Open Source Security

Shared code creates shared security needs. European product rules raise a more specific question: who must act? ...more

Banks often commission fixes for the same open-source libraries. OSERA is testing a shared way to fund and verify that work. ...more

Resource-constrained maintainers can now seek subsidised cyber access, but OpenAI has not published criteria showing how independent open-source projects will qualify. ...more

The incidents put familiar build-time assumptions under scrutiny for Drupal teams that rely on Composer and automated CI. ...more

The 8.9 login-screen flaw is remotely reachable without an authenticated account, yet its path to code execution still depends on social engineering and active victim interaction. ...more

Faster vulnerability discovery exposes a slower constraint: the human review needed to turn reports into secure releases. ...more

The launch puts a familiar open source security problem in sharper view: vulnerability reports move quickly, but maintainers still carry the burden of triage, trust, and disclosure. ...more

Composer 2.10 has been released with native malware filtering enabled by default for Packagist users, expanding the project's software supply-chain security capabilities. The update also introduces a unified dependency policy framework, new package-management controls, and workflow improvements aimed at helping developers manage software risk more effectively. ...more

The Drupal Association has received a grant from the Alpha-Omega Project to support security work across the Drupal ecosystem as AI-generated commits and AI-driven threats become more common. The funding will strengthen Drupal Security Team efforts focused on vulnerability management, ecosystem resilience, and modern open-source security challenges. ...more

A highly critical Drupal core security release affecting all supported branches of Drupal is scheduled for 20 May 2026 between 17:00 and 21:00 UTC, according to an advance notice published by the Drupal Security Team. The advisory also includes unusual mitigation support for unsupported Drupal 8, Drupal 9, Drupal 10.4, and Drupal 11.1 branches, reflecting the potential severity of the issue. Site owners and administrators have been urged to reserve emergency maintenance time to evaluate whether their configurations are affected and apply updates immediately where required, because exploit code could emerge shortly after public disclosure. ...more