The open source stories enterprise IT leaders actually read.
Volume 343, Issue 3 · 7 articles from 2 issues
At Open Source Summit Europe, sovereignty talk turned to migration targets, security rules and compliance metrics.
AI and digital sovereignty dominated Open Source Summit Europe, and the sovereignty sessions offered practical plans.
Keynotes covered geopolitics and open source, OSS supply-chain security, and OpenSSF's ORBIT effort to catalog open source components for Cyber Resilience Act compliance, including the CRA Baseline for Open Source Consumption.
CRA reporting duties for actively exploited vulnerabilities began last month, with the main requirements applying from December 2027.
The EU Open Source Observatory also presented its 2026 report, which covers national efforts beyond the EU.
Torvalds used Claude Code on a long-standing page-cache bottleneck; reviewers then found a race condition.
Linus Torvalds submitted a 10-patch series developed with Claude Code that delivered a 23-fold throughput gain in a synthetic benchmark by removing folio reference-count operations from a common buffered-read path.
He had run a broken version of his own fix for 18 months, and he cautioned that real-world gains would be much smaller.
Reviewers found a race condition and raised memory reclamation concerns, and Torvalds handed further work to kernel developer Kiryl Shutsemau.
The episode is a high-profile test of AI-assisted kernel development.
ArtCraft used AI and Rust to build open source near drop-in replacements for Photoshop, Illustrator, Premiere and more.
Jack Wallen tests PhotoCraft, part of ArtCraft's open source suite that developer Brandon Thomas built in Rust with AI-assisted reverse engineering as alternatives to Photoshop, Illustrator, Premiere, Lightroom, Acrobat, After Effects and InDesign, with apps that run on Linux, macOS and Windows.
Wallen found the alpha fast and stable, noting that it opened PSD files with layers intact and supports Actions, which makes it a likely replacement for GIMP.
Thomas claims full feature parity within a month.
The apps are free, AI features require a subscription, and CAD, Office and audio clones are planned.
A Linux Foundation survey finds maintainers estimate a quarter of incoming pull requests are AI slop, rising to 31% on big projects.
LF Research surveyed open source contributors and maintainers about generative AI, and maintainers estimate 25% of incoming pull requests are low-quality AI slop, rising to 31% on larger projects.
Respondents said AI cut code-writing time by 52% on average, though 21% took longer on highly complex tasks.
71% say AI lowered barriers to contributing, but 53% disagree that it improved community trust, and only 35% of projects have a formal policy allowing GenAI while 32% have none.
The foundation urges clear policies, contributor responsibility for testing and disclosure, and better tools for maintainers.
Bearer CLI is a free SAST scanner that ranks code flaws by the sensitive data they touch and can produce GDPR privacy reports.
Bearer CLI is a free static application security testing tool that scans source code and prioritizes findings by the sensitive data flowing through the affected code paths, so triage starts with flaws that could expose data.
Built-in rules cover the OWASP Top 10 and CWE Top 25.
It can also generate a privacy report identifying more than 120 data types and the components that handle them, including databases and third-party APIs, as evidence for privacy impact assessments and GDPR records.
It supports Go, Java, JavaScript, TypeScript, PHP, Python and Ruby under the Elastic License 2.0, which restricts offering it as a hosted service.
From October 26, curl will handle low and medium severity reports publicly on GitHub, keeping only high and critical issues private.
Facing an avalanche of vulnerability reports, many AI-assisted, curl maintainer Daniel Stenberg said low and medium severity issues should be filed in the project's public GitHub repository from October 26, with only high and critical reports handled privately.
He said over 90% of submissions in recent years were quickly judged below high severity.
The project already ended its bug bounty this year.
Stenberg described maintainers as strained and overloaded and called the change a survival step, arguing public handling lets more people help assess, fix and document reports.
DevGuard, an OWASP incubating project, centralizes scanning, SBOM/VEX handling and a dependency firewall in a free self-hosted platform.
DevGuard is a free, self-hostable OWASP Incubating Project that collects a project's security findings, ranks them by risk and tracks them.
Its CLI wraps open-source tools for secret scanning, static analysis, dependency checks, IaC, container and license scanning, or teams can upload CycloneDX SBOMs and SARIF results from Trivy, Grype or Semgrep.
Findings sync with GitHub, GitLab and Jira, and a dependency firewall proxies npm, Go and Python registries to block malicious packages.
It also manages reusable VEX rules, publishes live SBOM/VEX links and generates evidence for ISO 27001, the EU Cyber Resilience Act and SLSA.