September brings a commitment to sustainable package registries, practical Cyber Resilience Act (CRA) guidance, new community security work, and three conversations on AI, regulation, and dependency risk. Join us in Prague for OpenSSF Community Day Europe on October 6.

TL;DR

Sustainable Package Registries → OpenSSF’s Governing Board supports durable funding models for public registries.
Grow CRA Readiness → A role-specific community garden journey for maintainers, stewards, and manufacturers.
Security Slam 2026 → OpenSSF and CNCF TAG Security team up for a fall security challenge.
Podcast: Three September Episodes → CRA guidance with Madalin Neag, AI and security with Mark Russinovich, and dependency debt with Abby Kearns.
Community Releases → Updates from OpenSSF Scorecard, OpenBao, gittuf, Zarf, protobom, Gemara, and Sigstore.
OpenSSF Community Day Europe → Join us October 6 in Prague; project demos and booth volunteers are welcome.

5 min read

We’re In: Enterprise Commitment to Sustainable Package Registries

Public package registries face rising security and operating costs. OpenSSF’s Governing Board commits to supporting sustainable funding models as enterprise customers while keeping access available to individual developers. Read the commitment.

Case Study: How Does IBM Turn Open Source Participation Into Enterprise and Career Value?

IBM Enterprise Security Executive Jamie Thomas discusses how IBM’s historical journey with Java, Linux, and Red Hat shaped its strategy for turning open source software consumption into intentional stewardship, enterprise value, and career growth for developers. Through OpenSSF, that participation brings enterprise experience into a community working to secure the software upon which everyone depends. Learn more.

Security Slam 2026 – Fall Edition

OpenSSF and CNCF TAG Security are partnering on the fall Security Slam around KubeCon + CloudNativeCon North America. Learn how projects and contributors can take part.

Summer Mentorship Showcase

Meet emerging developers contributing to stronger software supply chain security through OpenSSF’s summer mentorship program. Read their stories.

Grow CRA Readiness: Find Your Path Through the European Union Cyber Resilience Act

OpenSSF’s community garden journey helps maintainers, open source software stewards, and manufacturers identify the CRA guidance and resources relevant to their roles. Explore the journey and the community guide to the September 11 manufacturer reporting deadline.

Empowering Open Source Security with Scalable Infrastructure

AWS describes how funding and scalable compute can support maintainers’ CI, fuzzing, testing, and artifact distribution. Read the guest blog.

A Community Guide to the EU CRA September 11 Deadline for Manufacturers

Discover key insights into the European Union Cyber Resilience Act (CRA) September 11, 2026 reporting obligations for manufacturers, alongside practical guidance enabling open source maintainers and stewards to streamline security response workflows. Read the community guide.

Open by Default After AI: The GDS Guidance and the Enforcement Question

The Government Digital Service (GDS) issued guidance reaffirming that public sector code should remain “open by default,” refuting NHS England’s decision to hide GitHub repositories over AI-driven vulnerability concerns by clarifying that opacity is not a valid substitute for proper security hygiene and rapid patching. Read here

What’s in the SOSS? An OpenSSF Podcast

#71 – S3E23 Navigating the New Era: The EU Cyber Resilience Act Explained with Madalin Neag
OpenSSF EU Policy Advisor Madalin Neag demystifies the EU Cyber Resilience Act (CRA). Learn how the CRA establishes a horizontal cybersecurity baseline for digital products. Listen now

#72 – S3E24 Balancing AI’s Double-Edged Sword: Software Engineering, Unlearning, and Ecosystem Sustainability with Mark Russinovich

Join Azure CTO and OpenSSF Board Chair Mark Russinovich as he discusses AI’s impact on software engineering, supply chain security, and vulnerability management. Listen now

#73 – S3E25 Securing the Source: Navigating AI Velocity, CRA Compliance, and Dependency Debt with Abby Kearns

In this episode of What’s in the SOSS, ActiveState CEO Abby Kearns breaks down the rapidly evolving open source security landscape. Listen now

News from OpenSSF Community Meetings and Projects

Contribute in Prague: Project maintainers and contributors can lead 30-minute Lightning Learning sessions during OpenSSF Community Day Europe on October 6. Sign up for a session.
Volunteers at Open Source Summit Europe can take short shifts at the OpenSSF booth for demos and questions. Sign up for a booth shift.
OpenSSF Scorecard migrated its public infrastructure with AboutCode to AWS and published the scorecard-infra repository. Community-hosted Allstar ended in August; users should move to self-hosted Allstar.
Self-hosted Allstar instructions.
The TAC approved the sandbox application for a new SBOM & VEX Working Group. Read the application.
OpenBao released v2.7.0 beta with external KMS-backed keys, post-quantum support, and PostgreSQL read scalability; v2.6.2 includes security fixes. Beta release; stable release.
OpenBao v2.6.2 release.
gittuf v0.16.0 adds SHA-256 repository support, storage and TUI improvements, and key inspection tools. Release notes.
Zarf v0.85.0 adds v1beta1 component config publishing, OCI source prefixing, and Helm retry controls. Release notes.
Protobom v0.6.0 expanded SPDX support and serialization; v0.6.1 followed. v0.6.0; v0.6.1.
Gemara released go-gemara v0.10.0 and established repositories for GRC Store capabilities. Explore Gemara.
The Securing Software Repositories WG discussed npm’s post-quantum package-signature plans with Sigstore. Sigstore also released Rekor v1.5.4, including a hashedrekord CLI default and request hardening. Rekor release.
The AI/ML Security and Best Practices WGs completed an initial draft of Finding and Fixing Vulnerabilities using AI (LFD126). Course draft.
Security Insights launched a web-based Form & Wizard Editor for maintainers. Open the editor.
Model Signing merged its Open Model Signing Conformance Suite and is developing dataset-signing and multi-signature logging proposals.
Alpha-Omega continues its Security Engineer in Residence work with the Apache Software Foundation, Erlang Ecosystem Foundation, and OSTIF. ASF update; Erlang update; OSTIF update.
OpenSSF’s CRA community garden journey offers role-specific paths for maintainers, stewards, and manufacturers. Explore it.
Recap and resources from the recent Global Cyber Policy Working Group’s CRA Tech Talk:
- Access the recording on-demand.
- Review presentation decks:
Upcoming community meetings.

Cybersecurity Policy & Regulatory Updates

The European Commission updated subchapter 5.5 of its FAQ, confirming that the September 11, 2026 CRA reporting deadline applies exclusively to manufacturers. For open source software stewards, compliance obligations start December 11, 2027. Review OpenSSF’s steward guide and manufacturer checklist for details.
Several national cybersecurity authorities published guidance regarding CRA reporting requirements:
- Ireland NCSC: National CRA Guidelines
- Belgium CCB: European Reporting Obligations
- Germany BSI: Single Reporting Platform Platform Overview
ENISA released new resources for September reporting obligations:
- Updated FAQ, Glossary, and SRP User Manual.
- Published the ENISA Threat Landscape 2026 report.
- Launched an MSME CRA investment survey examining cybersecurity planning.
- Opened public consultation on its draft Technical Advisory on AI-assisted development. Share input in the Feedback for the Open Consultation on the ENISA’s Technical Advisory on AI-assisted software development .
The Linux Foundation released a readiness guide covering CRA preparation steps for hosted projects.
Review the CRA Expert Group agenda for the upcoming meeting.
The ECCC announced a Digital Europe call for proposals.
Politico highlighted the EU’s initial findings on code vulnerabilities identified with AI frontier models.

Meet OpenSSF at These Upcoming Events!

OpenSSF Community Day Europe — October 6, Prague. Event details and registration.
Open Source Summit Europe — October 7–9, Prague. Event page.
- Join the OpenSSF Global Cyber Policy Working Group for an interactive workshop (and boxed lunch!) at Open Source Summit Europe + Embedded Linux Conference, Friday October 9, 2026 12:45 – 14:00 CEST | Chamber Hall (Floor 3)
AGNTCon + MCPCon North America — October 20–23, San Jose. OpenSSF preview.
Open Source SecurityCon North America — November 9, Salt Lake City. Event page.
KubeCon + CloudNativeCon North America — November 9–12, Salt Lake City. Security Slam preview.
- Meet OpenSSF & Zarf at Zarfest — November 11 | 6:30–9:30 p.m. Register

Ways to Participate

There are a number of ways for individuals and organizations to participate in OpenSSF. Learn more here.

You’re invited to…

Join a Working Group or Project

Chat with us on Slack

Join OpenSSF

See You Next Month!

Missed an issue? Browse the newsletter archive. Send ideas for next month to marketing@openssf.org.

Regards,

The OpenSSF Team