Tag

open source security

23 articles

Latest in open source security

Blogs

Endor Labs Adds AI Tool to Generate Fixes for Open Source Vulnerabilities

Endor Labs this week added an artificial intelligence (AI) tool to its portfolio that evaluates every reachable open source vulnerability against a code context graph to generate fixes that typically require only 10 lines of code…

Oct 30, 20263 min

All open source security Articles

Showing 1–23 of 23

Oct27

Gheist Hackers Abuse GitHub Tokens to Steal Repository Secrets

The evolving Gheist campaign uses stolen GitHub tokens and malicious Actions workflows to extract repository secrets and cloud credentials. While GitHub protections have blocked ob…

3 min

Oct21

Blogs

GitHub Puts a Firewall Between npm and Your CI Runners

GitHub’s new package firewall puts enterprise security policies between npm registries and the developers, CI runners and AI coding agents consuming packages. With malware detectio…

3 min

Oct19

Blogs

From Static Scans to Runtime Awareness: The Next Phase of Software Supply Chain Security

A growing wave of software supply chain attacks, including Shai-Hulud, Axios and LiteLLM, is exposing weaknesses in conventional security tooling. Malicious open-source packages ca…

3 min

Oct06

Blogs

Security Teams Are Fixing Vulnerabilities Faster Than Ever. So Why Is Software Getting Riskier?

AI is speeding up dependency decisions, making point-of-selection security essential for reducing vulnerable components, downstream tickets and avoidable rework.

3 min

Aug31

Broadcom Launches Trusted Artifact Service for Spring Framework

Broadcom launches TrueSource Trusted Artifacts to provide hardened Spring dependencies, secure open source packages and automated vulnerability remediation.

3 min

Aug25

Blogs

Report Shines Spotlight on 91 Vulnerabilities Fixed in Latest Update to Spring Framework

Sonatype says 91 Spring vulnerabilities affecting more than 209,000 software components highlight how AI is accelerating vulnerability discovery and creating a new patching challen…

3 min

Jul31

CISA’s 2026 SBOM Guidance Adds Hash Requirements and AI Coverage

CISA’s updated 2026 SBOM minimum elements expand software transparency requirements to AI, SaaS and open source while adding hashes, licenses and stronger validation.

3 min

Jul27

Blogs

GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks

GitHub and PyPI are using time as a security control, delaying dependency updates and locking older releases against new file uploads.

3 min

Jul22

Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem

A developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma…

3 min

Jul13

Blogs

Why Developer Workstations Have Become a Critical Part of the Software Supply Chain

For years, software supply-chain security discussions focused on centralized infrastructure such as build servers, package registries, and CI/CD systems. Recent attacks suggest tha…

3 min

May11

Blogs

How Open Source Dependency and Repo Attacks Compromise DevOps Pipelines and How to Stay Safe

Modern applications rely on open source components for up to 90% of their code, creating a vast attack surface dominated by inhemalicious supply chain injections. High-profile inci…

3 min

Jan28

Contributed Content

Software Supply Chain Threats Are on the OWASP Top Ten—Yet Nothing Will Change Unless We Do

Software supply chain security is steadily moving to the forefront of cybersecurity conversations. In the past, it has been overshadowed by a focus on malware outbreaks, ransomware…

3 min

Oct23

Blogs

The Silent Technical Debt: Why Manual Remediation Is Costing You More Than You Think

Manual vulnerability remediation drains time, innovation, and security. Learn how intelligent remediation eliminates hidden technical debt and accelerates DevSecOps.

3 min

Oct14

Blogs

Establishing Visibility and Governance for Your Software Supply Chain

Asset visibility and cloud governance start with SBOMs, VEX, and provenance tracking. Learn how to secure your software supply chain.

3 min

Sep26

Blogs

How GitHub Plans to Secure npm After Recent Supply Chain Attacks

GitHub strengthens npm security after Shai-Hulud worm attack with mandatory 2FA, granular tokens, and trusted publishing to protect the open source supply chain.

3 min

May30

Lineaje Adds Module to Manage Open Source Software Security Lifecycle

This can help DevSecOps teams identify open source software projects that are not being well maintained.

3 min

May13

Blogs

Does More Money Improve Open Source Security?

It sounds simple: If you pay developers more money they’ll improve the quality and security of their code. The evidence isn’t so clear.

3 min

Dec08

Blogs

How Devs Can Improve Open Source Security in the Enterprise

Modern applications are dynamic. They’re distributed and they’re often born in the cloud. These applications can be developed on the fly, spun up and scaled quickly to meet evolvin…

3 min

Dec02

Blogs

Securing Open Source Components in a World of Mixed Committer Motivations

Our world runs on software that contains open source components. This places an increased burden on developers, as the primary consumers and deployers of those components, to use c…

3 min

Oct27

Blogs

Sigstore Code Signing Service Becomes Generally Available

A free digital signing service for software created by the Sigstore open source community has become generally available this week via the cloud. Announced at the SigstoreCon event…

3 min

Dec15

DevOps and Open Technologies

Log4j: Is There Such a Thing as ‘Too Much’ Open Source?

The Log4j vulnerability got me thinking: Is there such a thing as too much open source? Before anyone immediately fires off a flaming email, rage tweet or scathing blog post, hear…

3 min

Apr20

Blogs

Open Source Vulnerabilities Were Up 50% in 2019 — How Will It Impact Software Development in 2020?

Open source vulnerabilities have been on the rise in recent years, but 2019 was truly one for the record books with a spike of nearly 50% over the previous year. According to the r…

3 min