Guest blog opportunities are open to members, working groups in collaboration, and with limited exceptions for active contributors and thought leaders. Share your insights on open source security with our community.
OpenSSF Blog
Nov 6, 2026 |
In Blog
OpenSSF Community Day Europe 2026: Driving Systemic Security and Operational Resilience in Open Source
At OpenSSF Community Day Europe 2026 in Prague, more than 200 attendees gathered onsite as practitioners, maintainers, policymakers, and security leaders came together across two distinct tracks: the Main Track (South Hall 3B) focusing on core community strategy, policy, and tooling, and the dedicated SCORED Track (South Hall 3A) highlighting… Read more.
Nov 6, 2026 |
From Sigstore to CRA readiness: Sylva’s journey with OpenSSF
Sylva’s security work relies heavily on the OpenSSF ecosystem. From supply chain tooling with Sigstore and SLSA to adopting OpenSSF Scorecard and Best Practices badges, learn how Sylva is approaching EU Cyber Resilience Act (CRA) readiness and building verifiable trust for downstream operators. Read more.
Nov 5, 2026 |
Case Study: Kubescape Completes All Six Security Slam Badges with OpenSSF
Kubescape completed all six project-level badges in the Fall 2026 Security Slam, bringing maintainers and community contributors together to strengthen security across its open source Kubernetes platform. Learn how 150+ hours of community contribution helped achieve OSPS Baseline Level Two status and harden 12+ repositories. Read more.
Nov 3, 2026 |
The PHP Security Wake-Up Call: Fixes Are Only the Beginning
By Jeff Borek and Mike LinksvayerRecent PHP vulnerabilities highlight why open source security requires sustained investment and action from everyone who builds on it. PHP, an open source programming language, powers roughly 70% of websites whose server-side language is known. On October 21, 2026, the project released security updates for… Read more.
Oct 30, 2026 |
New LF Research Survey Shows Generative AI Cuts Open Source Coding Time in Half, but 25% of Incoming Pull Requests are Considered AI Slop
While Generative AI boosts developer productivity and lowers barriers to entry, a new Linux Foundation Research report reveals it also increases maintainer workloads. With 25% of incoming pull requests now considered "AI slop," the findings highlight an urgent need for stronger open source project governance. Read more.
Oct 23, 2026 |
In Blog
New OpenSSF Tech Talk: How Upstream Contribution Minimizes Technical Debt & Streamlines CRA Reporting
Maintaining private forks of open source software (OSS) comes with a hidden tax, costing organizations an average of 5,160 labor hours per release cycle in maintenance and engineering overhead. Beyond the accumulating technical debt and security risks, passive open source consumption is no longer sustainable under emerging regulatory frameworks like… Read more.
Oct 22, 2026 |
Who Checked It? Attestations, Gemara, and CRA Due Diligence
Discover how the OpenSSF Gemara project clarifies the complex world of security attestations, streamlines software supply chain evaluations, and helps organizations confidently meet EU Cyber Resilience Act (CRA) due diligence requirements. Read more.
Oct 20, 2026 |
New OpenSSF Guide: Finding and Fixing Vulnerabilities Using AI
AI has gotten good at finding software vulnerabilities, and attackers are already using it. For example, “AI-enabled adversaries increased attacks by 89% year-over-year” according to the CrowdStrike 2026 Global Threat Report. If you maintain or develop software, it is critical to find and fix vulnerabilities before attackers exploit them. Read more.
Oct 16, 2026 |
Case Study: GitHub Expands Malware Advisories Across Eight Ecosystems with OpenSSF
Learn how GitHub integrated OpenSSF's malicious-package data into its Advisory Database to expand Dependabot malware alerts across eight ecosystems. Read more.
Oct 13, 2026 |
Introducing Privateer: AI-Assisted Security & Compliance Evaluation Framework Joins the OpenSSF Sandbox
Discover Privateer, a new plugin-based, AI-assisted security and compliance evaluation framework that has officially joined the OpenSSF Sandbox under the ORBIT Working Group. Read more.
