Open Source Security Foundation (OpenSSF)

Rule Changes

Providing guidance and training for open source compliance

For decades, software companies shipped code with security flaws and faced little legal consequence, but on September 11, 2026, that changes for any product sold in Europe. The Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities within 24 hours, maintain software bills of materials listing every component in their products, and provide security updates for the product's lifespan.

Updated May 27