# open source security (blogs) — RSS Amplifier Recent posts from the 7 feeds in the RSS Amplifier directory that cover open source security. Page: Feed: --- ## [Zero Trust In The Age Of AI Driven Cyber Threats (Why Cisos Must Redefine Enterprise Trust Boundaries In 2026)](https://www.cyberdefensemagazine.com/zero-trust-in-the-age-of-ai-driven-cyber-threats-why-cisos-must-redefine-enterprise-trust-boundaries-in-2026/) _2026-08-21 · News team · Cyber Defense Magazine_ Enterprise cybersecurity is undergoing a structural shift driven by two converging forces: the collapse of traditional network perimeters and the rapid weaponization of artificial intelligence by threat actors. Industry research... The post Zero Trust In The Age Of AI Driven Cyber Threats (Why Cisos Must Redefine Enterprise Trust Boundaries In 2026) appeared first on Cyber Defense Magazine . ## [The New Russian Playbook: Bypassing MFA Without Cracking Passwords](https://www.cyberdefensemagazine.com/the-new-russian-playbook-bypassing-mfa-without-cracking-passwords/) _2026-08-21 · Stevin · Cyber Defense Magazine_ OAuth Exploitation Russian threat actors are shifting away from plain old password theft and moving toward legitimate platform features like OAuth permissions. Groups like UNC6293 and UNC7005 take their time... The post The New Russian Playbook: Bypassing MFA Without Cracking Passwords appeared first on Cyber Defense Magazine . ## [Inside NIST SP 1353: The New Quick-Start Guide for AI-Powered CSF Analysis](https://www.cyberdefensemagazine.com/inside-nist-sp-1353-the-new-quick-start-guide-for-ai-powered-csf-analysis/) _2026-08-20 · Stevin · Cyber Defense Magazine_ NIST’s New Guide for AI and CSF 2.0 NIST recently released a new draft, SP 1353, that acts as a practical guide for using AI alongside the Cybersecurity Framework 2.0.... The post Inside NIST SP 1353: The New Quick-Start Guide for AI-Powered CSF Analysis appeared first on Cyber Defense Magazine . ## [The Expiry Illusion: Why Fresh Evidence Can Still Be Wrong](https://www.cyberdefensemagazine.com/the-expiry-illusion-why-fresh-evidence-can-still-be-wrong/) _2026-08-20 · News team · Cyber Defense Magazine_ In discussions about safety, assurance, and governance, evidence is often treated as a matter of age. A certificate issued ten years ago is viewed differently from one issued last month.... The post The Expiry Illusion: Why Fresh Evidence Can Still Be Wrong appeared first on Cyber Defense Magazine . ## [Federal Agencies Warn of Active Attacks on Siemens Industrial Controllers](https://www.cyberdefensemagazine.com/federal-agencies-warn-of-active-attacks-on-siemens-industrial-controllers/) _2026-08-20 · Stevin · Cyber Defense Magazine_ Evolving Threats to Industrial Systems The recent joint advisory issued by federal agencies highlights a concerning escalation in how threat actors target industrial control systems. By combining public internet scanning... The post Federal Agencies Warn of Active Attacks on Siemens Industrial Controllers appeared first on Cyber Defense Magazine . ## [Black Hat Rewind: Most Creative Booths Part 1](https://www.cyberdefensemagazine.com/black-hat-rewind-most-creative-booths-part-1/) _2026-08-19 · Stevin · Cyber Defense Magazine_ Exhibitor booths are a major part of the Black Hat experience, giving companies a chance to bring their technology to life and make a lasting impression. This year, some took... The post Black Hat Rewind: Most Creative Booths Part 1 appeared first on Cyber Defense Magazine . ## [Attackers Are Moving At Machine Speed. Federal Remediation Still Isn’t.](https://www.cyberdefensemagazine.com/attackers-are-moving-at-machine-speed-federal-remediation-still-isnt/) _2026-08-19 · News team · Cyber Defense Magazine_ As AI accelerates the scale, sophistication, and speed of cyberattacks, the window between vulnerability discovery and exploitation is narrowing. Recent reports found that AI-enabled adversaries increased attacks by 89% year-over-year in 2025, while the average eCrime breakout time... The post Attackers Are Moving At Machine Speed. Federal Remediation Still Isn’t. appeared first on Cyber Defense… ## [Dangerous Apple Bug Lets Images Execute Malicious Code](https://www.cyberdefensemagazine.com/dangerous-apple-bug-lets-images-execute-malicious-code/) _2026-08-19 · Stevin · Cyber Defense Magazine_ The Vulnerability Apple fixed a major security vulnerability in their image handling framework for both desktop and mobile devices on August 18, 2026. The vulnerability, which is tracked as CVE-2026-65346,... The post Dangerous Apple Bug Lets Images Execute Malicious Code appeared first on Cyber Defense Magazine . ## [What’s in the SOSS? Podcast #69 – S3E21 Watering the Community Garden: Navigating the EU CRA for Open Source with Roman Zhukov](https://openssf.org/podcast/2026/08/18/whats-in-the-soss-podcast-69-s3e21-watering-the-community-garden-navigating-the-eu-cra-for-open-source-with-roman-zhukov/) _2026-08-18 · Jeff Diecks · Open Source Security Foundation_ Summary The clock is ticking toward the European Union’s Cyber Resilience Act (CRA) deadlines, yet a staggering 66% of organizations remain completely unaware of what is coming. In this episode of What’s in the SOSS? host Sally sits down with Roman Zhukov, co-chair of the OpenSSF Global Cyber Policy Working Group and Security Communities Lead at Red Hat, to demystify this sweeping regulation.… ## [Inside A CISO’s Playbook: What Agentic Security Looks Like In Practice](https://www.cyberdefensemagazine.com/inside-a-cisos-playbook-what-agentic-security-looks-like-in-practice/) _2026-08-18 · News team · Cyber Defense Magazine_ Cyberhaven’s Office of the CISO is setting a higher standard for cybersecurity by embracing a new paradigm: autonomous, agent-driven security. Faced with an ever-widening gap between engineering velocity and security... The post Inside A CISO’s Playbook: What Agentic Security Looks Like In Practice appeared first on Cyber Defense Magazine . ## [Non-custodial Crypto Payments & Escrow (Sponsored)](https://crawlproof.com/a/Civvk56LFeUI) _2026-08-18 · **Sponsored**_ Accept multi-chain crypto with trustless escrow, instant confirmations, and no KYC ## [Webinar Announcement: How Fortune 500 Security Teams Are Governing AI Agents](https://www.cyberdefensemagazine.com/webinar-announcement-how-fortune-500-security-teams-are-governing-ai-agents/) _2026-08-18 · Nick · Cyber Defense Magazine_ Click here to access the webinar registration via CybersecurityWebinars.com As organizations across the Fortune 500 accelerate adoption of AI agents capable of invoking tools, accessing enterprise systems, and taking autonomous... The post Webinar Announcement: How Fortune 500 Security Teams Are Governing AI Agents appeared first on Cyber Defense Magazine . ## [Black Hat 2026: The Supply-Chain Trust Series](https://www.cyberdefensemagazine.com/black-hat-2026-the-supply-chain-trust-series/) _2026-08-17 · Gary Miliefsky · Cyber Defense Magazine_ Black Hat 2026 Series Introduction — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series. This is the series home. It collects seven vendor interviews, one... The post Black Hat 2026: The Supply-Chain Trust Series appeared first on Cyber Defense Magazine . ## [Microsoft at Black Hat 2026: When the Attacker Comes Through the Front Door You Trust](https://www.cyberdefensemagazine.com/microsoft-at-black-hat-2026-when-the-attacker-comes-through-the-front-door-you-trust/) _2026-08-17 · Stevin · Cyber Defense Magazine_ Black Hat 2026 Keynote Report — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with... The post Microsoft at Black Hat 2026: When the Attacker Comes Through the Front Door You Trust appeared first on Cyber Defense Magazine . ## [ReversingLabs: Deep Analysis of the Final Build, File by File](https://www.cyberdefensemagazine.com/reversinglabs-deep-analysis-of-the-final-build-file-by-file/) _2026-08-17 · Stevin · Cyber Defense Magazine_ Black Hat 2026 Vendor Profile — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with... The post ReversingLabs: Deep Analysis of the Final Build, File by File appeared first on Cyber Defense Magazine . ## [NetRise: Reading the Thing That Actually Runs — and Vetting Who Wrote It](https://www.cyberdefensemagazine.com/netrise-reading-the-thing-that-actually-runs-and-vetting-who-wrote-it/) _2026-08-17 · Stevin · Cyber Defense Magazine_ Black Hat 2026 Vendor Profile — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with... The post NetRise: Reading the Thing That Actually Runs — and Vetting Who Wrote It appeared first on Cyber Defense Magazine . ## [Chainguard: Structurally Deleting a Whole Category of Attack](https://www.cyberdefensemagazine.com/chainguard-structurally-deleting-a-whole-category-of-attack/) _2026-08-17 · Stevin · Cyber Defense Magazine_ Black Hat 2026 Vendor Profile — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with... The post Chainguard: Structurally Deleting a Whole Category of Attack appeared first on Cyber Defense Magazine . ## [ActiveState: Rebuilding Open Source From Source, With a Cool-Down and a Clock](https://www.cyberdefensemagazine.com/activestate-rebuilding-open-source-from-source-with-a-cool-down-and-a-clock/) _2026-08-17 · Stevin · Cyber Defense Magazine_ Black Hat 2026 Vendor Profile — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with... The post ActiveState: Rebuilding Open Source From Source, With a Cool-Down and a Clock appeared first on Cyber Defense Magazine . ## [CRA Monthly Tech Talk: ORBIT Launchpad SIG Updates](https://openssf.org/policy/cra/2026/08/14/cra-monthly-tech-talk-orbit-launchpad-sig-updates/) _2026-08-14 · Jeff Diecks · Open Source Security Foundation_ ## [CRA Readiness: A Practitioner’s Guide to Compliance](https://openssf.org/blog/2026/08/11/cra-readiness-a-practitioners-guide-to-compliance/) _2026-08-11 · aliu · Open Source Security Foundation_ The EU Cyber Resilience Act (CRA) is no longer a future regulatory discussion; it is an immediate operational reality. With the September 2026 reporting deadline rapidly approaching and full compliance... ## [What’s in the SOSS? Podcast #68 – S3E20 CRA Readiness: Practical Strategies for Open Source Communities with Megan Knight](https://openssf.org/podcast/2026/08/11/whats-in-the-soss-podcast-68-s3e20-cra-readiness-practical-strategies-for-open-source-communities-with-megan-knight/) _2026-08-11 · Jeff Diecks · Open Source Security Foundation_ Join Megan Knight on the What's in the SOSS podcast as she breaks down the upcoming EU Cyber Resilience Act (CRA) and shares practical compliance strategies for open source maintainers and organizations. ## [Home Internet From Space (Sponsored)](https://crawlproof.com/a/hXw5LUCyVNyT) _2026-08-11 · **Sponsored**_ Residential satellite internet that brings connectivity to homes beyond conventional networks ## [Announcing OpenBao v2.6!](https://openssf.org/blog/2026/08/06/announcing-openbao-v2-6/) _2026-08-06 · OpenSSF · Open Source Security Foundation_ We are thrilled to announce the availability of OpenBao v2.6, adding per-namespace sealing and the new workflow engine for cross-plugin communication! ## [What’s in the SOSS? Podcast #67 – S3E19 Funding the Future: Community Collaboration and the Spirit of Open Source with Mila Zhou](https://openssf.org/podcast/2026/08/04/whats-in-the-soss-podcast-67-s3e19-funding-the-future-community-collaboration-and-the-spirit-of-open-source-with-mila-zhou/) _2026-08-04 · OpenSSF · Open Source Security Foundation_ Summary Join host Yesenia as she sits down with Mila Zhou, Open Source Program Manager at AWS, to explore the fascinating intersection of finance, strategy, and security in the open source ecosystem. Mila shares her unique journey from forensic auditing to spearheading AWS funding initiatives, breaking down how strategic financial backing transforms vulnerable “long tail” projects and empowers… ## [OpenSSF Newsletter – July 2026](https://openssf.org/newsletter/2026/07/30/openssf-newsletter-july-2026/) _2026-07-30 · OpenSSF · Open Source Security Foundation_ The July 2026 OpenSSF Newsletter highlights the upcoming Community Day Europe agenda and new compliance resources for the EU Cyber Resilience Act (CRA). It also introduces a dedicated Policy & Regulatory section, technical updates on dependency firewalls and AI artifact signing, and global community outreach efforts. ## [OpenSSF Community Day Europe 2026: Schedule Highlights & What to Expect](https://openssf.org/blog/2026/07/29/openssf-community-day-europe-2026-schedule-highlights-what-to-expect/) _2026-07-29 · aliu · Open Source Security Foundation_ OpenSSF Community Day Europe 2026 (October 6 in Prague), focuses on open source software security, regulatory compliance like the EU CRA, and AI supply chain risks. The one-day event features technical sessions on tools like VEX, Gemara, and Sigstore, offering direct collaboration with maintainers and security experts. ## [What Is a Dependency Firewall?](https://openssf.org/blog/2026/07/28/what-is-a-dependency-firewall/) _2026-07-28 · OpenSSF · Open Source Security Foundation_ A dependency firewall is a security checkpoint that evaluates open source packages before they are installed. It can protect developer workstations, build environments, CI/CD pipelines, and AI coding agents by blocking packages that appear malicious, suspicious, or inconsistent with organizational policy. ## [What’s in the SOSS? Podcast #66 – S3E18 Turning AI into the Ultimate Open Source Maintainer Power Tool with Michael Winser](https://openssf.org/podcast/2026/07/28/whats-in-the-soss-podcast-66-s3e18-turning-ai-into-the-ultimate-open-source-maintainer-power-tool-with-michael-winser/) _2026-07-28 · OpenSSF · Open Source Security Foundation_ In Episode #66 of What’s in the SOSS?, CRob welcomes back Michael Winser to celebrate Alpha-Omega surpassing $20 million in security grants. They discuss the economics of package registries and how Alpha-Omega is partnering with frontier AI providers to give maintainers defensive power tools. ## [Haveno Brought Back the Arbitrator Multisig and Attackers Just Hijacked It](https://www.sambent.com/haveno-brought-back-the-arbitrator-multisig-and-attackers-just-hijacked-it/) _2026-05-20 · Sam · Sam Bent_ At 03:43 UTC on May 20, woodser opened an eight-line patch in TradeProtocol.java, and by the time it went up the exploit was already running against live RetoSwap trades. ## [Autonomous Incident Response at Scale: How Energy-Based Models & TAME Replace LLM Guessing in Security](https://www.securesql.info/2026/05/01/infosecblueprints/) _2026-05-01 · w8mej · John Menerick | Security Engineer_ Why do Fortune 10 SOCs with 15 people outpace teams 10x their size? They've stopped using autoregressive LLMs for threat modeling, response, and recovery. Instead, they deploy Energy-Based Models governed by TAME principles—tested, auditable, measurable, explainable—to score threats across continents and outer space in 47 seconds. A technical breakdown of how SentinelMesh scales autonomous… ## [Ageless Linux: Civil Disobedience Through Operating System](https://www.sambent.com/ageless-linux-civil-disobedience-through-operating-system/) _2026-04-18 · Sam · Sam Bent_ Ageless Linux is a Debian-based operating system project that has declared "full, knowing, and intentional noncompliance" with California's Digital Age… ## [Part VIII & Conclusion — What it looks like when you hold the whole picture at once](https://www.securesql.info/2026/04/17/project-butterfly-of-damocles-conclusion/) _2026-04-17 · John W8MEJ Menerick · John Menerick | Security Engineer_ The fairy dust didn't disappear. It moved one abstraction layer higher with each generation. In 2014 it was 'everyone's looking at the code.' In 2026 it is 'our AI security deployment is safe and our governance frameworks are adequate.' The pattern is consistent. Only the substrate changes. ## [Stop CI/CD & Supply-Chain Attacks (Sponsored)](https://crawlproof.com/a/8vrUalwlwrOc) _2026-04-17 · **Sponsored**_ Per-PR: 17 CI/CD checks and package malware scans with inline Check Run findings. ## [Security Theater and Cap Tables: Deconstructing Cal.com’s Closed-Source Pivot](https://www.securesql.info/2026/04/16/caldotcomcasestudy/) _2026-04-16 · w8mej · John Menerick | Security Engineer_ Cal.com's 2026 transition to a closed-source model was publicly framed as a response to AI-driven security threats. This case study decomposes the move, exposing the financial and competitive moats driving the decision. ## [Part VII — What this means if you work in security, build OSS, run AI infrastructure, or set policy](https://www.securesql.info/2026/04/16/project-butterfly-of-damocles-part-8/) _2026-04-16 · John W8MEJ Menerick · John Menerick | Security Engineer_ The scarcity of finding capability is over. The crisis of fixing it is just beginning. Six takeaways for the six categories of people who need to act now — with the specific actions, the honest timelines, and the non-obvious implications each category tends to miss. ## [Part VI — Pros, cons, and tensions that don’t resolve](https://www.securesql.info/2026/04/15/project-butterfly-of-damocles-part-7/) _2026-04-15 · John W8MEJ Menerick · John Menerick | Security Engineer_ The honest accounting of Project Glasswing: what it genuinely changes, what it genuinely cannot change, and the six tensions at the center of the initiative that do not resolve — regardless of how good the intentions are. ## [Part V — What Project Glasswing actually changes for every open source actor on earth](https://www.securesql.info/2026/04/14/project-butterfly-of-damocles-part-6/) _2026-04-14 · John W8MEJ Menerick · John Menerick | Security Engineer_ Glasswing is the first time a frontier AI lab publicly declared that a capability in its own model is too dangerous to release. That is not a product launch. It is a policy precedent. And policy precedents are defined not by the first organization that sets them, but by whether subsequent organizations follow them. ## [Part IV — From ‘I have a toolbox’ to ‘the scanner has a backdoor’](https://www.securesql.info/2026/04/13/project-butterfly-of-damocles-part-5/) _2026-04-13 · John W8MEJ Menerick · John Menerick | Security Engineer_ The twelve-year arc from a DEF CON talk about vulnerability density to an AI model that escapes its sandbox to email a researcher eating lunch. The path was not straight. But in retrospect it was inevitable. ## [Part III — Silicon Valley’s new attack surface: the machine learning AGI dependency graph](https://www.securesql.info/2026/04/12/project-butterfly-of-damocles-part-4/) _2026-04-12 · John W8MEJ Menerick · John Menerick | Security Engineer_ In 2014 the scariest projects were Exim, Bind, and OpenSSL. In 2026 the load-bearing walls include PyTorch, TensorFlow, and LiteLLM — and they were designed by researchers who were not thinking about nation-state supply chain attacks. ## [Part III — When the security scanner became the weapon: Trivy → LiteLLM → Axios](https://www.securesql.info/2026/04/11/project-butterfly-of-damocles-part-3/) _2026-04-11 · John W8MEJ Menerick · John Menerick | Security Engineer_ Two distinct nation-state actors struck the developer toolchain within 12 days. The inspector became the attack surface. The most diligent organizations had the greatest exposure. This is not a metaphor. ## [Part II — Third-party libraries: the vulnerability layer nobody counted](https://www.securesql.info/2026/04/10/project-butterfly-of-damocles-part-2/) _2026-04-10 · John W8MEJ Menerick · John Menerick | Security Engineer_ When your Node.js service pulls 847 npm packages to serve a login form, you are not running one application. You are running 847 applications — most written by someone who needed to scratch an itch and moved on. ## [Part I — The original quantitative case: internet infrastructure is not OK](https://www.securesql.info/2026/04/09/project-butterfly-of-damocles-part-1/) _2026-04-09 · John W8MEJ Menerick · John Menerick | Security Engineer_ The Open Source Fairy Dust talk wasn't a rhetorical exercise. It was a data exercise across 2,000+ projects. Almost nothing critical lived in the safe quadrant — and the outliers told a story about institutional failure, not individual negligence. ## [From fairy dust to Glasswing: a decade of being right about the wrong thing](https://www.securesql.info/2026/04/08/project-butterfly-of-damocles-intro/) _2026-04-08 · John W8MEJ Menerick · John Menerick | Security Engineer_ In 2014 I stood at DEF CON and showed the internet's foundational software was held together by wishful thinking. In 2026, two nation-states proved the security tooling itself is now the attack surface. ## [Perplexity's Incognito Mode Is a Lie](https://www.sambent.com/perplexitys-incognito-mode-is-a-lie/) _2026-04-05 · Sam · Sam Bent_ A class action complaint alleges Perplexity shipped complete conversation transcripts to Meta and Google, even when Incognito Mode was switched on. ## [Proton Meet Isn't What They Told You It Was](https://www.sambent.com/proton-meet-isnt-what-they-told-you/) _2026-04-02 · Sam · Sam Bent_ Proton built Proton Meet to escape the CLOUD Act. They built it on CLOUD Act infrastructure. Their website promises "not even government agencies" can access your calls. The company routing them hands your call records to the government when asked. Proton hid them from their privacy policy. ## [Apple Obeyed Russia and Britain in the Same Week](https://www.sambent.com/apple-obeyed-russia-and-britain-in-the-same-week/) _2026-03-31 · Sam · Sam Bent_ This week Apple pulled VPN apps in Russia at Roskomnadzor's request and forced UK users to hand over government ID to keep using their phones normally. ## [axios Got Hijacked and Your Machine May Be Compromised](https://www.sambent.com/axios-got-hijacked-and-your-machine-may-be-compromised/) _2026-03-31 · Sam · Sam Bent_ A stolen npm token was all it took to poison axios, the package with 100 million weekly downloads, and drop a cross-platform RAT on every developer who ran npm install this morning. ## [Europol Busted a Man Who Was Scamming Pedophiles](https://www.sambent.com/europol-busted-a-man-who-was-scamming-pedophiles/) _2026-03-30 · Sam · Sam Bent_ A Chinese national collected €345,000 from 10,000 people trying to buy CSAM, delivered nothing, and is still free — while 440 of his customers are now criminal suspects. ## [Fedware: 13 Government Apps That Spy Harder Than the Apps They Ban](https://www.sambent.com/the-white-house-app-has-huawei-spyware-and-an-ice-tip-line/) _2026-03-28 · Sam · Sam Bent_ The White House app ships with a sanctioned Chinese tracking SDK, the FBI app serves ads, and FEMA wants 28 permissions to show you weather alerts. ## [Canonical's GRUB Saboteur Has a 10-Year Plan](https://www.sambent.com/canonicals-grub-saboteur-has-a-10-year-plan/) _2026-03-26 · Sam · Sam Bent_ Julian Klode has been systematically stripping features from GRUB since 2021, and he built the replacement a decade ago. ## [Why I2P Sites Load So Slowly](https://www.sambent.com/why-i2p-sites-load-so-slowly/) _2026-03-26 · Sam · Sam Bent_ Every I2P packet takes 12 hops just to complete a round trip, and the streaming library has to fake TCP on top of all that latency. ## [Tails 7.6 Hides Bridge Requests Behind CDN Traffic](https://www.sambent.com/tails-7-6-hides-bridge-requests-behind-cdn-traffic/) _2026-03-26 · Sam · Sam Bent_ Tails 7.6 uses domain fronting to hide Tor bridge requests from censors, replaces KeePassXC with GNOME Secrets for accessibility, and catches up on 18 months of Electrum releases. ## [Microsoft's "Fix" for Windows 11: Flowers After the Beating](https://www.sambent.com/microsofts-plan-to-fix-windows-11-is-gaslighting/) _2026-03-23 · Sam · Sam Bent_ Microsoft spent four years stuffing Windows 11 with ads, forced Copilot integrations, and bloatware, now they want applause for promising to remove it.