Opensourcesecurity Domain Overview🔒 SSL Verified

Table of Contents

• ↓ VulnCheck's State of Exploitation Report with Patrick Garrity
• ↓ Blog - You don't have a supply chain, you have supply soup
• ↓ Securing critical infrastructure with Josh Corman
• ↓ Abandoned open source with Josh Marpet
• ↓ Red Hat's Project Lightwell with Mo Duffy
• ↓ Rust Foundation Maintainers Fund with Lori and Niko
• ↓ Top Alternatives to opensourcesecurity.io

6-Month Traffic Trend Estimate

Visual representation extracted from opensourcesecurity.io

Content Snippets from opensourcesecurity.io

"Josh chats with Patrick Garrity about the VulnCheck State of Exploitation 1H-2026 report. Patrick explains the current trends we are seeing around vulnerabilities right now. While the number of CVEs is way up, the number of actually exploited vulnerabilities isn’t growing year over year. This tells us there is a lot of FUD and hype. We also ask where are all the vulnerabilities that project Glasswing found. They should be going public by now, but we’re not seeing that play out in the data. ..."

"2026 has been a wild year. There are more vulnerabilities than anyone can count. We seem to keep talking about the number itself instead of things like how we got here or what we’re going to do about it, which is neat. The number of attacks against open source is basically an uncountable mess. Also very neat. And the cherry on top of this poop sundae is number of companies that have promised us they are going to “fix” open source, and when they use the word fix they really mean sell you a solution for a problem they mostly made up. Very cool, very cool. ..."

"Open Source Security welcomes Josh Corman to talk about the challenges around securing our critical infrastructure. Specifically the discussion centers around our water supplies. There are a lot of really wild things happening right now with attacks like Volt Typhoon and Salt Typhoon. Josh has an amazing ability to make these sort of discussions easy to understand without spreading FUD. Josh also has suggestions for actions that need to be taken to help deal with these problems. It’s not all technical solutions, there are non technical things we can do to help reduce the risk posed by our technical systems failing. ..."

"Josh welcomes Josh Marpet for a discussion about abandoned open source packages. Josh Marpet has a foundation called Value Chain Risk Institute that has a report discussion how to start measuring if an open source package might be abandoned. There’s a lot of data, but not a lot of groups using that data to help make informed decisions about using open source. VCRI is one of those places that’s starting to do this. ..."

Key Topics & Focus Areas for opensourcesecurity.io:

VulnCheck's State of Exploitation Report with Patrick Garrity

Blog - You don't have a supply chain, you have supply soup

Securing critical infrastructure with Josh Corman

Abandoned open source with Josh Marpet

Red Hat's Project Lightwell with Mo Duffy

Rust Foundation Maintainers Fund with Lori and Niko