Expand AI security guidance, cooperation, and research to help narrow the gap between AI-driven development and software security.

Salt Lake City, November 9, 2026 / PRNewswire / -- The Open Source Security Foundation ( Open Source Security Foundation , abbreviated as OpenSSF ) announced today that its membership has further expanded, welcoming Beautiful Majestic Dolphin , DevGuard , and UElement Technologies to join the foundation. OpenSSF is a cross-industry initiative under the Linux Foundation, focusing on enhancing the security of open-source software in a sustainable manner.

OpenSSF also indicates that multiple initiatives have been launched and expanded to help various organizations ensure software security in the AI era. This includes joining forces with multiple organizational security AI coordination groups (from Multi to Organization Secure AI Coordination, MOSAIC) to enhance AI security. A new guide on using AI to identify and fix vulnerabilities was released, as well as new research on the impact of AI on software security.

AI is redefining the software development lifecycle ( SDLC ). It affects both the speed at which code is produced and the speed at which vulnerabilities are discovered and reported – this is true for both attackers and defenders. As vulnerabilities become easier to detect, and reporting windows are shortened under regulations such as the European Union's Cyber Resilience Act ( CRA ), organizations need clear and practical guidance on how to use AI to ensure software security. OpenSSF indicates that it will continue to serve as a trusted and neutral hub in the fields of AI security education, collaboration, and open-source software security.

The Laura Guazzelli of OpenSSF / ML / LLM / Agentic Systems, a security architect, stated: "Security must keep up with this new software development lifecycle. This new SDLC has significantly reduced the time window between vulnerability discovery and automated attacks, exposing defense systems that are not yet prepared to deal with the threats and offensive actions posed by AI. That's why we focus on providing developers with practical resources, ranging from guidance on using AI to discover and fix vulnerabilities, to information on how to shape new data in software development with AI."

OpenSSF indicates that the newly joined members include Beautiful Majestic Dolphin, DevGuard, and UElement Technologies, who will join the foundation as regular members. These organizations will join a community composed of working groups, technical teams, and experts to jointly shape the future of OpenSSF and software security. The foundation states that the addition of these members enhances the long-term sustainability of open-source projects that are crucial to modern infrastructure.

Foundation's Achievements for the Fourth Quarter of 2026

• OpenSSF joins MOSAIC After joining MOSAIC, members of OpenSSF and MOSAIC can gather knowledge and resources to establish consistent AI security standards and guidelines. One of the main goals of this organization is to create a standardized mapping for participants, which includes consistency with NIST SP's 800-53 control items SC-42 and other initiatives, to continue building upon the existing framework, and to reach a general consensus on the definition of MOSAIC.
• "2026 AI Impact on Software and Network Security Status Report" A study supported by OpenSSF, ActiveState, LF AI & Data Foundation has found that there is a growing gap between the speed of software development driven by AI and an organization's ability to ensure the security of the code produced. 58% of the surveyed teams stated that the speed of code delivery exceeds the pace at which security reviews can keep up; 60% indicated that AI coding assistants have increased the number of external software packages in their code repositories. These data highlight the importance of credible and reliable guidance as AI deployment continues to grow.
• Secure AI Associate （SAIA） Authentication OpenSSF and Linux Foundation Education are launching the Secure AI Associate (SAIA) certification. This new certification will help learners acquire the skills to identify and fix security risks throughout the entire AI / ML lifecycle, covering all stages from training data to the production pipeline. The certification will be available in December 2026, and those interested can register to receive notifications when the exams are open.
• New Guide on Using AI to Discover and Fix Vulnerabilities The OpenSSF Best Practices Working Group and the AI / ML Working Groups have released "Utilizing AI to Discover and Fix Software Vulnerabilities: A Developer's Guide" ( Finding and Fixing Software Vulnerabilities Using AI : A Guide for Developers ). This is a free guide for developers and security researchers, explaining how to use AI to identify and fix issues before attackers can exploit them. The guide is based on the principle of not relying on a single tool, covering the entire process from AI preparation and sandbox isolation, to verification, fixing, and preventing problems. It also emphasizes that patches generated by AI should not be trusted without automated testing and manual review. In the coming months, there are also plans to launch an online course ( LFD126 ).
• Case Study: GitHub Expands Malware Notification to Eight Ecosystems A new case study shows that GitHub has integrated the malware package data from OpenSSF into its Advisory Database, expanding the malware alerts for Dependabot from npm to eight software package ecosystems, including PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. This community-driven repository now contains over 238,000 malware package reports, demonstrating how sharing and open data can help defenders keep up with the rapidly evolving supply chain attacks.
• Zarf 1.0 marks an important milestone for OpenSSF. This version helps teams package and deploy software in an environment isolated from the internet. Version 1.0 has strengthened the software package signing and verification process, improved configuration management, and laid the foundation for long-term compatibility and community-driven development.

Supportive quotations

ActiveState The Chief Executive Officer Abby Kearns said: "Scanning will tell you where the problem lies. Knowing where your software comes from will tell you whether it is trustworthy from the start." ActiveState Building open-source software from verified source code makes security the default option, and joining OpenSSF is the natural next step for everyone who builds based on open-source to achieve this.

Beautiful Majestic Dolphin CEO Shane Morris said: "We believe that you should be able to determine why things happen. Who, what, when, where, how? These questions are relatively easy to understand, but 'why' is one of the most difficult aspects of cybersecurity. That's why we have made GoRapide open source under a MIT license. We know why we build products for our customers, but ultimately, we cannot know all the reasons behind everyone's question 'Why?' For us, joining the open-source security foundation makes sense because open source is an indispensable part of our company's mission."

DevGuard – L3montree GmbH, Chief Technology Officer, Tim Bastin stated: "We build DevGuard to make secure software development the default, not the exception. We are already using OpenSSF in our projects and data to help users protect their entire software development lifecycle, so joining OpenSSF is a natural step for us. We are proud to be part of the community that shapes the future of open-source security and look forward to giving back."

UElement Technologies, Co-Founder and CEO, stated: "Open source is the common foundation upon which the global digital economy is built, and India has now become one of its largest builders. Maintaining the security of this foundation is not the responsibility of any one company or country; it is the responsibility of all of us." UElement joined OpenSSF to help make it trustworthy today and capable of quantum security in the future, so that the systems people rely on—from banks to public infrastructure—can be built in an open manner and gain trust anywhere.

Events and Gatherings

OpenSSF indicates that its members are currently participating in Open Source SecurityCon North America in Salt Lake City this week, and are also attending KubeCon + CloudNativeCon North America offline from November 9th to 12th. Those interested in participating in the OpenSSF event in 2027 can pay attention to Open Source SecurityCon Europe which is scheduled to take place on March 15th, 2027.

More resources

• View the complete list of members for OpenSSF.
• Participate in one or more ongoing OpenSSF workgroups and projects.
• Subscribe to OpenSSF newsletter to receive updates on upcoming events, resources, and community news.

About OpenSSF

The Open Source Security Foundation (OpenSSF) is a cross-industry organization under the Linux Foundation, bringing together the most important open source security initiatives in the industry, as well as individuals and enterprises that support these initiatives. OpenSSF is committed to collaboration and works with upstream parties and existing communities to promote the development of open source security. For more information, please visit openssf.org.

About the Linux Foundation

Linux The foundation is a globally leading platform for open-source software, hardware, standards, and data collaboration. Linux The projects under the foundation include Linux, Kubernetes, Model Context Protocol (MCP), OpenChain, OpenSearch, OpenSSF, OpenStack, PyTorch, Ray, RISC-V, SPDX, and Zephyr. These projects provide a foundation for global infrastructure. Linux The foundation focuses on leveraging best practices and meeting the needs of contributors, users, and solution providers to create a sustainable open collaboration model. For more information, please visit linuxfoundation.org.

The Linux Foundation has registered and is using the relevant trademarks. For a list of trademarks of the Linux Foundation, please refer to their trademark usage page: www.linuxfoundation.org / trademark-usage. Linux is a registered trademark of Linus Torvalds.

Media Contact

Grace Lucier