Signal
6 articles covering "software-supply-chain"
A new paper testing seven defenses against AI-hallucinated software packages finds only RAG and Self-Refine hold up under adversarial prompting; Ruby stays the most vulnerable language.
The Linux Foundation and roughly 20 companies including AWS, Anthropic, Google, IBM and major banks launched Akrites, a coordinated incident-response alliance for open source software, after finding fewer than 5% of recently surfaced vulnerabilities have been patched.
IBM and Red Hat launched commercial Lightwell offerings on July 8, building on their $5 billion pledge to secure open source software supply chains.
OpenMandriva says former contributor Davide Beatrici deleted years of GitHub repository work and published a package that obsoleted GNOME and Cosmic packages in its Cooker branch after a community dispute.
Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI fund a Linux Foundation initiative to help overwhelmed open source maintainers triage AI-generated vulnerability reports.
An audit of the world's largest open source package registries finds they spend 12 percent of their budgets fighting malware and just 2 percent on new features, with no path to sustainable security funding.