iiinova — where your digital self keeps evolving

Reposted by @ostifofficial.bsky.social

Cloud Native Computing Foundation (CNCF) @cncf.io · 03/08/2026

Cortex, the long-term storage layer for Prometheus and OpenTelemetry, just completed an independent security audit. Seven findings, all fixed. Read the results: www.cncf.io/blog/2026/08/03/cortex-… #Observability #CloudNative

001

ostifofficial.bsky.social @ostifofficial.bsky.social · 15/07/2026

Our Q2 2026 Community Spotlight is Antonela Conti! Antonela works for #X41D-Sec as a Project Manager and Admin. Read more about her work in open source in her own words: ostif.org/q2-2026-comm...

000

ostifofficial.bsky.social @ostifofficial.bsky.social · 13/07/2026

We are proud to share the results of our security audit of PyTorch ExecuTorch. Thanks to @trailofbits.bsky.social and Alpha-Omega, this project underwent a custom engagement of security review and testing. Read more on our blog- ostif.org/pytorch-exec... #OSTIF #PyTorch #TrailofBits #AlphaOmega

001

Reposted by @ostifofficial.bsky.social

Quarkslab @quarkslab.bsky.social · 06/07/2026

Cortex is a long-term, multi-tenant scalable open source storage for Prometheus and OpenTelemetry. Earlier this year we conducted a security audit sponsored by @ostifofficial.bsky.social Check our report here: blog.quarkslab.com/cortex-secur...

blog.quarkslab.com

Cortex Security Audit - Quarkslab's blog

At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of Cortex, evaluating the security of its multi-tenant design and the mechanisms protecting ...

011

ostifofficial.bsky.social @ostifofficial.bsky.social · 06/07/2026

We are proud to share the results of our security audit of #Cortex. Thanks to @quarkslab.bsky.social and the @cncf.io, Cortex received custom review and documentation for current and future security development. Read more about the work on our blog: ostif.org/cortex-audit... #OSTIF #Quarkslab #CNCF

010

ostifofficial.bsky.social @ostifofficial.bsky.social · 30/06/2026

We are proud to share the results of our security audit of @symfony.com Symfony-YAML. Thanks to @shielder.com and @sovereign.tech, this project received custom security review to further harden the project against risk. Read more on our blog: ostif.org/symfony-yaml... #symfony #OSTIF #shielder

000

ostifofficial.bsky.social @ostifofficial.bsky.social · 29/06/2026

#KEDA is an open source project for scaling containers in Kubernetes. With the help of #7ASecurity and @cncf.io, this project underwent a pentest and whitebox security review and audit. Read more on our blog: ostif.org/keda-audit-c...

000

ostifofficial.bsky.social @ostifofficial.bsky.social · 24/06/2026

We are proud to share the results of our security audit of Kubeflow. Thanks to ADA Logics and the @cncf.io, Kubeflow underwent a custom security engagement that audited 6 projects in the Kubeflow ecosystem. Read more on our blog: ostif.org/kubeflow-aud... #OSTIF #Kubeflow #CNCF #Adalogics

010

Reposted by @ostifofficial.bsky.social

Quarkslab @quarkslab.bsky.social · 09/06/2026

BOLT is a static analysis tool, part of the LLVM compiler infrastructure, used to verify compiler security hardening options have been applied on a binary. Thanks to @ostifofficial.bsky.social we've worked since November 2025 to improve it. Check our progress here: blog.quarkslab.com/extending-ll...

blog.quarkslab.com

Extending LLVM's BOLT-based Binary Analyser to Validate Stack Variable Initialisation - Quarkslab's blog

The Open Source Technology Improvement Fund (OSTIF) commissioned Quarkslab to extend the BOLT-based static binary analyser in LLVM to support additional compiler flags for security hardening. This wor...

041

ostifofficial.bsky.social @ostifofficial.bsky.social · 09/06/2026

Releasing today is OSTIF's work on LLVM's BOLT binary scanner. Completed thanks to @quarkslab.bsky.social and @sovereign.tech, the BOLT scanner received custom work to extend its coverage further. Read about the work and its implications at our blog: ostif.org/bolt-securit... #OSTIF #llvm #BOLT

010

Reposted by @ostifofficial.bsky.social

The Scala Programming Language @scala-lang.org · 01/06/2026

🎺 First phase of the Scala security audit is complete. ✅ No critical or major issues found ✅ All reported findings fixed ✅ Improvements shipped in Scala 3.3 LTS and upcoming 3.8 Huge thanks to @ostifofficial.bsky.social, @quarkslab.bsky.social & @sovereign.tech 💝 scala-lang.org/blog/2026/06...

scala-lang.org

Scala Codebase Security Audit Complete

The first part of the security audit funded by the Sovereign Tech Fund is done, no critical issues were found.

061

ostifofficial.bsky.social @ostifofficial.bsky.social · 01/06/2026

The Open Source Technology Improvement Fund is proud to share the results of our security audit of Scala, executed by a team of 3 auditors from Quarkslab. We want to thank our own Derek Zimmer of OSTIF for advocating for this audit for a long time! #OSTIF #Quarkslab #SovereignTechAgency #Scala

100

ostifofficial.bsky.social @ostifofficial.bsky.social · 26/05/2026

A lack of input sanitization on host header paths in Starlette leads to bypassing auth with a single character across a huge swath of Python LLM infrastructure. Update to Starlette 1.0.1 as soon as possible and read more about this vulnerability on badhost.org

badhost.org

BadHost - CVE-2026-48710 Starlette Host-Header Auth Bypass

Scan your Starlette or FastAPI server for CVE-2026-48710 (BadHost): a critical auth bypass via Host header injection affecting MCP servers, LLM proxies, AI agent frameworks, and thousands of Python AS...

010

ostifofficial.bsky.social @ostifofficial.bsky.social · 26/05/2026

During a security audit of vLLM managed by OSTIF.org, a bug was discovered through manual analysis by a senior security expert at X41 D-Sec. #OSTIF #BadHost #vLLM #X41DSec

100

Reposted by @ostifofficial.bsky.social

Brian Benz @bbenz.bsky.social · 12/05/2026

Good milestone for Inspektor Gadget: its first independent security audit is complete. Thanks to @ostifofficial.bsky.social , @cncf.io , and @inspektor-gadget.io for the transparency around the process and fixes. techcommunity.microsoft.com/blog/Linuxan... #Kubernetes #eBPF #OpenSource #Security

techcommunity.microsoft.com

Inspektor Gadget Completes First Independent Security Audit

CNCF's Inspektor Gadget passes its first independent security audit by Shielder and OSTIF, with all findings patched in v0.50.1. See what they found.

042

Reposted by @ostifofficial.bsky.social

OpenSSF @openssf.org · 12/05/2026

The AI Cyber Challenge (AIxCC) results are in and the work continues through new #OpenSSF projects like OSS-CRS and FuzzingBrain. Read the blog by Helen Woeste (OSTIF): openssf.org/blog/2026/05...

011

ostifofficial.bsky.social @ostifofficial.bsky.social · 12/05/2026

Read about the work on our blog: ostif.org/hack-to-the-...

ostif.org

000

ostifofficial.bsky.social @ostifofficial.bsky.social · 12/05/2026

In 2023, DARPA announced a two-year long competition called the Artificial Intelligence Cyber Challenge (AIxCC), a massive undertaking by dozens of organizations with the goal to safeguard open source software used in critical infrastructure throughout America. #OSTIF #DARPA #OpenSSF #AI

100

ostifofficial.bsky.social @ostifofficial.bsky.social · 05/05/2026

Voila- the results of OSTIF's security audit of #Paramiko! Thanks to the contributions of @quarkslab.bsky.social and @openssf.org Alpha-Omega, this project received custom security work. Read about the Python implementation of the SSHv2 protocol at our blog: ostif.org/paramiko-aud...

000

ostifofficial.bsky.social @ostifofficial.bsky.social · 30/04/2026

We're proud to share the results of our audit of #LibVLC, performed by @trailofbits.bsky.social with support from @sovereign.tech! LibVLC received scoped security work, custom tools and fixes, and documentation for future development. Read more about it on our blog: ostif.org/libvlc-audit...

030

ostifofficial.bsky.social @ostifofficial.bsky.social · 30/04/2026

We're excited to announce the results of our audit of Inspektor Gadget! With the help of @shielder.com and the @cncf.io, this project received a security audit reviewing Inspektor Gadget’s core components. Read more about the work done on our blog: ostif.org/inspektor-ga...

000

Reposted by @ostifofficial.bsky.social

Shielder @shielder.com · 30/04/2026

Can a hostile container sneak past your eBPF tracing? Sometimes, yes. With @ostifofficial.bsky.social & @cncf.io we audited Inspektor Gadget - 3 vulns (fixed), 6 hardenings, 6 bypasses (io_uring, openat2, jumbo frames…). Work by ndaprela & @suidpit.sh👏 🔗 www.shielder.com/blog/2026/04...

shielder.com

Shielder - Inspektor Gadget Security Audit

Security audit of Inspektor Gadget, an eBPF-based observability framework for Linux and Kubernetes. Sponsored by the CNCF (Cloud Native Computing Foundation), facilitated by Open Source Technology Imp...

097

Reposted by @ostifofficial.bsky.social

Sovereign Tech Agency @sovereign.tech · 28/04/2026

NEWS 📣 The Sovereign Tech Agency is launching the Sovereign Tech Standards network today, a new program designed to bring open source maintainers directly into global standards development. www.sovereign.tech/news/join-so...

12418

ostifofficial.bsky.social @ostifofficial.bsky.social · 28/04/2026

Our security audit of PyPI projects Requests, CacheControl, and urllib3 was executed by @7asecurity.bsky.social with funding provided from @openssf.org Alpha-Omega. Read more about this engagement on our blog: ostif.org/requests-cac...

000

ostifofficial.bsky.social @ostifofficial.bsky.social · 08/04/2026

With the help of Ada Logics, 7ASecurity, and the Sovereign Tech Agency, this project received expert security review, testing, and custom documentation contributing to DEfO’s ongoing development and security.

010

ostifofficial.bsky.social @ostifofficial.bsky.social · 08/04/2026

The Open Source Technology Improvement Fund is proud to share the results of our security engagement on Developing ECH for OpenSSL (“DEfO”). ostif.org/defo-audit-c... #OSTIF #DEfO #AdaLogics #7ASecurity #SovereignTechAgency

ostif.org

DEfO Audit Complete! – OSTIF.org

110

Reposted by @ostifofficial.bsky.social

Shielder @shielder.com · 24/03/2026

#KubeCon EU starts today and guess what? Our very own @suidpit.sh will be on stage with a panel about the @kubernetes.io Security Audit we performed during 2025 with the support of @ostifofficial.bsky.social! 🗓️ March 25 - 16:45 CET 📍 Hall 8 | Room F

155

Reposted by @ostifofficial.bsky.social

The Linux Foundation @linuxfoundation.org · 17/03/2026

The Linux Foundation Announces $12.5 Million in Grant Funding (via Alpha-Omega and @openssf.org) Anthropic, AmazonWebServices, GitHub, Google, GoogleDeepMind, Microsoft, OpenAI to Invest in Sustainable Security Solutions for #OpenSource

bit.ly

Linux Foundation Announces $12.5 Million in Grant Funding from Leading Organizations to Advance Open Source Security

Linux Foundation announces launch of the React Foundation

3224

ostifofficial.bsky.social @ostifofficial.bsky.social · 17/03/2026

We are proud to announce our top 3 bugs of the year on our blog: ostif.org/bug-of-the-y... #OSTIF #BOTY #7ASecurity

021

ostifofficial.bsky.social @ostifofficial.bsky.social · 10/03/2026

Miss our last OSTIF meetup? You can catch the recording here of Robin David, Software Security Researcher and Research Lead at Quarkslab, presenting "Bitcoin Core Audit: From Static Review to Fuzzing — Inside Bitcoin’s Testing Infrastructure". www.youtube.com/watch?v=J1Y1... #OSTIF #bitcoin

youtube.com

Meetup 010: Bitcoin Core Audit: From Static Review to Fuzzing w/ Robin David

YouTube video by Open Source Technology Improvement Fund (OSTIF)

000

Reposted by @ostifofficial.bsky.social

Internet Systems Consortium (ISC) @isc.org · 04/03/2026

ISC is pleased to announce the results of code audits for our Kea DHCP and Stork graphical management software projects! Thank you to @ostifofficial.bsky.social and the ICANN Grant Program for their support and assistance. Read more about the audits at www.isc.org/blogs/2026-t...

isc.org

Kea and Stork Projects Audited

In mid-2025 ISC contracted with OSTIF to identify an external organization to audit our Kea and Stork code for security issues.

011

ostifofficial.bsky.social @ostifofficial.bsky.social · 03/03/2026

OSTIF is proud to share the results of our security audit of Stork, an open source project developed by the Internet Systems Consortium (ISC) that acts as an administrative interface for monitoring, maintaining, and surveilling Kea servers. ostif.org/stork-audit-... #OSTIF #Stork #7ASecurity

020

ostifofficial.bsky.social @ostifofficial.bsky.social · 27/02/2026

While there is a lot to address, an important point of this story sticks out to us at OSTIF- that it was best practices, the secondary review of code before a push, that caught this before disaster struck.

000

ostifofficial.bsky.social @ostifofficial.bsky.social · 27/02/2026

We, like everyone else, couldn't look away from the Veritasium video on the XZ vulnerability. Watch the video here www.youtube.com/watch?v=aoag... to learn more details about this incredible story of open source security and community. #OSTIF #Veritasium #XZ

youtube.com

The Internet Was Weeks Away From Disaster and No One Knew

YouTube video by Veritasium

110

ostifofficial.bsky.social @ostifofficial.bsky.social · 26/02/2026

For the past 4 years, OSTIF has run a Managed Audit Program for the CNCF. We’ve audited 33 projects in that time, working with maintainers all over the world to reinforce the security health of cloud native open source for billions of end users. Read the full report here: ostif.org/cncfmanagedp...

000

ostifofficial.bsky.social @ostifofficial.bsky.social · 26/02/2026

Miss yesterday's amazing audit meetup "High Assurance Cryptography and the Ethics of Disclosure" w/ @nadim.computer ? Catch the video here www.youtube.com/watch?v=TdOX... Make sure you're subscribed for notifications of any new meetups! luma.com/ostif-meetups #OSTIF #meetup #audit

youtube.com

Meetup 009: High Assurance Cryptography and the Ethics of Disclosure w/ Nadim Kobeissi

YouTube video by Open Source Technology Improvement Fund (OSTIF)

010

ostifofficial.bsky.social @ostifofficial.bsky.social · 26/02/2026

Join us next Wednesday for an OSTIF meetup with Robin David, Software Security Researcher and Research Lead at Quarkslab, presenting "Bitcoin Core Audit: From Static Review to Fuzzing — Inside Bitcoin’s Testing Infrastructure". luma.com/gjnorzq0 #OSTIF #OpenSource #bitcoin

luma.com

Bitcoin Core Audit: From Static Review to Fuzzing — Inside Bitcoin’s Testing Infrastructure w/ Robin David · Luma

Description This talk explores the internals of the Bitcoin protocol and its reference implementation, Bitcoin Core, whose first version was written by Satoshi…

010

Reposted by @ostifofficial.bsky.social

Sovereign Tech Agency @sovereign.tech · 25/02/2026

Reminder: The Sovereign Tech Agency is gathering feedback from open source maintainers and contributors working with technology standards to inform the Agency's future work and new initiatives. ➡️ survey.sovereigntechfund.de/999999?lang=...

survey.sovereigntechfund.de

Create surveys in seconds with LimeSurvey. Easy to use, secure, and trusted by professionals worldwide. Get started free and unlock fresh insights today!

112

ostifofficial.bsky.social @ostifofficial.bsky.social · 23/02/2026

Our work with @sovereign.tech over the past two years resulted in 9 published audits with 6 more underway. OSTIF doesn't take lightly the responsibility we feel to help make a more resilient and secure open source ecosystem. Read more in our 2 year report: ostif.org/sovereigntec...

ostif.org

Sovereign Tech Agency and OSTIF Security Audit Report – OSTIF.org

030

ostifofficial.bsky.social @ostifofficial.bsky.social · 18/02/2026

RSVP fornext week's OSTIF meetup with Nadim Kobeissi, Senior Applied Cryptography Auditor at Cure53 presenting "High Assurance Cryptography and the Ethics of Disclosure". RSVPing adds the event to your calendar and lets us know you're coming! luma.com/xc4yuezb #OSTIF #OpenSource #disclosure

luma.com

High Assurance Cryptography and the Ethics of Disclosure w/ Nadim Kobeissi · Luma

Description Formally verified cryptographic libraries are increasingly deployed in critical systems, marketed as providing the highest level of assurance…

010

ostifofficial.bsky.social @ostifofficial.bsky.social · 17/02/2026

Zlib is an open source lossless data-compression library for use on virtually any computer hardware and operating system. Read about the audit process and results here 👉 ostif.org/zlib-audit-c...

ostif.org

zlib Audit Complete! – OSTIF.org

000

ostifofficial.bsky.social @ostifofficial.bsky.social · 17/02/2026

The Open Source Technology Improvement Fund is proud to share the results of our security audit of zlib. Thanks to the efforts of 7ASecurity and the Sovereign Tech Fund, this project underwent a holistic security review. See 🧵 below 👇 #OSTIF #7ASecurity #audit #zlib

100

ostifofficial.bsky.social @ostifofficial.bsky.social · 12/02/2026

We look forward to the great conversations that happen when you can get passionate folks together to talk open source security! Make sure to RSVP to add the event to your calendar and let us know you're coming: luma.com/xc4yuezb

luma.com

High Assurance Cryptography and the Ethics of Disclosure w/ Nadim Kobeissi · Luma

Description Formally verified cryptographic libraries are increasingly deployed in critical systems, marketed as providing the highest level of assurance…

000

ostifofficial.bsky.social @ostifofficial.bsky.social · 12/02/2026

Join us in 2 weeks on Wednesday, February 25th, for an OSTIF meetup with Nadim Kobeissi, Senior Applied Cryptography Auditor at Cure53 presenting "High Assurance Cryptography and the Ethics of Disclosure". #OSTIF #OpenSource #disclosure

110

ostifofficial.bsky.social @ostifofficial.bsky.social · 10/02/2026

This month's Community Spotlight shines on Peter Hunt, Principal Software Engineer at Red Hat who has contributed to both of OSTIF's audits of CRI-O (cri-o.io). Come check out our interview! ostif.org/feb-2026-com... #OSTIF #Spotlight #RedHat

000