YouTube video by OpenSourceMalware

For years, maintainers have asked security reporters for a fairly reasonable thing: reproduction steps. Not a vibe. Not a screenshot from a scanner. Not a majestic wall of speculative prose explaining...

A direct-action manifesto for maintainers keeping open source alive on company time.

This is Part 2 of our response to the Trivy supply-chain compromise. Part 1 covered how to consume GitHub Actions safely. This post covers the other side: how to publish safely, so your project doesn’...

On March 19, 2026, an attacker used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action, and replace all 7 tags in aquas...

Go library and CLI for working with git forges. Supports GitHub, GitLab, Gitea/Forgejo, and Bitbucket Cloud through a single interface. - git-pkgs/forge

YouTube video by Technology Connections

How a Broken Benchmark Quietly Broke America

I was writing this post today when the news dropped that Cursor has just raised a new round.   > We’re pleased to announce a new round of financing: our Series D of $2.3B at a $29.3B post-money valuat...

YouTube video by Oxide Computer Company

Project compromises have common root causes we can mitigate: phishing, control handoff, and unsafe GitHub Actions triggers.

The Register recently published a story titled Putin on the code: DoD reportedly relies on utility written by Russian dev. They should be ashamed of this story, and the company behind the ambulance ch...

Do you want to know more about

The Trump administration has set out to drastically reshape the relationship between the US and Europe. In response, Brussels is scrambling to adapt to this new reality,...

While open-source software risks are not going away, attack trends show third-party software presents the greatest risk to the enterprise.