Recently a security hole in a certain open source Java library resulted in a worldwide emergency kerfuffle as, say, 40% of the possibly hund...
Announcing the first Java library to run WebAssembly: Wasmer JNI
We are jazzed to announce that Wasmer has now landed in Java
How We Exploited CodeRabbit: From a Simple PR to RCE and Write Access on 1M Repositories - Kudelski Security Research Center
Aug 19, 2025 - Nils Amiet -
Hacker, Hack Thyself
We’ve read so many sad stories about communities that were fatally compromised or destroyed due to security exploits. We took that lesson to heart when we founded the Discourse project; we endeavor to build open source software that is secure and safe for communities by default, even if there
NSF investing in secure open-source ecosystems
Open-source software is ubiquitous, supporting artificial intelligence, data science, cloud computing, telecommunications and scientific research tools. Despite these benefits, the number of open-source developers is relatively small, and many projects lack sufficient resources, slowing the pace of innovation and making maintenance difficult. In addition, weaknesses in open-source software, such as security flaws, supply chain risks or insider threats, can spread across many connected systems. In extreme cases, these weaknesses could lead to large-scale failures that affect national or global systems.
Robin Berjon (@robin.berjon.com)
Again, we can try to be generous. But this fits a pattern. When people found issues in their open source code, instead of fixing them they went closed source. When they had an XSS vulnerability right at launch it took over a day for them to acknowledge and close it.
The day open source died: a story about Minecraft, Bukkit, and the GPL
Once upon a time, I volunteered in the Minecraft open source community with Bukkit and Spigot. This is a story about FOSS and young folks.
Google’s iron grip on Android: Controlling open source by any means necessary
From the archives: Android is open—except for all the good parts.
"Open source" is not broken
FOSS is not broken and the log4j2 fiasco is not FOSS' fault. The system is broken.
Critical Security Vulnerability in React Server Components – React
The library for web and native user interfaces
Deploying Jupyter Notebooks at scale on XSEDE resources for Science Gateways and workshops
We present a survey of credential management approaches for science gateways to integrate with the X.509 security infrastructure used by XSEDE.
Just a rumour of a bug is enough to find a security exploit these days
Thinking through how the conventional OSS security embargoes no longer buy us time, and what open source maintainers might do instead to respond
