Today, @linuxfoundation.org announced a $12.5 million investment from a powerhouse coalition including Anthropic, Amazon Web Services (AWS), Google, Google DeepMind, GitHub, Microsoft, and OpenAI. Managed by OpenSSF and the Alpha-Omega project. openssf.org/blog/2026/03...

The Linux Foundation Announces $12.5 Million in Grant Funding (via Alpha-Omega and OpenSSF) Anthropic, AmazonWebServices (AWS), GitHub, Google, GoogleDeepMind, Microsoft, OpenAI to Invest in Sustainable Security Solutions for #OpenSource openssf.org/press-releas...

The #OpenSSF Mentorship Program 2026 cycle is here! Whether you're a student looking to learn or a pro ready to lead, join us. 🎧 Inside Scoop: Check out the latest What’s in the SOSS? Podcast to hear how mentees become project maintainers. openssf.org/podcast/2026...

🔍 What to expect at Open Source #SecurityCon Europe 2026? From eBPF-based algorithms to the latest on the EU Cyber Resilience Act, we’re covering the tech and policy that keeps our ecosystem safe. 🔗 Read: openssf.org/blog/2026/03...

The agentic AI Tech Talk is happening next week -- have you registered yet? Read the blog to see why this conversation matters: from agent autonomy & trusted tool interaction to context integrity, it outlines what you’ll learn in the session. openssf.org/blog/2026/03...

Join OpenSSF next week for a #TechTalk and explore how community-driven frameworks like SAFE-MCP are being used to secure autonomous systems. 📅 March 17, 1 PM ET 🔗 https://openssf.org/resources/tech-talks/tech-talk-securing-agentic-ai-in-practice-from-openssf-guidance-to-real-world-implementation/

The EU #CRA is a major milestone for open source, but it can feel overwhelming. At FOSDEM 2026, Harald Fischer from balena broke down the first steps toward conformity using a simple metaphor. 🔗 Read the full guest blog and watch the FOSDEM session here: openssf.org/blog/2026/03...

🔍 The #OSPSBaseline provides practical guidance for open source maintainers and organizations to strengthen project security. It defines clear baseline expectations across areas like repository management, access control, and vulnerability handling. https://youtu.be/rx0NG4P9vaQ?si=KNS-C_zVfejhAE-1

New What’s in the SOSS? podcast episode is live 🎙️ Jennifer Power and Hannah Braswell from Red Hat join Sally Cooper to explain how the Gemara Project is helping make GRC engineering more interoperable across open source. 🎧 Listen: openssf.org/podcast/2026...

Introducing the #Gemara Model -- a new framework for GRC engineering. It outlines a 7-layer architecture designed to help teams standardize how security policies are defined, enforced, and measured. 📖 Blog: openssf.org/blog/2026/03... 📄 Publication: openssf.org/resources/ge...

#AgenticAI is moving fast -- but is it secure? 🤖🔐 📅 Join us for an OpenSSF Tech Talk on the practical realities of securing agentic systems on March 17, 1PM ET! Hear from experts from Microsoft, Canonical, TestifySec, and Thread AI! Register: openssf.org/resources/te... #OSSSecurity

Think you need special permission to contribute to OpenSSF? Think again. ❌ #OSSSecurity thrives on diverse perspectives. Whether you’re into AI/ML security, policy, or dev best practices, there’s a seat at the table for you. 🪑 Read: openssf.org/blog/2026/03...

In this final episode of our AI Cyber Challenge (#AIxCC) series, CRob and Jeff Diecks wrap-up the journey from DARPA's groundbreaking two-year competition to the exciting collaborative phase happening now. 🎧 openssf.org/podcast/2026...

How do you implement the EU Cyber Resilience Act without overburdening open source maintainers? Our new case study explores how Red Hat worked with OpenSSF to align #CRA standards with community-driven development. Read more: openssf.org/blog/2026/03...

Huge updates in the world of Open Source Security! 🔐 The #OpenSSF February Newsletter is out, and it is packed with resources for developers and security teams. Stay ahead of the curve and check out the full breakdown here: openssf.org/newsletter/2...

Maintainers: make your project’s security visible. Start with the #OpenSSF Baseline and earn your badge: 🔗 openssf.org/blog/2026/02...

Now live: ROI for Open Source Software Contribution The data is clear: • 2 to 5x ROI • Faster security response • Less technical debt Read the report: openssf.org/resources/ro... #OpenSSF

AI is playing an increasing role in open source security. Part of our #AIxCC series, Trail of Bits shares lessons from DARPA’s challenge and how AI + fuzzing can deliver real results. openssf.org/podcast/2026...

AI is reshaping open source software and expanding the attack surface. Join our Tech Talk on Securing Agentic AI to explore practical approaches to managing risk, trust, and control in AI-driven systems. Register: openssf.org/resources/te...

Package repository security impacts every OSS ecosystem. 🔐 OpenSSF convened npm, PyPI, Maven Central, RubyGems, crates.io & more to tackle shared challenges -- from identity to governance and sustainability. Read: openssf.org/blog/2026/02... #OSSSecurity

End-of-Life (#EOL) software is creating permanent security risks that can’t be patched away. Join us today at 11am EST as we unpack the 2026 State of the Software Supply Chain Report and share strategies to tackle "forever risks." Save your spot: webinars.sonatype.com/wcc/eh/50116...

At #FOSDEM2026, the CRA in Practice DevRoom showed how developers, maintainers, foundations, & manufacturers are turning the EU #CRA into workflows, powered by open collaboration, practical tooling, and community-driven processes. 👉 Recap: openssf.org/blog/2026/02...

From skeptics to believers. Hear how Team Atlanta won DARPA’s AI Cyber Challenge (AIxCC) by combining fuzzing, symbolic execution, and LLMs to find and prove vulnerabilities in open source. 🎧 Listen: openssf.org/podcast/2026...

#SecuritySlam2026 is open for registration! 🔬 From Feb 20~Mar 20, OpenSSF is partnering with CNCF TAG Security & Compliance and Sonatype on a 30-day challenge focused on improving real-world security hygiene. 👉 Learn how to participate and register: openssf.org/blog/2026/02...

Modern compilers offer powerful annotation features that improve memory safety, correctness, diagnostics, and performance, but they’re often underused. This #OpenSSF's new Compiler Annotations for C & C++ guide explains how to use them effectively. 🔗: openssf.org/blog/2026/02...

⏰The CFP for #OpenSSFCommunity Day North America is closing February 15. Read the blog and learn about: ✅ The types of topics we’re looking for ✅ What makes a strong, community-driven proposal ✅ Key dates you don’t want to miss openssf.org/blog/2026/02...

New podcast 🎙️ How did the AI Cyber Challenge go from skepticism to success? Start with AIxCC Part 1 – From Skepticism to Success and hear how #AIxCC reshaped thinking around AI + cybersecurity. Part 1 kicks off a 4-episode series: openssf.org/podcast/2026...

Open Source #SecurityCon Europe 2026 is heading to Amsterdam 🇳🇱 This blog highlights speakers & perspectives from across the OpenSSF community, all bringing hands-on experience from production environments. Read the blog: openssf.org/blog/2026/02... #OSSSecurity

CFPs don’t have to be scary. Learn how to get your conference talk accepted, avoid common pitfalls, and show up with confidence. 🎤 New What’s in the SOSS episode out now. openssf.org/podcast/2026...

🔐 Open source security in 2026 is taking shape. The January newsletter covers CRA readiness, 2026 themes, VEX adoption, AI security, and upcoming community events like #FOSDEM and Open Source SecurityCon Europe. openssf.org/newsletter/2...

OpenSSF community will be at #FOSDEM2026 this week, bringing practical perspectives on CRA readiness, vulnerability intelligence, SBOMs, and software supply chain security 🔐 Read the blog and find out where to find us & what not to miss: openssf.org/blog/2026/01... #OSSSecurity

Season 3 of What’s in the SOSS? starts now 🎙️ We’re welcoming Sally Cooper as an official co-host and talking about why #marketing matters in open source, why trust is the real currency, and how people find their way into the OpenSSF community. openssf.org/podcast/2026...

🎉 We’re excited to share a new blog introducing OSSAfrica, an OpenSSF community-led initiative focused on strengthening open source security across Africa by bringing people together across roles, experience levels, and geographies. Read: openssf.org/blog/2026/01... #OSSSecurity

“Open source provides inputs, not regulated products.” 🧩 Madalin explains why #CRA upstream self-attestation risks shifting responsibility to maintainers, and why automation, machine-readable metadata, and downstream accountability scale better. Read the blog: openssf.org/blog/2026/01...

🎉 OpenSSF’s 2026 Themes are here, and so is Honk’s 2026 Vision Board, inspired by our new blog post that outlines the community roadmap for securing the future of open source! Read the blog & see how themes align with our 2026 priorities: openssf.org/blog/2026/01... #OSSSecurity

🚨 CFP is open for #OpenSSFCommunity Day North America, and we want to hear from YOU!! This is a community conference focused on sharing what’s working, what’s hard, and what others can learn. 🗓️ CFP closes: February 15 👉 Submit your proposal: events.linuxfoundation.org/openssf-comm...

ICYMI: The latest What’s in the SOSS? #podcast celebrates OpenSSF’s 5-year anniversary and recaps a huge year for open source security. 🎧 Listen here: openssf.org/podcast/2025...

Conference badges can mean more than a name 🎟️ Madalin shares what it has meant to represent the Open Source Security Foundation and The Linux Foundation across Europe 🌍 from #opensource events to policy rooms and standards discussions. Read the story: openssf.org/blog/2026/01... #OSSSecurity

🔍 VEX promises clarity in vulnerability management, but adoption is still uneven. This #OpenSSF community paper looks at: • What’s working (and what isn’t) • CSAF vs OpenVEX vs SPDX vs CycloneDX • Tooling gaps, trust, and regulation ...and more. 🔗: openssf.org/blog/2026/01...

👀 Everyone’s talking about the #OSPSBaseline. This new blog serves as a "Resource Hub" where you can learn what it is, see it in action, and understand how open source projects can improve security over time. 📎 Read: openssf.org/blog/2026/01...

📖 Part 2 of this blog series shares practical tips for using #AI in software development, avoiding “vibe coding,” & strengthening security through human review & intent. Take a clear look at where AI helps, where it doesn’t, & what comes next: openssf.org/blog/2026/01...

🎙️ "What's in the SOSS?" Podcast Season Finale is live! Join co-hosts CRob & Yesenia for a special season finale celebrating OpenSSF’s 5th anniversary, & a look back at a truly transformative year for open source security. 🛡️ 🎧 Listen: openssf.org/podcast/2025... #OSSSecurity

💻 AI is now the norm in software development, but security hasn’t caught up. This blog explains: • Why productivity is driving #AI adoption • Where AI-generated code creates real security risk • What developers need to watch out for Read Part 1: openssf.org/blog/2025/12...

🧑‍🌾 bomctl makes SBOMs easier to work with by handling format and version differences for you. Convert between SPDX and CycloneDX, upgrade spec versions, and link #SBOMs across suppliers and systems. Watch the OpenSSF Project Spotlight about #bomctl: youtu.be/Tax1pNaySYQ?...

OpenSSF-funded improvements to sigstore’s rekor-monitor are making transparency logs easier to monitor for malicious package releases and identity misuse. Great work by Trail of Bits, with support from the sigstore maintainer's Hayden Blauzvern and Mihai Maruseac. openssf.org/blog/2025/12...

As 2025 comes to a close, we’re grateful for the people behind open source security. Thank you for your collaboration, commitment, and community spirit. 📘 Explore the 2025 OpenSSF Annual Report: openssf.org/download-the... Happy Holidays from the #OpenSSFCommunity.

The December 2025 #OpenSSF Newsletter is live 🎉 Featuring the 2025 Annual Report, free education courses, new podcast episodes, project updates, and upcoming events across the open source security community. Read it here 👉 openssf.org/newsletter/2...

🛡️ #gittuf brings supply chain security to the source itself - applying portable, policy-based attestations directly to Git repositories. From two-party reviews to test enforcement, gittuf makes GitOps & repo-driven workflows more trustworthy by default. 🎥 : youtu.be/bQ-GHyHJcbc?...

🎙️ New episode of What’s in the SOSS is live! Justin Cappos from @nyutandon.bsky.social joins #OpenSSF to talk about software supply chain security education, open source collaboration, and preparing students for real world security work. 🎧 Listen here: openssf.org/podcast/2025...

When a new vulnerability drops, the first question is always: Is this in my supply chain? 🔍 By ingesting and enriching #SBOMs with vulnerability and dependency data, #GUAC lets you query your entire application portfolio and pinpoint where action is needed immediately. 🎥 youtu.be/uDT0xes5ico?...