Loading story…
Open-source software forms the backbone of much of today's digital infrastructure, powering browsers, applications, and critical business systems. Security leaders are increasingly aware of the risks associated with integrating open-source components into their environments, as vulnerabilities can be present even in widely used and actively maintained projects. A recent study by James Cusick at Ritsumeikan University compared the security of open-source and proprietary software by scanning millions of lines of code. The analysis revealed that large open-source projects like Chromium, despite their robust contributor communities, still contained over 1,400 potential issues, though only a few were deemed critical or high severity. In contrast, smaller open-source projects such as Genann exhibited a much higher density of potential issues, with one problem for every 27 lines of code. Proprietary software, while not immune, generally fell between these extremes, with most issues rated as medium or low severity. These findings highlight the importance of static code scanning and rigorous review processes for all software, regardless of its origin. The integration of open-source components without thorough vetting can introduce significant supply chain risks, as vulnerabilities may remain undetected and exploitable. In response to these challenges, regulatory frameworks like the European Union's Cyber Resilience Act (CRA) have been developed to enhance software security and transparency. According to Greg Kroah-Hartman, a leading Linux kernel maintainer and member of the CRA working group, the Act has evolved to be more accommodating to open-source developers. The CRA now requires producers of products with digital elements to document, secure, and maintain their software supply chains, including the generation of Software Bills of Materials (SBOMs) and proactive vulnerability management. While initial drafts of the CRA raised concerns among open-source communities about potential legal liabilities, subsequent revisions have made the regulations more palatable and beneficial for open-source contributors. Organizations like the Linux Foundation and Mozilla are required to comply with these rules, but individual contributors are generally exempt unless they are acting as commercial entities. The CRA aims to foster greater transparency and accountability in software development, ultimately benefiting both open-source and proprietary ecosystems. Security leaders are encouraged to adopt comprehensive code scanning and supply chain management practices to mitigate the risks associated with open-source software. The evolving regulatory landscape underscores the need for organizations to stay informed and proactive in addressing software security challenges. By combining technical diligence with compliance efforts, businesses can better protect themselves against the hidden risks inherent in modern software supply chains. The ongoing dialogue between regulators, open-source communities, and industry stakeholders is shaping a more resilient and secure digital environment for all.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
By late September 2025, foundations and large open source projects were reported to be working with EU authorities on checklists and templates to help clarify Cyber Resilience Act compliance. Further clarification on commercial versus non-commercial obligations was expected over the following year.
In a September 2025 discussion of the EU Cyber Resilience Act, Linux stable kernel maintainer Greg Kroah-Hartman said the revised law mainly targets commercial producers of products with digital elements rather than unpaid individual open source contributors. He said non-commercial developers generally face minimal obligations, while manufacturers and funded legal entities bear the main compliance burden.
3 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcetheregister.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA released **"Open Source Software: Security Principles and Practices"**, a guide for federal agencies on securely using, evaluating, developing, and publishing open-source software across its full lifecycle. The guidance says open-source software is not inherently more or less risky than proprietary software, but agencies should tailor risk management to open-source development models by improving asset tracking, patching, vulnerability management, and software bill of materials (**SBOM**) practices. The document introduces the **C4 Framework** for assessing project trustworthiness and includes recommendations on secure development, contributing to upstream projects, and preserving government reuse rights in custom software contracts. CISA also highlights added scrutiny for so-called open-source or open-weight AI systems, warning that licensing and transparency gaps can make it harder for agencies to evaluate trustworthiness and security.
Aug 3, 2026
Recent high-profile incidents such as the SolarWinds, MOVEit, and Log4Shell breaches have underscored the critical vulnerabilities present in the software supply chain, prompting organizations to prioritize third-party risk management and supply chain security at the executive level. Security leaders now recognize that every external dependency, from open-source libraries to SaaS platforms, represents a potential attack vector, with 69% of organizations reportedly impacted by a supply chain security event in the past year. The MOVEit and SolarWinds attacks, in particular, demonstrated how a single compromised vendor can trigger widespread data breaches and operational disruptions across thousands of downstream organizations. In response to these threats, companies are increasingly adopting third-party risk management tools and modern application security practices to monitor and secure their extended digital ecosystems. Industry reports highlight a gap between awareness and implementation of foundational security controls, with many organizations failing to mandate essential protections despite acknowledging the risks. Regulatory bodies such as CISA have also identified supply chain attacks as one of the most persistent and damaging threats, emphasizing the need for proactive, holistic risk management strategies that extend beyond internal systems to encompass the entire vendor ecosystem.
Jul 12, 2026
Government and industry leaders are intensifying efforts to address software supply chain security, with a particular focus on the adoption of Software Bills of Materials (SBOMs) and the potential for holding software vendors liable for security failures. In the United States, the push for SBOMs has been driven by federal policy, but private sector adoption remains slow, even as the rapid evolution of AI-assisted coding introduces new complexities and risks. Experts are divided on whether AI will reduce or exacerbate vulnerabilities, but there is consensus that transparency in software components remains critical for managing security risks. In the United Kingdom, lawmakers are calling for significant regulatory changes, including introducing liability for software developers, incentivizing cyber resilience investments, and mandating incident reporting. These recommendations come in response to a series of high-profile cyber incidents, such as the attack on Jaguar Land Rover, which have underscored the economic and public risks posed by insecure software. The debate continues between industry groups, who warn that liability could stifle innovation, and security leaders, who argue that the current system leaves critical infrastructure and the broader economy exposed to escalating cyber threats.
Jul 12, 2026