#opensourcesecurity

6 days ago

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=diRrt9HJRZU

0 0 0 0

Top npm package backdoored to drop dirty RAT on dev machines Updated: Hijacked maintainer account let attackers slip cross-platform trojan into 100M-downloads-a-week Axios

6 days ago

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=diRrt9HJRZU

0 0 0 0

Manuel Bissey

@mbissey.bsky.social

1 week ago

A backdoored Axios npm package delivered a RAT - another reminder that even trusted libraries can turn into attack vectors. Verify before you trust. 📦⚠️ #OpenSourceSecurity #SupplyChainRisk

0 0 0 0

Bob Carver

@cybersecboardrm.bsky.social

1 week ago

AI Supply Chain Security: Why Trust Is Your Biggest Vulnerability
youtu.be/RrzJPOGjI4M #CyberSecurity #AISecurity #ArtificialIntelligence #MachineLearning #SupplyChainSecurity #AIThreats #Infosec #DataSecurity #OpenSourceSecurity #CloudSecurity #RiskManagement #AIGovernance

1 0 0 0

Always Further, Inc

@alwaysfurther.ai

2 weeks ago

MCP and Agent security with Luke Hinds Josh talks to Luke Hinds, CEO of Always Further, about MCP and agent security. We start out talking about Luke’s new tool, nono which is a sandboxing tool that has AI agents in mind as a use case. We ...

@josh.bressers.name put it well: MCP is moving faster than anyone can keep up with.
@lukehinds.bsky.social joined #OpenSourceSecurity to dig into why agent security is structurally hard and what kernel-level sandboxing nono.sh actually solves.
Episode: opensourcesecurity.io/2026/2026-03...

2 2 0 0

Caleb Faruki

@kleb.cyberplace.social.ap.brid.gy

2 weeks ago

Original post on cyberplace.social

Airlock v0.3.0: command modules are now opt-in.

Airlock already shipped hardened deny rules per tool and scoped each container via profiles. Now there's a third layer: no command loads unless the operator enables it.

SSH is worth calling out. It's remote code execution with real keys. If you […]

0 1 0 0

2 weeks ago

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=O5ewVqmClYo

0 0 0 0

2 weeks ago

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=O5ewVqmClYo

0 0 0 0

AI Daily Post

@aidailypost.com

3 weeks ago

Alpha‑Omega teams up with OpenSSF to boost open‑source security against AI‑driven attacks. New funding means faster vulnerability detection for maintainers. Curious how Google DeepMind fits in? Dive in! #OpenSourceSecurity #AIThreats #OpenSSF

🔗 aidailypost.com/news/alpha-o...

3 0 0 0

MCP and Agent security with Luke Hinds Josh talks to Luke Hinds, CEO of Always Further, about MCP and agent security. We start out talking about Luke’s new tool, nono which is a sandboxing tool that has AI agents in mind as a use case. We ...

3 weeks ago

I had a chat on #OpenSourceSecurity with @lukehinds.bsky.social about his project nono as well as MCP security

nono is a sandbox for containing all these tools which is an incredibly difficult problem to solve. The things we see skills and MCP doing are moving forward faster than anyone can keep up

5 1 0 1

3 weeks ago

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=0GtI0pEWpzI

0 0 0 0

3 weeks ago

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=0GtI0pEWpzI

0 0 0 0

BaseFortify.eu

@basefortify.bsky.social

4 weeks ago

📦 Installing a single package can introduce dozens of dependencies.

Attackers exploit this through typosquatting, malicious packages, and compromised maintainers.

ENISA’s advisory highlights why dependency visibility is becoming critical.

#CyberSecurity #SoftwareSupplyChain #OpenSourceSecurity

0 0 1 0

The State of OpenSSL for pyca/cryptography with Alex Gaynor and Paul Kehrer Josh talks to Paul Kehrer and Alex Gaynor, from the Python Cryptographic Authority. Alex and Paul recently published a statement discuss the challenges posed by modern OpenSSL. We discuss the statemen...

4 weeks ago

This week on #OpenSourceSecurity I had a chat with Paul Kehrer and Alex Gaynor about the statement they published discussing the challenges posed by modern OpenSSL for the python cryptography module

1 2 0 0

CIO.com

@cio.com

1 month ago

A man with glasses and a white patterned shirt is smiling with his hand near his chin. He has a bald head and light skin.

Marcin Wyszynski warns that open source isn’t the feel‑good story many think. It’s a survival strategy.
Read why teams betting on “free” tools need to rethink risk now:
spr.ly/63329h4jPX

#FoundryExpert #OpenSourceSecurity #SoftwareSupplyChain

0 0 0 0

Rust coreutils with Sylvestre Ledru Josh talks to Sylvestre Ledru about the Rust coreutils project. We’ve been using GNU coreutils for decades now, and the goal of Rust coreutils is to rewrite these utilities in Rust. The primary reason...

1 month ago

I had a chat on #OpenSourceSecurity with @sylvestreledru.bsky.social about his Rust coreutils work

Replacing coreutils with Rust is one of those things that I love as a way to improve security but also keep a project fresh in the modern age

I learned a ton from this disucssion

2 1 0 0

roxsross

@roxsross.bsky.social

1 month ago

⚠️ El desarrollo con IA lleva el riesgo del código abierto al límite

La IA acelera el desarrollo, pero multiplica los riesgos de seguridad

devops.com/ai-fueled-development-pu...

#OpenSourceSecurity #BlackDuckOSSRA #VulnerabilityManagement #RoxsRoss

1 0 0 0

1 month ago

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=FazSzP_Kty4

0 0 0 0

Eric Gallagher | SecuringTheBackbone.com

1 month ago

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=FazSzP_Kty4

0 0 0 0

@ericgallagher.bsky.social

1 month ago

Full breakdown in this week's Securing the Backbone. Link below. 👇

www.linkedin.com/pulse/securi...

#DevSecOps #SoftwareSupplyChain #OpenSourceSecurity #CyberSecurity

1 0 0 0

Goose and the Agentic AI Foundation with Brad Axen Josh chats with Brad Axen from Block about his creation Goose as well as the Agentic AI Foundation (AAIF). I am quite skeptical of many AI claims, but Brad has a very pragmatic view about where things...

1 month ago

This week on #OpenSourceSecurity I chat with Brad Axen about Goose and the Agentic AI Foundation

I'm often skeptical about AI claims, but I do approve the foundation model and seeing Goose donated to it

0 0 0 0

1 month ago

We're LIVE! Join the Anchore Open Source team now to discuss Syft, Grype, and the latest in #OpenSourceSecurity. Ask your questions! https://www.youtube.com/watch?v=-Unu5gZ8Cxc

0 0 0 0