October brought four new members and fresh CRA resources from Prague, a practical guide to finding and fixing vulnerabilities with AI, and a new Sandbox project. Next stop: Salt Lake City for Open Source SecurityCon on November 9.

TL;DR

Welcoming New Members → Four new members, a CRA Readiness guide, and 1,400 upstream fixes from Ericsson.
AI Vulnerability Guide → A free guide for finding and fixing vulnerabilities with AI.
New LF Research → AI cuts coding time roughly in half, but maintainers estimate 25% of incoming pull requests are “AI slop.”
Privateer → AI-assisted compliance evaluation joins the OpenSSF Sandbox.
New Tech Talk → Learn how upstream contribution minimizes technical debt & streamlines CRA reporting
GitHub Case Study → Malware advisories now cover eight ecosystems with OpenSSF data.
Podcast: Two October Episodes → Regulatory-era risk with Vincent Danen and ten years of cloud native with Chris Aniszczyk.
Project Releases → Updates from OpenSSF Scorecard, OpenBao, Zarf, Gemara, Darnit, OSV Schema, Sigstore, and Alpha-Omega.
OpenSSF at KubeCon NA → Security Slam wraps November 6; Open Source SecurityCon and KubeCon NA start November 9.

5 min read

OpenSSF Welcomes Four New Members and Releases New CRA Resources

At Community Day Europe in Prague, OpenSSF welcomed A-Team Systems, Emphere, DACHS IT GMBH, and JetBrains. The Foundation also released a CRA Readiness practitioner’s guide, a CRA Readiness User Journey, and role-based User Journeys for developers, security engineers, OSPO leaders, and executives. Read the announcement.

Stop Forking Around: Upstream Contribution and CRA Reporting

Tech Talk: Stop Forking Around: How Upstream Contribution Minimizes Technical Debt & Streamlines CRA Reporting Organizations cut their private forks and contributed more than 1,400 dependency updates and security fixes upstream to meet CRA obligations. Hear how from Ericsson, ActiveState, and Linux Foundation Research in our next Tech Talk on Monday, November 2 at 12:00 PM ET. Register for the webinar.

New Guide: Finding and Fixing Vulnerabilities Using AI

AI is getting good at finding vulnerabilities, and attackers know it. The OpenSSF Best Practices and AI/ML Working Groups built a free, tool-agnostic guide that covers how to prepare, find and fix, and prevent. A course (LFD126) is on the way. Read the blog or jump to the guide.

New LF Research Survey Shows Generative AI Cuts Open Source Coding Time in Half, but 25% of Incoming Pull Requests are Considered AI Slop

New Linux Foundation research, supported by OpenSSF, highlights AI’s productivity gains alongside growing pressures on maintainers. OpenSSF Chief of Staff Adrianne Marcum explains: “AI can write code faster, but contributors still need to understand and test what they submit.”

Explore the findings and recommendations for stronger contribution policies, testing, and transparency in the full report, and read the announcement.

Introducing Privateer: AI-Assisted Compliance Evaluation Joins the Sandbox

Privateer is a plugin-based, AI-assisted framework for evaluating security and compliance. It joins the OpenSSF Sandbox under the ORBIT Working Group. Read the blog.

Case Study: GitHub Expands Malware Advisories Across Eight Ecosystems

See how GitHub integrated OpenSSF’s malicious-package data into its Advisory Database to expand Dependabot malware alerts across eight ecosystems. Read the case study.

Who Checked It? Attestations, Gemara, and CRA Due Diligence

A guest blog on how the Gemara project makes sense of security attestations, streamlines supply chain evaluations, and supports CRA due diligence. Read the guest blog.

What’s in the SOSS? An OpenSSF Podcast

#75 – S3E27 From Upstream to Downstream: Managing Open Source Risk in a Changing Regulatory Era with Vincent Danen

Red Hat’s VP of Product Security joins CRob for a deep dive on managing open source risk as regulation shifts. Listen now.

#76 – S3E28 Invisible Infrastructure, Autonomous Agents, and 10 Years of Cloud Native with CNCF’s Chris Aniszczyk

CRob and CNCF CTO Chris Aniszczyk celebrate a decade of scaling invisible infrastructure and how it’s evolving. Listen now.

News from OpenSSF Community Meetings and Projects

The Best Practices Working Group approved the Concise Guide for Collaborating with Open Source Projects to help commercial manufacturers establish sustainable upstream engagement aligned with the EU CRA. Meanwhile, researchers from Purdue University and Bloomberg received the Best Paper Award at SCORED 2026 for their work on Software Dark Matter, which analyzes untracked security-critical files that escape standard SBOM declarations.
The Global Cyber Policy Working Group’s Devroom, Beyond the CRA – Building Secure and Resilient Open Source, was accepted for FOSDEM.
Voting for the OpenSSF Technical Advisory Council (TAC) Community Voting Representative is open, with ballots active through Sunday, November 8th.
Akrites SIRT is now a CVE Numbering Authority (CNA) for projects directly attached to the Linux Foundation or any of its sub-foundations, unless the project has a Supplier CNA of its own.
OpenBao released v2.7.2, addressing multiple security vulnerabilities across authentication and secret engines while introducing UI configuration for external keys in PKI. The release also improves cluster-wide backend reloading and resolves unresponsiveness for rate-limit-exempt paths during post-unseal.
Sigstore Cosign announced v3.1.4, adding the bundle create-from-container command, building releases with Go 1.27.3, and publishing community AI policy guidelines in AGENTS.md. In tandem, Rekor released v1.5.5 with configurable TLS serving and JSON canonicalization improvements, while ecosystem client libraries sigstore-python v4.5.1 and sigstore-java v2.4.0 received major dependency and verification upgrades.
gittuf published v0.17.0, introducing an experimental, high-performance go-git storage backend and support for custom application-defined fields in the Record of State Log (RSL). The update also optimizes Sigstore metadata fetching and separates git-remote-gittuf into its own standalone repository.
Zarf delivered v0.88.0, adding schema generation and linting tools for v1beta1 packages and component configurations. The v1.0.0 release is targeted for November 9th and we hope you’ll join us at ZarfFest at KubeCon North America on November 11th.
AMPEL released v1.4.2, standardizing SKIP evaluation outcomes across root policies and exposing verifier engine metadata directly to the CEL evaluation environment. Additionally, the project has officially joined OpenSSF under the Policy Labs organization.
The Model Signing project reviewed an architectural proposal for an optional closure predicate to verify dependencies when machine learning models dynamically load external weights or code at runtime. Concurrently, the End-to-End Model Provenance SIG concluded its activities to merge ongoing AI supply chain integrity initiatives directly into the AI/ML Working Group and Model Signing efforts.
Upcoming community meetings

Meet OpenSSF at These Upcoming Events!

Security Slam 2026 – Fall Edition — Now through November 6. Learn more.
Open Source SecurityCon North America — November 9, Salt Lake City. Event page.
KubeCon + CloudNativeCon North America — November 9–12, Salt Lake City. Stop by OpenSSF booth #313 (Solutions Showcase, Hall 4); Security Slam participants can pick up awards November 10–12. Event page.
Meet OpenSSF & Zarf at ZarfFest — November 11 | 6:30–9:30 p.m. Register.

Ways to Participate

There are a number of ways for individuals and organizations to participate in OpenSSF. Learn more here.

You’re invited to…

Join a Working Group or Project

Chat with us on Slack

Join OpenSSF

See You Next Month!

Missed an issue? Browse the newsletter archive. Send ideas for next month to marketing@openssf.org.

Regards,

The OpenSSF Team