software-supply-chain

The Linux Foundation and roughly 20 companies including AWS, Anthropic, Google, IBM and major banks launched Akrites, a coordinated incident-response alliance for open source software, after finding fewer than 5% of recently surfaced vulnerabilities have been patched.

IBM and Red Hat launched commercial Lightwell offerings on July 8, building on their $5 billion pledge to secure open source software supply chains.

OpenMandriva says former contributor Davide Beatrici deleted years of GitHub repository work and published a package that obsoleted GNOME and Cosmic packages in its Cooker branch after a community dispute.

Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI fund a Linux Foundation initiative to help overwhelmed open source maintainers triage AI-generated vulnerability reports.

An audit of the world's largest open source package registries finds they spend 12 percent of their budgets fighting malware and just 2 percent on new features, with no path to sustainable security funding.