Open Source Security
In-depth guides and analysis on open source security from the Safeguard engineering team.
100 articles
Python 3.10 End of Life: What Stopped on 1 October 2026 and How Fast Your Dependencies Will Leave
Python 3.10 reached end of life on 1 October 2026. Its final release, 3.10.22, shipped that day with fixes for eight CVEs, and the CPython team will not fix anything in 3.10 again. The interpreter keeps running.
How to Verify PyPI Attestations (PEP 740), and Which Top Packages Have Them
PyPI has accepted signed attestations since November 2024, but pip doesn't check them. How to verify one, how to catch a change of publisher in CI, and which of the top 1,000 packages attest today.
Credit the Tool: AI-Found Vulnerabilities Are Hiding in Free Text
CVE and OSV records already have a 'tool' credit type. Of 2,544 CVE records added on 13 and 14 October 2026, two used it. Why AI-found vulnerabilities should credit the tool, and why defenders should care.
curl 8.23.0 Fixes 24 CVEs: The One to Prioritise and How to Find Every libcurl You Ship
curl 8.23.0, released on 14 October 2026, fixes 24 CVEs in one go. That's more than curl published in all of 2024 and 2025 combined, and it takes the project's 2026 total to 69.
The Twenty-Minute Review to Run Before You Add a Dependency
Adding a dependency takes ten seconds and commits you to trusting a stranger's code on your build machines for as long as the project lives. Six checks, the signals that should stop you, and what this deliberately does not defend against.
How to manage open source risk in telecom OSS/BSS softwar...
A practical guide to managing telecom OSS/BSS open source risk—from SBOM inventory to dependency scanning—so carrier billing and network software stays secure.
npm Classic Tokens Are Gone. The keyv Worm Shows Why That Mattered.
Every npm classic token has been permanently revoked — unrecoverable, unrecreatable. Teams treated it as a chore. Then a worm propagated across 444 packages on exactly that kind of credential.
How to vet open source software before deployment in tele...
A seven-step process for vetting open source telecom core network components — SBOMs, signature verification, protocol fuzzing, and procurement sign-off — before they reach production.
Open source dependency risk in e-commerce platforms (Mage...
A practical guide to finding and fixing e-commerce platform dependency risk across Magento plugins, WooCommerce extensions, and Shopify apps before attackers do.
npm 12 Turned Install Scripts Off. The keyv Worm Used a preinstall Hook Anyway.
Install scripts have been off by default since npm 12 shipped in July 2026. Four weeks later a worm propagated through preinstall hooks. A default is not a control until you prove it is enforced.
RubyGems 2019 Multi-CVE Disclosure: Directory Traversal v...
CVE-2019-8320 let malicious RubyGems packages delete arbitrary directories via symlinked gem decompression. Here's the impact, timeline, and how to remediate it.
RubyGems Escape Sequence Injection via Gem Name Output (C...
A look at CVE-2019-8321, the RubyGems escape sequence injection flaw in gem CLI output: affected versions, severity, and how to remediate it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.