#opensourcesecurity — Public Fediverse posts

🔐 Attending USENIX in Baltimore? Join @steiza tomorrow for:

Supply Chain Attacks on Open Source: What’s Happening, What Can We Do Today, and What’s Next

📅 August 13, 2026
🕟 4:30 PM
📍 Baltimore, MD

#USENIX #OpenSourceSecurity #SupplyChainSecurity

🔐 Attending USENIX in Baltimore? Join @steiza tomorrow for:

Supply Chain Attacks on Open Source: What’s Happening, What Can We Do Today, and What’s Next

📅 August 13, 2026
🕟 4:30 PM
📍 Baltimore, MD

#USENIX #OpenSourceSecurity #SupplyChainSecurity

This week on #OpenSourceSecurity I had a chat with @43081j about the @e18e project

The idea is to cleanup, speedup, and level up NPM projects. It's a really cool idea and is also a hugely complicated challenge

I learned a ton from James and the project is always looking for volunteers

https://opensourcesecurity.io/2026/2026-08-e18e-james/

This week on #OpenSourceSecurity I had a chat with @43081j about the @e18e project

The idea is to cleanup, speedup, and level up NPM projects. It's a really cool idea and is also a hugely complicated challenge

I learned a ton from James and the project is always looking for volunteers

https://opensourcesecurity.io/2026/2026-08-e18e-james/

This week on #OpenSourceSecurity I chat with Patrick Garrity from VulnCheck about a report they wrote that looked at the number of actually exploited vulnerabilities

The increase of CVEs is out of control, but the number of things that get exploited is flat

We obsess over the raw number, but reality tells a different story

https://opensourcesecurity.io/2026/2026-08-vulncheck-state-of-exploitation/

This week on #OpenSourceSecurity I chat with Patrick Garrity from VulnCheck about a report they wrote that looked at the number of actually exploited vulnerabilities

The increase of CVEs is out of control, but the number of things that get exploited is flat

We obsess over the raw number, but reality tells a different story

https://opensourcesecurity.io/2026/2026-08-vulncheck-state-of-exploitation/

https://opensourcesecurity.io/2026/07-supply-soup/

@joshbressers is on a roll. Peak Josh sarcasm, guaranteed pH-value around zero. Go read it, keep 🍿 at the ready.

Certainly agree on the "explosive diarrhea opportunity" argument. You forgot to find an opportunity to garnish the post with some salad leaves.

The rest is as hilarious as it is on point.
Question is: Whereto next?

• Invest more in complexity reduction?
• More in containment and ability to be failure-operational? - See the last podcast episode on that.
• Or that "it's all infrastructure and hence FOSS needs to be nationalized, government run and paid from tax money" argument which is all too popular at the moment.

Or maybe that

• Force to internalize the FOSS risk back onto those that are possibly profiting from it argument?

After all, FOSS is the video-game edition of the literal sofa/cook top/... someone threw on the street and you thrifted it because it seemed to still be good enough to re-use for a while.
With the video game effect being that it immediately reappears once you took it. pling

Intentionally commercial FOSS might be the slightly better looking loot, but with a line attached to it and usually intentionally missing parts for certain use cases. Which is completely fine.

All rules and regulations are present for this already. They're just large scale ignored across the board. Funnily even by a very large degree of those who create said FOSS.

I guess it's just easier to do nothing and enjoy freshly roasted smores on the ever burning garbage fire that Josh post described so nicely?
:flan_shrug: :dumpster_fire_gif:

#foss #opensouce #opensourcesecurity #dumpsterfire #popcorn #smores #explosivediarrhea

https://opensourcesecurity.io/2026/07-supply-soup/

@joshbressers is on a roll. Peak Josh sarcasm, guaranteed pH-value around zero. Go read it, keep 🍿 at the ready.

Certainly agree on the "explosive diarrhea opportunity" argument. You forgot to find an opportunity to garnish the post with some salad leaves.

The rest is as hilarious as it is on point.
Question is: Whereto next?

• Invest more in complexity reduction?
• More in containment and ability to be failure-operational? - See the last podcast episode on that.
• Or that "it's all infrastructure and hence FOSS needs to be nationalized, government run and paid from tax money" argument which is all too popular at the moment.

Or maybe that

• Force to internalize the FOSS risk back onto those that are possibly profiting from it argument?

After all, FOSS is the video-game edition of the literal sofa/cook top/... someone threw on the street and you thrifted it because it seemed to still be good enough to re-use for a while.
With the video game effect being that it immediately reappears once you took it. pling

Intentionally commercial FOSS might be the slightly better looking loot, but with a line attached to it and usually intentionally missing parts for certain use cases. Which is completely fine.

All rules and regulations are present for this already. They're just large scale ignored across the board. Funnily even by a very large degree of those who create said FOSS.

I guess it's just easier to do nothing and enjoy freshly roasted smores on the ever burning garbage fire that Josh post described so nicely?
:flan_shrug: :dumpster_fire_gif:

#foss #opensouce #opensourcesecurity #dumpsterfire #popcorn #smores #explosivediarrhea

🔒 Ah yes, the GitHub Blog provides a revolutionary guide to protect your open-source projects by suggesting you, um, use GitHub Actions to prevent attacks on GitHub Actions. 🚀 Because nothing says "security" like blindly trusting the very service you need protection from. 🤖
https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/ #GitHubActions #OpenSourceSecurity #CyberSecurity #TrustIssues #TechHumor #HackerNews #ngated

🔒 Ah yes, the GitHub Blog provides a revolutionary guide to protect your open-source projects by suggesting you, um, use GitHub Actions to prevent attacks on GitHub Actions. 🚀 Because nothing says "security" like blindly trusting the very service you need protection from. 🤖
https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/ #GitHubActions #OpenSourceSecurity #CyberSecurity #TrustIssues #TechHumor #HackerNews #ngated

I got to chat with @mairin about Red Hat's Project Lightwell on #OpenSourceSecurity

It's going to be interesting to figure out how everyone will start interacting with open source projects. This is something Red Hat is pretty good at already

https://opensourcesecurity.io/2026/2026-07-lightwell-mo-duffy/

I got to chat with @mairin about Red Hat's Project Lightwell on #OpenSourceSecurity

It's going to be interesting to figure out how everyone will start interacting with open source projects. This is something Red Hat is pretty good at already

https://opensourcesecurity.io/2026/2026-07-lightwell-mo-duffy/

I had a chat with Lori Lorusso and Niko Matsakis about the Rust Foundation Maintainers Fund

Funding open source is a huge topic right now, the Rust Foundation has some great ideas. It will be exciting to watch this one grow and evolve

https://opensourcesecurity.io/2026/2026-07-rfmf-lori-niko/

#OpenSourceSecurity #rust #RustFoundation

I had a chat with Lori Lorusso and Niko Matsakis about the Rust Foundation Maintainers Fund

Funding open source is a huge topic right now, the Rust Foundation has some great ideas. It will be exciting to watch this one grow and evolve

https://opensourcesecurity.io/2026/2026-07-rfmf-lori-niko/

#OpenSourceSecurity #rust #RustFoundation

📊🛡️ Linux domină clasamentele CVE în 2026: De ce numărul mare de vulnerabilități raportate este, de fapt, o veste bună 🚀🐧Rapoartele statistice privind securitatea cibernetică din 2026 scot la iveală o realitate izbitoare: Linux conduce detașat în topul sistemelor de operare cu cele mai multe vulnerabilități (CVE — Common Vulnerabilities and Exposures) înregistrate.La o primă vedere, un titlu precum "Linux Tops 2026 CVE Charts" poate suna alarmant pentru companii și administratori de sistem. Totuși, experții în securitate subliniază că interpretarea brută a acestor cifre este complet greșită și că realitatea din teren spune o poveste total diferită: mai multe vulnerabilități raportate înseamnă un sistem mai transparent și mai sigur.Iată de ce Linux domină aceste clasamente și care este semnificația reală din spatele statisticilor:🔹 Paradoxul Securității Open-Source („Legea lui Linus”)Spre deosebire de sistemele proprietare (cum sunt Windows sau macOS), unde codul este secret și raportările depind de echipele interne ale companiilor mamă, Linux funcționează sub principiul transparenței absolute."Găsirea unei breșe nu înseamnă că sistemul a devenit brusc nesigur, ci că o problemă ascunsă a fost în sfârșit scoasă la lumină și neutralizată."Mii de cercetători independenți, companii gigant (Google, Red Hat, Intel, Microsoft) și pasionați din întreaga lume auditează zilnic kernelul Linux. Acest nivel uriaș de atenție duce la descoperirea și înregistrarea oficială a sute de bug-uri minore sau teoretice care, în cazul software-ului proprietar, adesea rămân nedocumentate sau neraportate public.🔹 Volum vs. Severitate: Ce se ascunde în statistici?Nu toate CVE-urile sunt create la fel. O mare parte din numărul masiv care plasează Linux pe primul loc constă în vulnerabilități de severitate scăzută sau medie, multe dintre ele fiind extrem de greu de exploatat în scenarii reale de producție (necesitând, de exemplu, acces fizic la mașină sau privilegii locale deja existente).În plus, o bună parte din aceste vulnerabilități sunt identificate prin procese automatizate avansate de tip fuzzing direct în fazele de testare ale kernelului, fiind remediate înainte ca versiunile respective să ajungă în distribuțiile stabile de producție utilizate de companii (cum ar fi Ubuntu LTS, RHEL sau Debian).🔹 Viteza de reacție: Avantajul suprem al LinuxCeea ce contează cu adevărat în securitatea cibernetică nu este dacă un software are un defect, ci cât de repede este remediat. În timp ce sistemele proprietare pot aștepta săptămâni sau luni până la următorul pachet masiv de actualizări („Patch Tuesday”), în ecosistemul Linux:Corecțiile pentru vulnerabilitățile critice sunt scrise, testate și distribuite adesea în termen de câteva ore de la raportare.Datorită modularității și tehnologiilor moderne de tip Livepatching, administratorii pot aplica aceste patch-uri pe servere fără a fi nevoiți să repornească sistemul, menținând serviciile active și protejate.📈 ConcluziePoziția Linux în topul graficelor CVE din 2026 nu este un indicator al slăbiciunii, ci o dovadă a maturității și a unui ecosistem de securitate incredibil de sănătos și activ. Într-o lume digitală în care infrastructura globală de cloud, supercomputerele și miliarde de dispozitive inteligente (IoT) rulează pe Linux, transparența totală rămâne singura cale eficientă de a garanta o reziliență veritabilă în fața atacurilor cibernetice.#Linux #Cybersecurity #CVETrends2026 #OpenSourceSecurity #LinuxKernel #PatchManagement #Linuxiac #TechNews

📊🛡️ Linux domină clasamentele CVE în 2026: De ce numărul mare de vulnerabilități raportate este, de fapt, o veste bună 🚀🐧Rapoartele statistice privind securitatea cibernetică din 2026 scot la iveală o realitate izbitoare: Linux conduce detașat în topul sistemelor de operare cu cele mai multe vulnerabilități (CVE — Common Vulnerabilities and Exposures) înregistrate.La o primă vedere, un titlu precum "Linux Tops 2026 CVE Charts" poate suna alarmant pentru companii și administratori de sistem. Totuși, experții în securitate subliniază că interpretarea brută a acestor cifre este complet greșită și că realitatea din teren spune o poveste total diferită: mai multe vulnerabilități raportate înseamnă un sistem mai transparent și mai sigur.Iată de ce Linux domină aceste clasamente și care este semnificația reală din spatele statisticilor:🔹 Paradoxul Securității Open-Source („Legea lui Linus”)Spre deosebire de sistemele proprietare (cum sunt Windows sau macOS), unde codul este secret și raportările depind de echipele interne ale companiilor mamă, Linux funcționează sub principiul transparenței absolute."Găsirea unei breșe nu înseamnă că sistemul a devenit brusc nesigur, ci că o problemă ascunsă a fost în sfârșit scoasă la lumină și neutralizată."Mii de cercetători independenți, companii gigant (Google, Red Hat, Intel, Microsoft) și pasionați din întreaga lume auditează zilnic kernelul Linux. Acest nivel uriaș de atenție duce la descoperirea și înregistrarea oficială a sute de bug-uri minore sau teoretice care, în cazul software-ului proprietar, adesea rămân nedocumentate sau neraportate public.🔹 Volum vs. Severitate: Ce se ascunde în statistici?Nu toate CVE-urile sunt create la fel. O mare parte din numărul masiv care plasează Linux pe primul loc constă în vulnerabilități de severitate scăzută sau medie, multe dintre ele fiind extrem de greu de exploatat în scenarii reale de producție (necesitând, de exemplu, acces fizic la mașină sau privilegii locale deja existente).În plus, o bună parte din aceste vulnerabilități sunt identificate prin procese automatizate avansate de tip fuzzing direct în fazele de testare ale kernelului, fiind remediate înainte ca versiunile respective să ajungă în distribuțiile stabile de producție utilizate de companii (cum ar fi Ubuntu LTS, RHEL sau Debian).🔹 Viteza de reacție: Avantajul suprem al LinuxCeea ce contează cu adevărat în securitatea cibernetică nu este dacă un software are un defect, ci cât de repede este remediat. În timp ce sistemele proprietare pot aștepta săptămâni sau luni până la următorul pachet masiv de actualizări („Patch Tuesday”), în ecosistemul Linux:Corecțiile pentru vulnerabilitățile critice sunt scrise, testate și distribuite adesea în termen de câteva ore de la raportare.Datorită modularității și tehnologiilor moderne de tip Livepatching, administratorii pot aplica aceste patch-uri pe servere fără a fi nevoiți să repornească sistemul, menținând serviciile active și protejate.📈 ConcluziePoziția Linux în topul graficelor CVE din 2026 nu este un indicator al slăbiciunii, ci o dovadă a maturității și a unui ecosistem de securitate incredibil de sănătos și activ. Într-o lume digitală în care infrastructura globală de cloud, supercomputerele și miliarde de dispozitive inteligente (IoT) rulează pe Linux, transparența totală rămâne singura cale eficientă de a garanta o reziliență veritabilă în fața atacurilor cibernetice.#Linux #Cybersecurity #CVETrends2026 #OpenSourceSecurity #LinuxKernel #PatchManagement #Linuxiac #TechNews

I had the pleasure to chat with @allanfriedman about Bill of Materials things on #OpenSourceSecurity

We touched on SBOMs, HBOMs, AIBOMs, and even some other BOM types I can't remember now

Allan is always fun to chat with, and he has encyclopedic knowledge about the BOM universe

https://opensourcesecurity.io/2026/2026-06-allan-omnibom/

I had the pleasure to chat with @allanfriedman about Bill of Materials things on #OpenSourceSecurity

We touched on SBOMs, HBOMs, AIBOMs, and even some other BOM types I can't remember now

Allan is always fun to chat with, and he has encyclopedic knowledge about the BOM universe

https://opensourcesecurity.io/2026/2026-06-allan-omnibom/

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=5jT7yhBi5CM

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=5jT7yhBi5CM

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=5jT7yhBi5CM

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=5jT7yhBi5CM

IBM and Red Hat’s $5B Project Lightwell highlights a new reality: AI is accelerating cyber risk faster than companies can remediate it. https://hackernoon.com/ai-is-speeding-up-vulnerability-discovery-most-security-teams-arent-built-to-keep-up #opensourcesecurity

IBM and Red Hat’s $5B Project Lightwell highlights a new reality: AI is accelerating cyber risk faster than companies can remediate it. https://hackernoon.com/ai-is-speeding-up-vulnerability-discovery-most-security-teams-arent-built-to-keep-up #opensourcesecurity

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=rlIzI419Sjc

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=rlIzI419Sjc

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=rlIzI419Sjc

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=rlIzI419Sjc

I had a chat on #OpenSourceSecurity with Mike Milinkovich and Thabang Mashologu from @EclipseFdn about their new managed Open VSX registry

It's becoming common knowledge that the public open source registries are on an unsustainable path, the Eclipse Foundation has a plan that seems pretty sensible to keep the Open VSX registry around

https://opensourcesecurity.io/2026/2026-06-openvsx-mike-thabang/

I had a chat on #OpenSourceSecurity with Mike Milinkovich and Thabang Mashologu from @EclipseFdn about their new managed Open VSX registry

It's becoming common knowledge that the public open source registries are on an unsustainable path, the Eclipse Foundation has a plan that seems pretty sensible to keep the Open VSX registry around

https://opensourcesecurity.io/2026/2026-06-openvsx-mike-thabang/

Miasma Worm Spreads as Open-Source Toolkit Compromises GitHub Repos

A newly discovered open-source toolkit, known as Miasma Worm, is wreaking havoc on GitHub repositories, allowing attackers to execute a range of malicious activities via stolen credentials. This powerful supply chain attack toolkit can compromise multiple platforms, including PyPI, npm, and RubyGems, and even spread through AI…

https://osintsights.com/miasma-worm-spreads-as-open-source-toolkit-compromises-github-repos?utm_source=mastodon&utm_medium=social

#OpenSourceSecurity #SupplyChain #Github #MiasmaWorm #PackageManagement

I had a chat with François Proulx on #OpenSourceSecurity about CI/CD security and a tool he built to red team your own pipelines. Holy cow this is a wild topic right now. I chatted with François a bit over a year ago before CI/CD lit on fire, his warnings back then were very apt

https://opensourcesecurity.io/2026/2026-06-fran%C3%A7ois-smoked-meat/

I had a chat with François Proulx on #OpenSourceSecurity about CI/CD security and a tool he built to red team your own pipelines. Holy cow this is a wild topic right now. I chatted with François a bit over a year ago before CI/CD lit on fire, his warnings back then were very apt

https://opensourcesecurity.io/2026/2026-06-fran%C3%A7ois-smoked-meat/

Open Source Faces Hard Fork Amid AI-Fueled Security Crisis

The open source community is facing a daunting security crisis fueled by AI, giving rise to a new category of threat dubbed "Mythos" - a complex chain of low-level issues that can be combined to create devastating attacks. This emerging threat is not just a single bug or false positive, but a game-changing phenomenon that demands…

https://osintsights.com/open-source-faces-hard-fork-amid-ai-fueled-security-crisis?utm_source=mastodon&utm_medium=social

#OpenSourceSecurity #AifueledThreats #Mythos #EmergingThreats #SupplyChain

Open Source Community Unprepared for EU's Cyber Resilience Act

The open source community is lagging behind on cybersecurity readiness, with stagnating awareness and a lack of preparedness for the EU's Cyber Resilience Act, which requires minimum security standards for hardware and software products by December 2027. It's time for urgent action to avoid falling short…

https://osintsights.com/open-source-community-unprepared-for-eus-cyber-resilience-act?utm_source=mastodon&utm_medium=social

#CyberResilienceAct #OpenSourceSecurity #EuRegulations #SupplyChainSecurity #VulnerabilityManagement

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=JAm86bCwDvM

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=JAm86bCwDvM

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=JAm86bCwDvM

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=JAm86bCwDvM

This week on #OpenSourceSecurity I have a chat with Sal Kimmich about open source validation. Sal has some really interesting insight about what the future could look like. It's not patching faster, it's systemic solutions

https://opensourcesecurity.io/2026/2026-06-verification-sal-kimmich/

This week on #OpenSourceSecurity I have a chat with Sal Kimmich about open source validation. Sal has some really interesting insight about what the future could look like. It's not patching faster, it's systemic solutions

https://opensourcesecurity.io/2026/2026-06-verification-sal-kimmich/

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=UGUnqfA0VuA

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=UGUnqfA0VuA

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=UGUnqfA0VuA

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=UGUnqfA0VuA

Malicious Packages Exploit Realistic Identities

Malicious open source packages are getting smarter, with 91% using realistic identities and naming-variant tactics to blend in with legitimate projects, making them harder to spot. This shift away from simple typosquatting tricks means developers need to be extra vigilant when adding dependencies to their workflows.

https://osintsights.com/malicious-packages-exploit-realistic-identities?utm_source=mastodon&utm_medium=social

#MaliciousPackages #OpenSourceSecurity #SupplyChain #NamingvariantTactics #Typosquatting

🚨 Neuer Angriff auf das NPM‑Ökosystem!
Am 23. Jan. 2024 wurden kritische JavaScript‑Pakete mit der Malware **“Shuffled NPM”** kompromittiert.

**Wichtig:**
- Prüft eure Abhängigkeiten ▶ Verwendet Hash‑Checks & automatisierte Scans.
- Folgt den Sicherheitswarnungen von npm‑security.
- Nutzt Lock‑Files & Monorepos, um ungewollte Updates zu verhindern.

#JavaScript #NPM #OpenSourceSecurity #NodeJS #PrivacyFirst

🔗 https://news.google.com/rss/articles/CBMijgFBVV95cUxQSzRWMU5rVVRHbGJsMWVYQ3NET1Y0cGNLX2NWbjdnWGEtT0ktZm5iMnctTnQwQXFPemlUUkEyRzNvdWxNeXBRMkQ4MTJKMDRLSnhJd2FlZjE4UFJiSjJJN3FFV3dESWI1WG9ZQVoyVXVoLXJNXzF4WmE0dk9SS2VTb3gyb01tNjk2ZGJUbHdB?oc=5

This week on #OpensourceSecurity I chat with @caseyjohnellis about vulnerability disclosure

This is a pretty hip topic right now, and on any list of the best in the business, Casey is at the top

I guarantee anyone who listens to this one will learn something useful

https://opensourcesecurity.io/2026/2026-05-vulnerability-disclosure-casey-ellis/

This week on #OpensourceSecurity I chat with @caseyjohnellis about vulnerability disclosure

This is a pretty hip topic right now, and on any list of the best in the business, Casey is at the top

I guarantee anyone who listens to this one will learn something useful

https://opensourcesecurity.io/2026/2026-05-vulnerability-disclosure-casey-ellis/

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=HlKQmWVn2Kc

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=HlKQmWVn2Kc

I had a chat with @eighthave about @fdroidorg on #OpenSourceSecurity

We cover how it works, the security angles for running an app store, and talk about some of the changes that are coming for Android that will make F-Droid's job a lot harder

I learned a ton from Hans, it's a great discussion

https://opensourcesecurity.io/2026/2026-05-fdroid-hans-steiner/

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=N-6Sc5CQwI0

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=N-6Sc5CQwI0

https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised
#CyberSecurity #InfoSec #SupplyChainSecurity #SoftwareSupplyChain #NPM #OpenSourceSecurity #AppSec #DevSecOps #ThreatIntel #Malware #JavaScript #NodeJS #CICD #GitHubActions #CloudSecurity #TypeScript #ReactJS #WebDev #OpenSource #DevTools #SoftwareEngineering #DeveloperSecurity #SecureCoding #GitHub #SupplyChainAttack #Programming #TechNews #DevOps #ApplicationSecurity #ThreatResearch #SecurityEngineering #CyberAttack #Hackers #MalwareAlert #SecurityResearch #DevCommunity