In November 2021, a zero-day vulnerability in widely used open-source code shocked the tech industry and triggered an urgent effort to help protect the largely volunteer-maintained open-source ecosystem. Nearly four years later, that effort has made significant progress but has also encountered multiple setbacks.

The Log4Shell vulnerabilityappeared in a popular Java logging tool, prompting the Biden administration to focus on open-source security and pushing major tech companies like Amazon, Google, and Microsoft to pledge tens of millions of dollars for security improvements. Much of this work has been carried out through theOpen Source Security Foundation (OpenSSF)under the Linux Foundation, which has created various tools to help developers analyze and respond to code risks.

However, the effort that began with aWhite House summitand an ambitious industry"mobilization plan"soon faced challenges. A seductive new technology—generative AI—distracted the tech giants funding this work, while the U.S. political transition extinguishedgovernment efforts to push the industry forward。

Experts told Cybersecurity Dive that overcoming these obstacles and doubling down on open-source security is crucial, because open-source code has permeated everything from critical infrastructure to everyday home computing.

"We need to make sure that the momentum we built doesn't get lost," said Jack Cable, who served as a senior technical advisor at the U.S. Cybersecurity and Infrastructure Security Agency (CISA) overseeing open-source security efforts.

Open-source security progress

Since early 2022, the influx of funding and attention has brought important open-source security improvements.

One of the most notable advances is the effort to improveopen-source package repository security. David Nalley, director of developer experience at Amazon Web Services, said repositories are "the distribution point for most software consumption today," and Amazon has helped fund improvements to these critical platforms. Christopher Robinson, chief security architect at OpenSSF, said the goal of this work is to ensure that "all projects in these ecosystems will inherit" strong security practices.

Amazon also helped developers of the TLS encryption library in the memory-safe programming language Rust adoptfederally compliant encryption algorithms, making it easier for organizations that need to meet these standards, including companies in regulated industries, to use memory-safe code.

Robinson highlighted OpenSSF'sSigstore project, which allows developers to digitally sign code to prevent tampering. He also praised tech companies for embedding security experts in communities built around specific programming languages, serving as "ambassadors" for these groups in the broader ecosystem.

CISA used its authority and reputation for expertise to bridge the gap between organizations using open-source code and the developers producing it.

"We did a lot of work to make sure... that when incidents happen, people can connect with each other," said Cable, who is now CEO and co-founder of Corridor, an AI coding security company. He said these efforts paid off during the 2024XZ Utils crisis, when a malicious actor used social engineering to trick an overburdened developer into planting a backdoor in his widely used software package.

Perhaps most importantly, companies that rely on open-source software packages are increasingly taking responsibility for securing them, rather than treating open-source developers as unpaid labor. Arnaud Le Hors, senior technical staff member at IBM Open Technology, said open-source developers have complained for years that they feel exploited by companies profiting from their code. Now, more businesses "realize you can't just rely on the whole community to fix vulnerabilities in open-source packages you decide to use in your products."

"A lot of good work has really been done over the past few years," Cable said, "and a lot of it is still ongoing."

Reduced investment

After Log4Shell exposed the unstable state of the open-source ecosystem, leading tech companiesmet with Biden administration officialsandpledged more than $30 millionin services, infrastructure, and personnel support. But experts say that while these companies' efforts have yielded some results, they have fallen short of expectations.

Aeva Black, who led CISA's open-source security program for two years, said tech companies' commitments "didn't materialize at the promised amounts," leading to "a lot of disappointment." Additionally, Cable said many other companies didn't even make any commitments because they "still don't recognize... the value they get from open-source software" and "haven't thought about how to engage with maintainers, let alone start giving back."

Amazon, one of the largest early funders of OpenSSF's work, "invests more today than it did after Log4Shell," Nalley said, but its "investment has evolved as we learn what works and what doesn't... Some investments have paid off well, others may not have been as we expected."

As companies scaled back their ambitions, the U.S. government shifted from pushing them forward to abandoning this area under President Donald Trump. Le Hors said open-source efforts "have slowed down under the new administration."

The Biden administration pledged$11 millionfor open-source security last August, but Black said "those commitments were not fulfilled."

The Trump administration'scutsto CISA and thedeparturesof widely respected experts like Black and Cable have essentially eliminatedthe agency's work on open-source security。

Black said CISA's advocacy helped open-source experts at tech companies convince employers to "honor their commitments" and become more active participants in the community. Looking ahead, Cable said "it's unclear to what extent CISA and the federal government as a whole will be involved" in open-source matters.

Marci McCarthy, CISA's director of public affairs, said in a statement that the agency "remains highly focused" on open-source security. "Open-source software is a critical component of our software supply chain for the federal government and U.S. critical infrastructure," McCarthy said. "We are proud to have a talented team dedicated to understanding and mitigating the risks of open-source software."

OpenAI unexpectedly upends everything

On November 30, 2022, just months after the OpenSSF security program launched, OpenAI released ChatGPT. As the generative AI chatbot captured public attention, tech companies rushed to embrace the technology. Around that time, Black said, "several big companies that had made open-source security commitments began reassigning developers from open-source security projects to AI tools."

In the years that followed, as companies "shifted massively to double down on AI," open-source security was set aside, Black said.

Black said most of the Microsoft experts they worked with during their time at Microsoft and CISA "are now all moved to AI teams." They recalled that when CISA recruited them from Microsoft, their team at the company "was being dismantled and reassigned to AI work."

Black said Microsoft's legal and policy staff who had supported open-source work were also reassigned to AI, and Microsoft subsidiary GitHub "underwent a massive shift." Black said Microsoft and Google "both seem to be reallocating human resources away from this work."

Microsoft did not dispute Black's claims, but Ryan Waite, its director of open-source ecosystems and open-source incubation, said the company remainsdeeply engagedwith the ecosystem. A Google spokesperson said it "continues to invest significant resources and expertise" in open-source security.

Some experts believe AI will improve open-source security by dramatically speeding up the discovery and fixing of vulnerabilities. The U.S. Defense Advanced Research Projects Agency (DARPA) recently partnered with OpenSSF toconclude a prize competitionaimed at developing AI-driven vulnerability detection software.

But others are less optimistic. Black pointed to afrustrated presentationby the developer of the widely used curl software package at a conference. "He's being overwhelmed," Black said, "by AI-based developer junk—people submitting patches that are clearly written by generative AI tools, of poor quality, and he has to constantly filter through and reject them."

Unresolved issues

Experts say a range of pressing open-source security issues remain unresolved, and their levels of commitment to these issues vary.

One of the most serious issues is that software developers—including thosesupplying the U.S. military—often don't know where the code they use comes from. "People don't have a good understanding of what they consume," Nalley said. This problem is especially severe because of the sheer number of packages contained in a piece of software—according to Sonatype data, anaverage of 180—and many of these packages have poor security. Nearly four years after the Log4j vulnerability was widely publicized, flawed versions still account for 13% of all downloads of that package, Robinson said.

Nalley said OpenSSF'sScorecard projectwill help developers address these "dependency" risks.Software bills of materials (SBOMs)may also help reveal a package's dependencies, though Black said the complexity of open source makes them less effective.

Identifying and helping the least-maintained but critical projects remains another major challenge. Some projects underpinning the entire internet may be the work of justone or two volunteers. "We need to invest there," Nalley said. Harvard Business School has been addressing this throughregular censuses.

The XZ Utils crisis highlighted the importance of reducing trust gaps in projects and knowing where every line of code comes from, Le Hors said, and OpenSSF'sSupply-chain Levels for Software Artifacts (SLSA)project will help address this.

Tech companies rewriting software packages in memory-safe programming languages face adoption challenges. "Many of the packages we've tried to rewrite haven't seen significant adoption," Nalley said. His teamhelped rewritethe criticalsudo packageand encouraged Linux distributions to adopt it, but they said it had too many dependencies, so the team had to redo it.

There is also more work to be done in securing package repositories. "Investing in infrastructure is very important," Nalley said.

Even as efforts in the U.S. slow down, other governments have not stood still.New EU legislationwill require companies to be responsible for the security of the open-source code they list, which could have global implications.

"We've made a lot of progress since the Log4Shell issue," Le Hors said. "We're still making some progress, fortunately, because the U.S. is not the whole world."