Open Source Security

Josh talks to Keith Hoodlet about a research project he co-authored about the success rate of AI generated vulnerability patches. Keith has a very scientific approach to this paper and does a great job of breaking down all the data and outcomes. There isn't a lot of AI research that  takes this approach, this paper is a breath of fresh air. Keith has some pretty scary details during the discussion, but he manages to give us hope at the end.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-10-keith-ai-patches

Josh chats with James Matchett from Cloudsmith about a new report they put out. It has some scary looking statistics in it about how organizations are using dependencies. There are some surprising numbers in there, but the story is really one of defense in depth. There's no single thing we can do here, it's all about knowing what you have every step of the way. It's easy to say, but certainly a challenge to do right. James is a ton of fun to chat with and filled with energy and knowledge.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-10-james-cloudsmith

Josh welcomes Amanda Brock from OpenUK to chat about sovereignty, policy, open source, and a whole host of other topics. Amanda has front row seat into how sovereignty decisions can affect a county and its open source. It seems sometimes like open source is a global phenomenon, but there are always country wide considerations. This is what the OpenUK is doing in the UK. The discussion is great and the things the OpenUK is dealing with will affect many of us moving forward, even if we would prefer to ignore our digital borders.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-09-OpenUK-amanda-brock

Josh chats with Daniel and Stefan from curl about their summer of bliss. Curl stopped taking vulnerability reports for a month and nothing much happened really. Daniel and Stefan have a really pragmatic view of all the new LLM powered vulnerability detection tools. The cost of finding a vulnerability has dropped dramatically, but the cost of fixing those bugs hasn't changed. Taking some time off is important for anyone in the middle of these reports. Daniel and Stefan have some great experience and ideas on how to make this all happen. It's great advice for anyone working on software, not just open source.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-09-curl-bliss-stefan-daniel

Josh welcomes back Daniel Thompson to explain what just happened regarding vulnerability reporting and the CRA on September 11. The very first CRA requirements kicked in, but what does it really mean? Daniel explains it's not too bad. There are plenty more requirements coming, but this one feels very approachable.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-09-daniel-cra