We have just launched Akrites at The Linux Foundation, a coordinated industry effort to harden the world’s most critical open source software in the era of AI-assisted vulnerability discovery. www.linuxfoundation.org/press/linux-...

Linux Foundation and Industry Leaders Launch Akrites to Defend Critical Open Source Software Against AI-Enabled Cyber Threats

Linux Foundation and Industry Leaders Launch Akrites to Defend Critical Open Source Software Against AI-Enabled Cyber Threats

linuxfoundation.org

Severity is not risk

CNBC Make It@cnbcmakeit.cnbc.com · 2mo ago

Add these 4 words to your vocabulary right now, experts say: They can make you more influential at work

mstdn.social/@msw/1167825...

when it comes to addressing newly discovered flaws in your software dependencies (some of which might be classified as "security vulnerabilities") ... pruning > patching That's it. That's the post.

Personally, I miss the days of Free and Open Source when folks debated if NDAs were compatible (at minimum, in spirit) with the conditions of the GPL. Now, I see the slight possibility of a world where folks rush to share fixes for vulnerabilities in a private club. And if that software is GPL?

For folks who are thinking about locally patching open-source software to fix what they think is a bug (_especially_ if they think it's a security vulnerability), I think that's a path to www.xkcd.com/424/

Security Holes

xkcd.com

Heads up maintainers of packages, this is a big deal: github.com/orgs/communi...

npm granular access token invalidation to prevent supply chain attacks · community · Discussion #196340

As initially announced on npm’s X channel, we have invalidated granular access tokens with write access that bypass two-factor authentication. This action was taken to help prevent supply chain att...

github.com

Y'all, AI models seem to be *really good* at triaging vulnerabilities that are discovered with AI tooling! Try this prompt: > read gitlab.gnome.org/GNOME/libxml... and tell me if CVE-2026-6732 applies to github.com/libarchive/l... [...] Conclusion Not affected.

Super curious what folks think about this 🧵. Especially @adamhjk.me

Kelsey Hightower@kelseyhightower.com · 3mo ago

This generation of AI tooling will not change the CI/CD process. People will continue setting up dominos of shell scripts and using triggers to knock them over.

Yesterday the QEMU team released 11.0.0, which features a new special purpose accelerator and machine model for AWS Nitro Enclaves. Check it out! www.qemu.org/docs/master/...

Fun fact: when you have more than 1,000 notices on GitHub, it says you have 1. It should be like tabs in Chrome on mobile devices, where past 100 it shows ":)"

"Dealing with the rate of change in software development" Asked 17 years, 6 months ago. If only I had a time machine to suggest to folks that they try to enjoy the "good 'ole days". stackoverflow.com/questions/10...

Dealing with the rate of change in software development

I am primarily a .NET developer, and in that sphere alone there are at any given time probably close to a dozen fascinating emerging technologies, some of them real game-changers, that I would love...

stackoverflow.com

The Linux Foundation Announces $12.5 Million in Grant Funding (via Alpha-Omega and OpenSSF) Anthropic, AmazonWebServices (AWS), GitHub, Google, GoogleDeepMind, Microsoft, OpenAI to Invest in Sustainable Security Solutions for #OpenSource openssf.org/press-releas...

Some folks in and around Free and Open Source Software (FOSS) are asking, "does AI change everything?" If you think that FOSS only exists because software is expensive to write, reuse is efficiency, and AI shifts the economics ("we rewrote Next.js in a week with AI!"), you may be worried. I'm not.

I added a sentence to the #curl hackerone submission page: "Please present your case briefly and to the point. Do not use an AI to help you blab hundreds of line that will exhaust us to death instead of making us understand your claim."

China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) aws.amazon.com/blogs/securi...

China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | Amazon Web Services

Within hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat g...

aws.amazon.com

Unpopular opinion: a vulnerability that was disclosed privately by researchers and had a coordinated response from vendors and service operators under an (albeit short) embargo is not a “0-day”.

A public service announcement regarding CVEs: one identified vulnerability gets one CVE. Each vendor doesn't get their own CVE that corresponds to their security bulletin. CVE-2025-66478 is REJECTED as duplicate of CVE-2025-55182 www.cve.org/CVERecord?id...

To celebrate #awsreinvent, @redmonk.com has been publishing New Builders conversations w @awscloud.bsky.social leaders every day this week & TODAY IS MY DAY 🎉🎉🎉!! Hear AWS's Ali Maaz & Jessie VanderVeen chat all things #AI & #DevTools w me redmonk.com/videos/insid... www.youtube.com/shorts/Ot0gy...

Not overselling #aideveloper and #devtools as magical at #aws with Ali Maaz & Jessie VanderVeen

YouTube video by RedMonk

youtube.com

Unpopular opinion: through an economics lens, the optimal number of CVEs in most software systems is almost never 0.

Culture eats AI adoption strategy for breakfast, lunch, and dinner.

"Our only modification part is that, if the Software (or any derivative works thereof) is used for any of your commercial products or services that have more than 100 million monthly active users, or more than $20M in monthly revenue, you shall prominently display 'Kimi K2' on the user interface"

AI News@ai-provider.bsky.social · 9mo ago

Moonshot AI released open-source thinking agent model Kimi K2 Thinking: moonshotai.github.io/Kimi-K2/thin...

#FerryLife #WAWX #Seattle #Sunrise

"As adoption has grown, so has our responsibility to ensure the project remains sustainable and continues to thrive. That’s why, with the release of Liquibase 5.0, we are updating the license for Liquibase Community." www.liquibase.com/blog/liquiba...

Strengthening Liquibase Community for the Future

Liquibase Community now uses the Functional Source License (FSL). Learn what this means for developers, contributors, and enterprises, and how it protects sustainability.

liquibase.com

PSA: attacks on public infrastructure like software package registries are on the rise. Here’s an active one targeting folks who have crates.io accounts.

crates.io: Rust Package Registry

crates.io

Andrew Gallant@burntsushi.net · 11mo ago

FYI, I got an obvious phishing attempt in my inbox from `security@rustfoundation.dev` that was masquerading as a security breach notification. It made it past gmail's spam filters. The link goes to the `github.rustfoundation.dev` domain.

It’s really hard for OSS projects too. Imagine a leaked GH access token from a project maintainer who is not responding, and who is not an employee because OSS isn’t a company. How do you the project get that token revoked? You can’t. You have to de-list the maintainer from your GH org.

From my POV, the most important message for everyone who is doing the hazardous work of developing software in public on platforms like GitHub: you have to pay *close attention* to GitHub token permission scoping. It’s not well known outside of security research circles how often GitHub tokens leak.

Corey Quinn@quinnypig.com · last yr.

It's kinda "good news / bad news." Good news: No one at AWS (human or AI) merged in a dodgy PR, because... Bad news: It was an exciting new exploited vulnerability in CodeBuild.

There's much to agree with in Dan's piece on defending the definition of Open Source. On details, I quibble. "Today, Valkey is maintained by a neutral foundation, ensuring no one company can take it away from open source." Linux Foundation doesn't maintain Valkey. thenewstack.io/open-source-...

Open Source Is Too Important To Dilute

The definition of "open source" is quietly eroding. When these lines blur, trust breaks — and open source doesn’t work without trust.

thenewstack.io

Thrilled for the launch of @kiro.dev today! We started with two main ideas that led to Kiro's spec-driven development features: 1) AI can help us build better products through rapid prototyping 2) Devs can declare their app's requirements to get better results from AI, close to production-grade code

It has officially begun. The CRA info request counter is no longer at zero.