OpenSSF

🎉 The 2025 OpenSSF Annual Report has officially arrived!!! We invite you to celebrate another year of progress, creativity, and collaboration shaping a safer, more resilient open source community. Download the report: openssf.org/download-the-202… #AnnualReport #OSSSecurity

AI speeds up development. Who’s keeping up with maintenance? Abby Kearns, CEO of ActiveState, explores the AI security gap hiding in routine updates and what it means for keeping open source dependencies secure. hubs.la/Q04DNNNh0

Welcome Beautiful Majestic Dolphin, DevGuard, and UElement Technologies to OpenSSF! Announced at Open Source #SecurityCon North America, our newest members join a growing community advancing open source security. Read the announcement: hubs.la/Q04DMbVg0

Secure software delivery, even without internet access. Zarf 1.0 brings stronger package signing and verification workflows and a redesigned package schema to air-gapped deployments. Congratulations to the Zarf community! hubs.la/Q04DLnrH0

👋 See you at #SecurityCon tomorrow! Our room is 255BC and is located one floor above where you'll pick up your badge. It's a long trek to get there though, so we made a quick video and some slides to help you find it more easily. Hope this helps!

At #OpenSSFCommunity Day Europe 2026 in Prague, 200+ open source maintainers, security researchers, and policymakers gathered to drive systemic security and operational resilience across the ecosystem. Check out the complete event recap: openssf.org/blog/2026/11/06/…

Building toward CRA readiness? Start with the OpenSSF ecosystem. @Project_Sylva shares what worked and what’s still hard with sigstore, SLSA, OpenSSF Scorecard, the Best Practices Badge, OSPS Baseline, Security Insights, and the CRA Readiness Guide. hubs.la/Q04Dz-Br0

🏆 Kubescape earned all six badges in this year’s Fall Security Slam with OpenSSF tools. Congrats to the contributors. Looking forward to seeing the community at #KubeCon. Stop by OpenSSF booth #313! hubs.la/Q04DtQSt0

A security fix only protects systems when it reaches them. The recent PHP vulnerabilities show why upstream investment and downstream action must advance together. Read five practical steps for policymakers: hubs.la/Q04D9qGK0

🎙️ What’s actually in your Swift build? Apple’s Ev Cheng and Sam Khouri join What’s in the SOSS? to discuss accurate SBOMs and baking security into the toolchain. Listen: hubs.la/Q04D6LTx0

📊 AI speeds up coding, but maintainers estimate 1 in 4 pull requests are “AI slop.” New research supported by OpenSSF explores the gains, challenges, and need for clear AI contribution policies. hubs.la/Q04CWvvw0

Join OpenSSF and Defense Unicorns at ZarfFest on November 11. Meet fellow maintainers, swap stories with builders, and make new connections across cloud native and software security. hubs.la/Q04CQCp70

🚨 New Tech Talk Alert 📅 Nov 2, 12 PM ET: Join OpenSSF to learn how an upstream-first strategy reduces tech debt & streamlines CRA compliance! Featuring experts from @LinuxFoundation, @ericsson, & @ActiveState. Read: openssf.org/blog/2026/10/23/… Register: zoom.us/webinar/register/WN_…

💎 How do software attestations support due diligence? Eddie Knight explores how OpenSSF’s Gemara connects security policies, evaluations, enforcement, and audit evidence, with a practical look at CRA readiness. Read more: hubs.la/Q04B_-8X0

Your Wednesday night #KubeCon plans? Sorted. Join OpenSSF + Defense Unicorns at ZarfFest for drinks, bites, and open source community. Nov. 11 | 6:30–9:30 p.m. Le Méridien, Salt Lake City Register: hubs.la/Q04BTggR0

OpenSSF just launched a new guide: Finding and Fixing Software Vulnerabilities Using AI, authored by David A. Wheeler. Learn how to prepare your setup, run AI effectively, and build deterministic safety nets for your code. Read & access the guide: openssf.org/blog/2026/10/20/…

What happens when an AI agent can hide its tracks? @cra of @CloudNativeFdn joins @SecurityCRob to talk agents, disappearing evidence, and why independent observability matters. 🎧 New What’s in the SOSS? hubs.la/Q04BMNfL0

From 1 ecosystem to 8. 🔐 GitHub expanded malware advisories using OpenSSF’s community-driven data, bringing broader coverage to developers with Dependabot malware alerts enabled. See shared security infrastructure in action: hubs.la/Q04BrR290

Welcome Privateer to the OpenSSF Sandbox! 🎉 Privateer combines automated security checks with optional AI-assisted evidence review, flagging uncertain findings for human review. Explore the project and get involved: hubs.la/Q04B4bft0

Our new report, “Strengthening Software Supply Chain Security with OpenChain and OpenSSF,” explores how OpenChain's governance processes and OpenSSF's secure engineering practices work together. hubs.la/Q04zv64D0

🚀 The Fall Security Slam is live! Join the open source community October 5–November 6 to strengthen your project’s security, earn badges, and put OpenSSF best practices into action. All projects are welcome! 🎥 Learn how to get started with Eddie: hubs.la/Q04zmpx10