, has graduated to OWASP Lab Project status three months after its initial release.
OWASP AppSec Israel is one of the leading cybersecurity conferences in the region, bringing together experts, professionals, and enthusiasts from around the world. It is a gathering of 400+ web app developers, security engineers, mobile developers, and information security professionals. The German Chapter of the Open Worldwide Application Security Project (OWASP) organizes its national OWASP conference annually. Join OpenSSF at AGNTCon + MCPCon North America this October to explore the Secure Agentic Framework (SAF) and learn how to secure the future of agentic AI ecosystems. OpenSSF events are a great opportunity to get involved with the OpenSSF community across the security and open source ecosystem.
But it’s a people problem we can probably use technology to help. Mo does a really good job of explaining why this is fundamentally a people https://power-at-work.com/cybersecurity-risks-and-solutions-for-connected-construction-equipment/ problem, not a technology problem. Josh welcomes Josh Marpet for a discussion about abandoned open source packages. It’s not all technical solutions, there are non technical things we can do to help reduce the risk posed by our technical systems failing. We also ask where are all the vulnerabilities that project Glasswing found. While the number of CVEs is way up, the number of actually exploited vulnerabilities isn’t growing year over year.
How is OpenSSF ensuring inclusive representation of the open source community?
This approach requires a DevSecOps (development, security, and operations) mindset that integrates security practices and tools into every stage of the DevOps (development operations) pipeline. Transitive dependencies are the indirect dependencies that get introduced when an open source package pulls in other packages of its own. The result is a growing backlog of known, exploitable vulnerabilities sitting inside production systems.
- CISA calls upon developers to make open source software secure from the start.
- Anaconda Core provides access to a curated repository of packages that have been vetted for security and stability, helping teams reduce their exposure to malicious or unmaintained packages.
- Patrick explains the current trends we are seeing around vulnerabilities right now.
- The development is being completed through a contract with the Department of Homeland Security.
- AI Catalyst helps teams accelerate deployment from months to days while maintaining enterprise security standards.
A single vulnerability in a widely used open source package is a potential entry point into thousands of systems simultaneously—but most organizations lack the automated security solutions needed to manage open source risk at scale. That ubiquity brings transparency, rapid innovation, community collaboration, and access to cutting-edge tools that would cost a fortune to build from scratch. It is more important than ever that we bring the industry together in a collaborative and focused effort to advance the state of open source security. Create and maintain best practices guides & education materials that ensure both current and future OSS developers obtain & maintain sufficient secure development skills. This focus supports the community to develop tooling, processes, and educational assets that accelerate OSS security technical initiatives.
- Most vulnerability scanning tools rely on the NIST National Vulnerability Database as their primary source of common vulnerabilities and exposures (CVE) data.
- It is a gathering of 400+ web app developers, security engineers, mobile developers, and information security professionals.
- The software is analyzed with a subset of the scanning features to prevent the development team from being overwhelmed.
- A well-known example is the March 2026 Axios compromise, in which attackers introduced a malicious dependency into two releases of axios, the most popular JavaScript HTTP client library.
- Participate meaningfully in standards, frameworks and public policy that impact OSS security.
- Maintainership and governance processes are decided by the projects without regard to OpenSSF membership.
Why does the industry need OpenSSF now?
As open source has become more pervasive, its security has become a key consideration for building and maintaining critical infrastructure that supports mission-critical systems throughout our society. Participate meaningfully in standards, frameworks and public policy that impact OSS security. Drive technical engagement to create integrated tools that remove barriers to adopting security foundations to improve open source software security. Objectives focus on tooling and processes designed to ensure consistency, integrity, and risk assessment that strengthen the overall security of the OSS ecosystem. The OpenSSF remains committed to directly facilitating an environment for all perspectives, all backgrounds, and equitable opportunities for global mentorship and education.
The OpenSSF is viewed as an influential advocate for mutually-beneficial external efforts and an educator of policy decision makers. This includes fostering collaboration within and beyond the OpenSSF, establishing best practices, and developing innovative solutions. The Open Source Security Foundation (OpenSSF) seeks to make it easier to sustainably secure the development, maintenance, release, and consumption of open source software (OSS).
Blog: Lessons from XZ Utils: Achieving a More Sustainable Open Source Ecosystem
All organizations can use this same exercise package to assess their preparedness and response. This resource helps agencies and organizations use open source software (OSS) securely, https://www.inrecognition.org/what-impact-does-cybersecurity-have-on-business-trust/ manage supply chain risk, and engage constructively with open source communities. Tools for discovering security vulnerabilities in applications, networks, and infrastructure
Finding difficult vulnerabilities with Jaya Baloo from AISLE
Join us as we celebrate OWASP’s 25th Anniversary with a free virtual conference dedicated to the global community that makes our mission possible. Join 1,000+ developers, DevOps engineers, architects, security specialists, product leaders, and other industry professionals dedicated to advancing the future of application security. At LASCON, leaders at these companies along with security architects and developers, gather to share cutting-edge ideas, initiatives, and technology advancements. Join 400+ security professionals, developers, and architects for Portugal’s premier application security conference.
