News from Open Source #SecurityCon New members: Target and Thread AI Membership upgrade: OSTIF Golden Egg Awards go to Sarah Evans, Justin Cappos, Patrick Zielinski, Evan Anderson and Brandt Keller 🎉 openssf.org/press-releas...

Join us at #KubeCon for a deep-dive on SBOMit -- a build-time technique for generating in-toto attestations and using them to produce SBOMs that don’t miss dependencies. 📅 Tue, Nov 11, 2025 🕑 2:00–5:00 PM 📍 Building B | Level 2 | Room B213 #SBOM #OSSSecurity

How can open source maintainers prove their project’s security posture? 💬 Learn about the OSPS Baseline in our latest What’s in the SOSS? discussion with Ben Cotton & Eddie Knight. openssf.org/podcast/2025... #OpenSSF

ICYMI 👻 Attackers are using AI… and it’s spooky. Great insights from Hugo Huang + Canonical on why securing AI is the next battleground and how open source helps. Read more 👉 openssf.org/blog/2025/08... #OpenSSF

🚨 Zarf Tech Talk happening next Thursday 2PM ET! Join experts from Defense Unicorns, Sonatype, and Boeing next week too see how #Zarf keeps #Kubernetes and cloud-native workloads running smoothly in air-gapped environments. Register: openssf.org/resources/te...

🚨 Zarf Tech Talk happening next Thursday 2PM ET! Join experts from Defense Unicorns, Sonatype, and Boeing next week too see how #Zarf keeps #Kubernetes and cloud-native workloads running smoothly, no connection required. Register: openssf.org/resources/te...

Stay informed in the fast-moving world of open source security. The October #OpenSSF Newsletter covers AI security, SBOM evolution, OpenSSF Scorecard improvements, and upcoming events built for developers. Read the full update: openssf.org/newsletter/2...

📣 Our next Tech Talk is around the corner. Hear from experts from Defense Unicorns, Boeing, and Sonatype as they talk about how OpenSSF project #Zarf simplifies software delivery in disconnected or semi-connected environments. 📅 Sign-up now: openssf.org/resources/te... #openssf

The global push for #SBOM standards is reshaping how we approach cybersecurity and transparency. 🌍 Explore how the EU #CRA, CISA, and @OpenSSF efforts are aligning global software supply chain security. openssf.org/blog/2025/10...

💬 “You are not alone. It’s totally OK to ask for help.” — Seth Larson In this week’s What's In the SOSS podcast, Seth Larson joins host Yesenia Yser to talk about trust, maintainers, and building security together. 🎧 Listen: openssf.org/podcast/2025... #OpenSSFCommunity

❓What’s new in the #OSPS Baseline? The latest release (v2025-10-10) refines guidance across access control, build & release practices, and documentation, making it easier for maintainers to adopt and demonstrate strong security practices. baseline.openssf.org/release_note...

💚 #OSS thrives when communities are welcoming and inclusive. Listen to the latest GR-OSS OUT Podcast from G-Research, Tabatha DiDomenico & Stacey Potter from OpenSSF 🎧 www.youtube.com/watch?v=Us_M...

🚀 Ready to build software securely in the age of AI? #AI code assistants can boost productivity, but they can also introduce real security risks. Earn your digital badge in just one hour and write safer, smarter code. 📘 openssf.org/blog/2025/10... 👉 training.linuxfoundation.org/express-lear...

42 is the answer to life, the universe… and everything. For #OpenSSF, it’s the answer to secure AI development. Listen to What’s in the SOSS? Episode #42 ft. David A. Wheeler + the launch of LFEL1012 🎧 Listen → openssf.org/podcast/2025... 🎓 Enroll → training.linuxfoundation.org/express-lear...

🎉 The new #Sigstore Rekor transparency log public dataset is now available on BigQuery! This dataset makes it easier for researchers to analyze software signing trends & understand how artifacts are signed across the open source ecosystem. 🔗 Read: openssf.org/blog/2025/10...

Heading to #PyTorchCon 2025? Don’t miss our BoF on Applying DevSecOps Lessons to MLSecOps (Oct 23 | 10:30 AM PDT). Join Jeff Diecks + Mihai Maruseac as we explore secure AI/ML development with the OpenSSF AI/ML Security WG. 👉 sched.co/27QQG #OpenSSF #MLSecOps

The @ostifofficial.bsky.social recently completed a security audit of #OpenSSFScorecard. With support from the OpenSSF, this audit covered five core repositories and included threat modelling, manual code review, and fuzz testing. . Read to learn more:🔗 openssf.org/blog/2025/10...

Financial services run on open source, and #OpenSSF is helping make it more secure. At #OSFF, our community is leading sessions on: 🔹 OSPS Baseline 🔹 CVE & vulnerability data 🔹 AI security 📖Read the blog: openssf.org/blog/2025/10...

Security is no longer optional -- it’s essential. Join us at #OpenSource SecurityCon (co-located with #KubeCon + #CloudNativeCon North America 2025) to learn, connect & collaborate on the future of secure software. Read more 👇 🔗 openssf.org/blog/2025/10...

New #podcast episode 🎙️ AI agents are changing the game for open source security. CRob talks with John Amaral of root.io about the shift from scanning to fixing first. Listen → openssf.org/podcast/2025...

⏪ On September 24, OpenSSF hosted a Tech Talk with experts on securing the #AI/ML lifecycle. Recording & slides now available: openssf.org/resources/te... 📖 Read the recap: openssf.org/blog/2025/10... #OSSecurity

🎉 The September #OpenSSF Newsletter is live! CRA + SBOM updates Golden Egg Awards 🥚 AI/ML security resources OpenSSF Community Day Europe & India recaps New podcasts + free courses openssf.org/newsletter/2...

⏳ Join our Securing the AI Lifecycle Tech Talk in 1.5 hours! We’re bringing together experts from Intel Labs, Google, and Dell Technologies to explore how open source can make AI/ML pipelines more secure. See you there at 1PM ET! openssf.org/resources/te...

From SPDX to SBOMs to safety-critical systems, Kate Stewart has been shaping the future of secure open source. In this episode of What’s in the SOSS?, she discusses her journey, Zephyr Project, ELISA Project and what the CRA means for developers and manufacturers. openssf.org/podcast/2025...

Registries like PyPI, Maven Central & crates.io power the ecosystem. They can’t run on goodwill alone. OpenSSF endorses the Joint Statement on Sustainable Stewardship. 👉 openssf.org/blog/2025/09... #PreserveOpenSource

How to contribute your first line of code to open source? Contributing to the OpenSSF #community isn’t just about code, it’s about building trust, learning how secure software is built, and growing your career. Read the blog and take your first step: openssf.org/blog/2025/08...

🚆 From Ghent to Brussels! At the end of October, OpenSSF, the Linux Foundation, and Linux Foundation Europe will host three gatherings advancing security, policy, and collaboration across Europe’s open source ecosystem. 👉 Learn more: openssf.org/blog/2025/09... #CRA #OSSSecurity

🧾 SBOMs are everywhere, but how do you make them decision-ready for risk management? Read the blog that introduces the white paper “Improving Risk Management Decisions with SBOM Data,” from the OpenSSF SBOM Everywhere SIG: openssf.org/blog/2025/09...

🚨 AI code assistants are powerful, but they’re only as secure as the prompts you give them. This practical resource helps developers write clear, security-focused prompts so assistants generate safer, more reliable code. 📖 Read the blog: openssf.org/blog/2025/09...

🕙 #OSSummit Europe & #OpenSSFCommunity Day Europe may have ended, but the momentum continues far beyond Amsterdam 🌍 👉 Read the full recap + explore photos & recordings here: openssf.org/blog/2025/09...

What does the EU’s Cyber Resilience Act mean for open source developers? At #OSSummit EU, The New Stack sat down with Christopher Robinson to unpack the CRA’s implications. Watch the full conversation on The New Stack Agents podcast ⬇️

On August 15, GitHub’s Open Source Friday spotlighted the OpenSSF Global Cyber Policy WG in a live session hosted by Kevin Crosby, GitHub. 📖 Read the recap blog, watch the replay, and explore ways you can join the conversation: openssf.org/blog/2025/09... #OSSSecurity

🌞 This summer in Hyderabad, the #OpenSSFCommunity came together for a full day of open source security at OpenSSF Community Day India. Read the recap: openssf.org/blog/2025/09...

⏳ The clock is ticking. PQC migration is due by 2030. In the latest What’s in the SOSS? podcast, Keyfactor’s David Hook & Tomas Gustavsson join Yesenia to unpack #postquantum cryptography, crypto agility & entropy -- and why orgs must act now. 🎧 Listen → openssf.org/podcast/2025...

Agenda is live! 📣 #OpenSSFCommunity Day Korea 2025 is your chance to connect, learn, and collaborate on securing open source. 📍 Nov 4 | Seoul | Co-located with #OSSummit Speakers from AWS, Ericsson, & more. 👉 openssf.org/blog/2025/09...

At #OpenSSFCommunity Day Europe, we celebrated momentum in open source security 🎉 🌟 Golden Egg Awards 🌟 AI/ML Security WG whitepaper 👉https://openssf.org/press-release/2025/08/28/openssf-celebrates-global-momentum-ai-ml-security-initiatives-and-golden-egg-award-winners-at-community-day-europe/

Trustify is now part of GUAC! 🎉 Hear from Ben Cotton (Kusari) & Dejan Bosanac (Red Hat) at #OpenSSFCommunity Day EU → openssfcdeu2025.sched.com/event/25dGq Details 👉https://openssf.org/blog/2025/08/27/trustify-joins-guac/

At #OSSummit in Amsterdam, The New Stack spoke with CRob, OpenSSF’s Chief Security Architect, about the impact of the Cyber Resilience Act (CRA) on open source. 📺 Watch: youtu.be/oAgHEQit5JU?...

New podcast episode! 🎙 Sarah Evans (Dell Technologies #OpenSSF AI/ML Security WG) joins What’s in the SOSS? to discuss: 🔐 AI Model Signing 📄 MLSecOps whitepaper 👩‍💻 New AI/ML personas Listen now: 🎧 openssf.org/podcast/2025...

#OSSummit and #OpenSSFCommunity Day Europe are almost here. What’s on your “don’t miss” list? Visit the #OpenSSF booth B33 for demos, AMAs, and practical insights from the people building secure-by-design tools for open source. Read the highlights: openssf.org/blog/2025/08...

Secure AI, CRA readiness & 5 years of #OpenSSF! Inside the August newsletter: ✨ MLSecOps Whitepaper 🔍 Baseline & Guac case study 🎙 CRA + OSTIF podcasts 🎓 Free courses 👉 openssf.org/newsletter/2...

How do you prove your open source project is secure in minutes, not weeks? #GUAC did it using #OpenSSF’s #OSPSBaseline + #LFX Insights. Faster trust. Less friction. More time to build! Read the full story: openssf.org/blog/2025/08...

🎉 Big week for the OpenSSF community at #BlackHatUSA + #DEFCON33! From packed panels to big wins in the #AIxCC, our community showed what’s possible when open source security leaders, researchers, and innovators come together. Read the full recap: openssf.org/blog/2025/08...

🚨 The AI wave is here, and with it comes a new cybersecurity battleground. Discover how open source tools like #Sigstore, and #SLSA-based frameworks can help close these gaps and build more resilient AI systems. Read the blog and learn how to get involved: openssf.org/blog/2025/08...

📺 We’re going live at Open Source Fridays by GitHub! Join Madalin, CRob, and David for a live session diving into the OpenSSF Global Cyber Policy Working Group and the EU #CRA! 📅 Streaming live on: 🔗 YouTube: www.youtube.com/watch?v=lBcp... 🔗 Twitch: www.twitch.tv/GitHub

🎉 10 YEARS of OSTIF 🎉 Hear how they’ve made #opensource security audits collaborative, supportive & effective for over a decade Listen: openssf.org/podcast/2025...

Love #SBOMs ☕ Hate Mondays 😒 Join us TODAY at 11 AM ET — we’ve got the meeting for you! openssf.org/getinvolved/

New to OpenSSF or thinking about getting involved? We've got you. 💡 This blog by Ejiro and Sal introduces all our working groups, tools, and projects like #sigstore, #SLSA, and #OpenSSFScorecard. Start here 👉 openssf.org/blog/2025/08...

🎥 The Japan OSS Security Meetup video is now live! Catch the latest on Protobom, SBOMs, and event takeaways from Tokyo & Denver. ▶️ youtu.be/3ReRO5OUJMU #OpenSSFCommunity

Cheering on the #AIxCC teams at #DEFCON 33 as they work to secure open source infrastructure. Catch our panel at the AIxCC Village: 🧠 Applying DevSecOps Lessons to MLSecOps 📅 Sat, Aug 9 | ⏰ 10:30 AM 🔗 openssf.org/blog/2025/08...