Prague – – October 06, 2026 -- The Open Source Security Foundation (OpenSSF) added four new General Members and published a wave of Cyber Resilience Act (CRA) compliance resources, including a case study showing Ericsson Software Technology contributed more than 1,400 upstream dependency fixes to meet the regulation's requirements.
Ericsson eliminates private forks with 1,400 upstream contributions
Ericsson Software Technology removed internal code forks and submitted over 1,400 dependency updates and security fixes directly upstream, using OpenSSF guidance to satisfy CRA obligations. OpenSSF cited the case as enterprise-scale proof that fixing vulnerabilities upstream, rather than in isolated forks, strengthens the broader software supply chain.
Mandatory CRA incident reporting took effect last month
The EU's mandatory vulnerability and incident reporting provisions under the CRA became binding in September 2026, intensifying compliance pressure on companies selling software into the EU. OpenSSF released a CRA Readiness practitioner's guide and a CRA Readiness User Journey to convert the regulation into actionable steps for maintainers and vendors.
A-Team Systems, Emphere, DACHS IT, and JetBrains join as General Members
The four companies joined OpenSSF's community of working groups and technical groups shaping open source security standards. DACHS IT GMBH founder and CEO Alexander Schaber said the firm is expanding its Linux Foundation and CNCF work to help protect the security foundation that cloud-native ecosystems depend on. JetBrains' Katherine Druckman said the company is joining to help shape secure software development as AI reshapes how code is built and verified.
OpenBao v2.6 ships with per-namespace sealing
The open source secrets management tool's latest release adds per-namespace sealing and a new workflow engine for cross-plugin communication. Separately, BOMHort, a Kubernetes-native SBOM visualization and governance tool, entered the OpenSSF Sandbox as software bills of materials shift from best practice to regulatory mandate under CRA, NIST SSDF, and Executive Order 14028.
Role-based User Journeys target developers, OSPO leaders, and executives
OpenSSF rolled out curated navigation paths tailored to security practitioners, developers, security engineers, OSPO leaders, marketers, and executives, aiming to route the right compliance and technical guidance to each audience segment.
OpenSSF members are gathering in Prague this week for OpenSSF Community Day Europe, with a workshop on operationalizing the Cyber Resilience Act scheduled for October 9. Additional events include AGNTCon + MCPCon North America in San Jose, California, October 22-23, and Open Source SecurityCon North America in Salt Lake City, Utah, on November 9.