Fewer keys under the doormat: why trusted publishing matters for Open VSX
Every software registry eventually learns the same lesson: the most valuable thing in a publishing pipeline is not the code...
Growing the Eclipse Foundation Security Team to Meet the AI Moment
For the last several years, the Eclipse Foundation Security Team has worked alongside our project communities to keep the software...
Eclipse Foundation GitLab incident postmortem: CVE-2026-85706
Between 12 and 14 September 2026, our GitLab instance was affected by CVE-2026-85706, a critical vulnerability in GitLab that allowed...
The Vulnerability Report Is Dead. Long Live the Prompt!
For years, maintainers have asked security reporters for a fairly reasonable thing: reproduction steps. Not a vibe. Not a screenshot...
Optional Identity Verification for Eclipse Foundation Committers Launches June 2
Trust is a core part of open source collaboration. At the Eclipse Foundation, we have always required committers to provide...
Don't become the next Trivy: how to make your releases, tags, and automation resistant to compromise
This is Part 2 of our response to the Trivy supply-chain compromise. Part 1 covered how to consume GitHub Actions...
Stop trusting mutable references: how Eclipse Foundation projects should harden GitHub Actions after the Trivy compromise
On March 19, 2026, an attacker used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77...
Open VSX security update, October 2025
Over the past few weeks, the Open VSX team and the Eclipse Foundation have been responding to reports of leaked...
Eclipse Open VSX Registry Security Advisory
This security advisory provides additional technical details following our initial statement and the corresponding CVE record. TL;DR A vulnerability in...
Vulnerability in Eclipse Open VSX Registry extension publication process
On May 4th, the Eclipse Foundation (EF) Security Team received a notification from researchers at Koi Security regarding a potential...
Strengthening Open Source Security: Eclipse Foundation Selected by the Sovereign Tech Agency for a New Service Agreement
We are pleased to announce that the Eclipse Foundation has been selected by the Sovereign Tech Agency for a new...
Eclipse Foundation Security Statement: JARsigner Abuse by Malicious Actors
Recent reports indicate that cybercriminals are exploiting the Windows DLL side-loading technique using the legitimate jarsigner.exe executable to propagate malware...