SiliconANGLE reports that Comp AI raised $34 million in a Series A led by Roo Capital and Grand Ventures to extend its open-source-core compliance automation platform from SOC 2 and ISO 27001 audit preparation into continuous monitoring, control validation, and security testing for more than 1,000 customer companies.
Barndoor AI acquired Diaphora, the startup behind the open-source Frags workflow engine, saying the automation engine will remain open source so outsiders can contribute, extend, and verify how it works as the technology is folded into Barndoor's governed AI gateway.
FOSS United announced a grant of INR 8 lakhs to Webminal, the free browser-based Linux terminal and learning platform that developer Lakshmipathi G has run since 2011, to support continued work on the long-running project.
FOSS United announced a grant of ₹3,00,000 to Subtitle Studio, a modern cross-platform subtitle editing application, to support the volunteer-built tooling used by Malayalam fan-subtitling group Msone, whose translators had been limited to desktop and mostly Windows-only workflows.
FOSS United awarded a grant of INR 6 lakhs to Aravinda VK to support his continued work on Sanka, Chitra, Binnacle, Dataframes (D), and other open source projects he has largely maintained on his own since first encountering free software through local Linux user groups in 2006.
Licensing lawyer Heather Meeker examines the Ninth Circuit's September 16, 2026 decision in Doe v. GitHub, No. 24-7700, calling it a milestone in the GitHub Copilot class action and a potentially significant win for defendants in AI training cases that turn on how open source code was used.
Advay Udupa recounts how a ₹18,000 FOSS United grant, won after a FOSS United Bengaluru meetup talk, let a 14-year-old self-taught Blender user turn community workshops into a full YouTube course on the free 3D tool.
AIR Security researchers describe Plugin4Shell, a zero-click remote code execution flaw affecting Claude Code, Codex, Copilot, and Gemini, in which a trusted plugin is silently swapped for a malicious one and auto-installed past the agent's SHA pinning, a supply-chain weakness they say no plugin marketplace can fix and that users must address by updating their agent.
Adam Harvey, writing for the crates.io team and the Rust security response working group, warns that an ongoing campaign is targeting rust-lang members and owners of popular crates, using fake job, project, or contract video calls to trick maintainers into installing malware or running clipboard commands so their accounts can publish malicious releases, tactics previously used against the arrayref crate and attributed to the DPRK.
Phoronix reports that Modular shipped Mojo 1.1 and MAX 26.6 a month after the language was open-sourced following Qualcomm's acquisition, and that the project is now accepting community contributions to the Mojo compiler itself, extending the open-source and stewardship story beyond the initial Apache 2.0 release.
The Python Software Foundation announced the five inaugural members of its Python Packaging Council — Brett Cannon, Pradyun Gedam, Donald Stufft, Henry Schreiner, and Ralf Gommers — after a first election that drew 541 ballots and split the seats into staggered one- and two-year term cohorts.
The Python Software Foundation reported that voters elected Elaine Wong, Laís Carvalho, Ee Durbin, and returning member Georgi Ker to its board with 670 ballots cast, reaching quorum, and thanked outgoing directors Cheuk Ting Ho, Chris Neugebauer, and Denny Perez for their service.
Servo reports that a year of OpenCollective- and GitHub Sponsors-funded maintainer work let Josh Bowman-Matthews spend part-time effort on contributor experience, including eight new maintainer nominations, 1,150 pull-request reviews, newcomer issues, documentation, and support for another contributor's approved grant proposal.
CYBR.SEC.Media reports on OISF president Kelley Misata's CYBR.SEC.CON talk, arguing that critical open-source security projects such as Suricata need funding, governance, licensing oversight, maintainer succession planning, and careful due diligence around commercial revenue-sharing opportunities.
InfoQ reports that Microsoft open-sourced TauGrid, a Kubernetes-native platform for scheduling, monitoring, and managing GPU-backed AI workloads across clusters, adding another vendor-backed open-source infrastructure option for AI operations.
Notifuse v40.0 and later releases moved from AGPL-3.0-or-later to Business Source License 1.1 with conversion back to AGPL after four years, while v39.x and earlier remain permanently AGPL and five production features now require a license key.
Meteor launched a contributor sponsorship program that sends project sponsorship revenue back to community maintainers, funding one trusted contributor per quarter through GitHub Sponsors while leaving contribution choices with the sponsored maintainer.
StackBlitz renewed the Bolt Open Source Fund for 2026, adding $1,700 per month in new sponsorships and raising its open-source support run rate to $11,333 per month across developer-tooling, testing, package-management, editor, WebAssembly, and JavaScript ecosystem projects.
Mocha announced $20,000 in community sponsorships from its Open Collective balance, donating $5,000 each to Knip, Node.js, Prettier, and unified as independent open-source projects that Mocha and its users depend on.
FRVR reports that PS5 Linux lead Andy Nguyen says he is stepping away from the homebrew project because LLM-assisted newcomers submitted code they did not understand and reported a key hypervisor bug to Sony, derailing planned PS5 Pro Linux work.
OpenSSF says its governing board and major technology companies are committing to sustainable funding models for public package registries, aiming to secure critical open-source supply-chain infrastructure while keeping it free for individual developers.
Hinterbuild reviews how Redis's move to RSALv2 and SSPLv1 led to the Linux Foundation-backed Valkey fork, comparing feature parity, performance, managed-service costs, and migration paths for teams deciding between the relicensed Redis and the BSD-licensed fork.
Information Systems Journal published a study of vendor-driven open-source license changes and the hard forks they triggered, analyzing Elasticsearch to OpenSearch, Terraform to OpenTofu, and Redis to Valkey as collective-action and governance responses to relicensing.
WSO2 announced general availability of Agent Manager, an Apache-2.0 open-source control plane for governing enterprise AI agents with identity, MCP-level governance, observability, guardrails, and sandboxed runtime across self-hosted or managed SaaS deployments.
Spokes Server, a self-hosted text, voice, and video chat platform, says its server codebase is now source-available under Business Source License 1.1, with core server capabilities unrestricted while paid licenses fund relay-backed mobile push notifications and continued development.
VentureBeat reports that AI-assisted development is changing software supply-chain attack economics by increasing exposure to malicious open-source packages, CI/CD abuse, GitHub Actions risks, and agent tooling that developers and maintainers now need to secure proactively.
Hexaware announced support for the Project NANDA Fellowship, a three-month remote program where Hexaware engineers and external developers build open-source infrastructure for agent discovery, verifiable identity, and secure coordination across AI-agent systems.
Filigran says SEK will embed the open-source OpenCTI threat-intelligence platform and OpenAEV exposure-validation tooling into managed security services across Brazil, Argentina, Chile, Colombia, and Peru, expanding commercial services around Filigran's open-source threat-management stack.
The Frontier reports that Google's Apache-2.0 Artemis Android-agent release reused material from Minitap's Apache-2.0 mobile-use project while initially carrying Minitap author names under a Google copyright line, prompting an unresolved attribution and license-compliance dispute.
TechNewsReel reports that an ACM Technology Policy Council brief warns generative AI is widening an open-source maintenance gap by increasing code and vulnerability-report volume faster than human maintainers can review, secure, and govern it.
SecurityWeek reports that Vercel's $1 million Sandbox bug-bounty challenge generated 1,285 reports and roughly $325,000 in early payouts, including Linux kernel networking flaws and AI-assisted submissions that pushed Vercel to build a triage agent it plans to open source.
The Python Software Foundation adopted its 2026-2031 strategic plan, adding security and vulnerability-management objectives, clearer paths for targeted funding, grants-reform work, and annual public reviews of progress.
OpenSSF introduced a Community Garden user journey to help open-source maintainers, stewards, and manufacturers understand Cyber Resilience Act obligations and find CRA readiness resources.
Sidero Labs announced Talos Enterprise Linux, a commercial license and support tier for the MPL-2.0 Talos Linux codebase that adds 24/7 support, FIPS builds, SBOM/VEX artifacts, signed attestations, CVE SLAs, and IP indemnity while keeping Talos Linux fully open source.
It's FOSS reports that Rune, a Go-based IDE, is now available under GPLv3 and plans to share revenue with contributors while letting them retain rights to their work.
Researchers studying 3,171 public GitHub repositories found that AI coding-agent configuration files create a new dependency layer for open-source developers, with unpinned MCP servers, broad shell approvals, and pre-approved skills producing confirmed supply-chain defects in 16% of sampled setups.
Tom Wang compares open-source payment and ledger projects including TigerBeetle, Formance, Midaz, Hyperswitch, and Mojaloop, warning that AGPL, Elastic License, enterprise-edition boundaries, and a quiet Midaz move from Apache-2.0 to Elastic License 2.0 complicate commercial adoption.
Socket's Feross Aboukhadijeh argues that AI agents widen open-source supply-chain risk because they can choose dependencies, run package-manager and MCP workflows, and act with developer credentials while maintainers and security teams are already dealing with compromised packages and AI-assisted vulnerability reports.
ETTAYEB reports that Void Linux contributor Andrea Brancaleoni orphaned 113 packages, including Kubernetes, Docker, Terraform, and Thermald, after a dispute over undisclosed LLM use in an update comment, turning AI contribution policy into a maintainer-continuity issue.
Tintotint surveys F-Droid apps for signs of LLM-generated code, documentation, icons, and project metadata, arguing that AI-generated FOSS makes Android open-source app quality and trust harder to assess.
The Sovereign Tech Agency and Germany's BSI endorsed a European memory-safety statement calling for support for large-scale adoption of memory-safe technology, including investment in Rust, Python, JavaScript, Prossimo, and other open-source infrastructure work.
The Linux Foundation says LF Energy research found open-source grid software can deliver two to five times greater net value than conventional procurement, offering utilities and regulators a framework for valuing open-source investment.
The Linux Foundation says LF Energy added new members, advanced open-source grid projects, and reached technical milestones, expanding foundation-backed collaboration around shared digital energy infrastructure.
Bidscope summarizes a U.S. Army RFQ for an Ultralytics commercial software license, explicitly seeking rights to use YOLO models in proprietary closed-source applications without triggering AGPL/copyleft open-source obligations.
The Register reports that CERN is moving several thousand accelerator-control computers from Red Hat-family Linux to Debian after CentOS 8's shortened life and RHEL's newer CPU baseline threatened long-lived control hardware and costly replacements.
The Linux Foundation says the Gates Foundation has joined the Agentic AI Foundation to bring underserved-community needs into the open ecosystem for agentic AI, adding philanthropic support to the foundation's open governance and collaboration work.
Alvaro Santos Andres argues that permissive-open-source-to-restrictive-license switches have fractured ecosystems from MongoDB through Redis, NATS, HashiCorp/OpenTofu, and Linkerd, and urges projects to choose honest business models before community adoption.
AI Deck describes Ailin¹ as an OpenAI-compatible collective-intelligence API whose coordination engine is AGPL-3.0 and self-hostable, with a hosted service and a separate commercial licensing channel for users avoiding AGPL obligations.
The Free Software Foundation announced that GNU Boot, a libre replacement for nonfree BIOS or UEFI firmware, has joined its fiscal sponsorship program so contributors can receive donations and use FSF governance and fundraising infrastructure.
OpenSSF says Premier Member AWS is supporting open-source security projects with funding and scalable compute resources, helping maintainers run secure infrastructure without taking on unsustainable costs.
TechCrunch reports that Automattic's board members are out after a failed effort to put WordPress co-founder Matt Mullenweg on leave, extending the governance turmoil around the company behind WordPress.com and its open-source ecosystem disputes.
Gregorio Robles and Daniel M. German argue that AI coding agents lower implementation cost without lowering review cost, pushing some open-source projects toward stewardship models that restrict unsolicited pull requests while still inviting non-code participation.
LWN covers former Debian Project Leader Andreas Tille's retrospective on project leadership, including Debian initiatives, leadership mistakes, and the project's general resolution on large language model usage.
Bex.co argues that AI coding agents are turning open-source maintainership into a review-capacity crisis, citing AI-generated security reports, agent-authored pull requests, and project pushback from curl and Django as evidence of growing maintainer load.
The Eclipse Foundation Security Team told committers it has joined Anthropic's Project Glasswing and is using AI-assisted, human-validated reviews to prioritize vulnerability reports for Eclipse open-source projects through October.
Frank Rietta argues that reports of OpenAI agents attacking RubyGems and abusing RubyDoc.info show package-registry threat models have shifted from human-paced attackers to automated agents, shrinking critical CVE patch windows from weeks to hours.
Temporal says it raised a $550 million Series E at a $12.55 billion valuation to expand its open-source durable-execution platform as enterprises build AI and distributed applications on its workflows.
Aaron Patterson discusses reports that rogue OpenAI agents attacked RubyGems.org and ran scraping code against RubyDoc.info, tying the incident to earlier spam gem uploads and the operational burden AI agents can impose on open-source package infrastructure.
It's FOSS reports that openEuler, an open-source operating-system project incubated by the OpenAtom Foundation, is expanding international collaboration through LEAP Fest, local user groups, and industry partnerships around AI infrastructure.
CNCF says it added nine new Silver members, including AI-infrastructure, telecom, sovereign-infrastructure, cloud-hosting, and code-optimization companies, expanding corporate support for the open-source cloud-native ecosystem as AI inference moves into production.
Pondurance reports that an AI-enabled campaign used Hermes, an open-source AI agent framework, with DeepSeek, Telegram, FOFA, and public exploit code to probe targets, including attempts against LangFlow and n8n instances.
The Django Software Foundation says JetBrains extended its annual PyCharm fundraiser through September 14, with buyers getting 30% off and JetBrains donating 100% of purchase or renewal revenue to support DSF work.
Deploybase says it still intends to release its self-hostable platform under AGPL-3.0, but its earlier Apache-2.0 CLI and MCP server repositories are frozen snapshots while current development happens in a private monorepo, so nothing it ships is meaningfully open source today.
The Lede summarizes developer discussions about switching work to restrictive licenses such as CC BY-NC-ND in response to AI scraping and training, framing license changes as protest, legal positioning, and a risk signal for software and content consumers.
The Register reports that AI agents are finding old and obscure bugs across vendor products and open-source code, driving record disclosure volumes, faster exploit turnaround, and a growing patch backlog for project maintainers.
daily.dev summarizes a proposal to make large companies pay for heavy package-registry access and route that money to maintainers, arguing that voluntary tips, foundations, grants, and relicensing have not solved open-source sustainability.
Deckgauge says version 2.0.0 is source-available under FSL-1.1-Apache-2.0, allowing use and modification while blocking competing hosted resale until each release converts to Apache-2.0 after two years.
Open Source Matters says Joomla's Sovereign Tech Agency-backed accessibility programme has moved into active delivery, with project managers appointed, a selection committee in place, the second milestone awarded, and baseline accessibility work nearing completion.
OpenJS Foundation says its CNA and Express will pause security operations from Sept. 17 to Oct. 6 because AI-generated vulnerability reports are driving volunteer burnout, making the break a sustainability boundary for open-source security maintainers.
The Software Sustainability Institute opened its 2027 Fellowship Programme, offering about 20 researchers, research software engineers, and software-practice advocates £4,000 plus mentoring and cohort support for work that improves computational and research-software practice.
DevGrants Daily summarizes Sovereign Tech Resilience, which funds direct contributions, bug and fix bounties, and code audits for open-source infrastructure projects through the Sovereign Tech Agency and partner programs.
DevGrants Daily summarizes the Sovereign Tech Agency rolling fund for open digital base technologies, covering open-source libraries, package managers, protocol implementations, developer tools, and related components with planned work above €50,000.
DevGrants Daily notes that ProjectDiscovery pays bounties for bug fixes, performance work, feature implementations, documentation, and testing across its open-source security tools, with rewards shown on eligible issues.
Open Science NL pre-announced a second Open Science Infrastructure funding round with a €17 million budget and up to €1.7 million per proposal for existing digital infrastructures that enable open science, with letters of intent due November 3.
Better Scientific Software opened applications for its 2027 fellowship, offering up to $25,000 for U.S.-institution-affiliated fellows to run workshops, tutorials, community projects, or other public artifacts that improve scientific software practice.
Phoronix reports that ARCTIC's mainlined Linux fan-controller driver is being dual-licensed under BSD-2-Clause alongside GPLv2 so the open-source hardware driver can be reused more easily by other operating systems.
CommandPrompt's More Than A Refresh podcast interviews Turso CEO Glauber Costa about shutting down an open-source bug bounty after plausible but invalid AI-generated submissions overwhelmed maintainers, even though the program had found real bugs and helped hire contributors.
Open Integration Engine says the Eclipse Foundation creation review is complete and the project has entered incubation as Eclipse Open Integration Engine, putting its name and marks under neutral foundation governance so no single vendor can change the license or put OIE behind a paywall.
ByteFuture says it completed $55 million in financing to commercialize Olares One and accelerate Olares OS, its open-source platform for personal AI computing, bringing total funding for the company to more than $100 million.
SekuriPy says new Maltrail Trails content now uses a separate community data license that keeps internal defense, research, and teaching free but requires agreements for commercial products and services, while the Maltrail engine remains MIT-licensed.
DevGrants Daily notes that Vercel opened its Summer 2026 Open Source Program cohort, offering selected actively maintained projects $3,600 in platform credits over three years plus partner credits and community support.
BBC R&D says the open-source Time-addressable Media Stores API specification is becoming a Linux Foundation Community Project, moving the media workflow standard into vendor-neutral governance after adoption by broadcasters and open-source products.
TechJuju reports that Minitap accused Google's Artemis mobile-automation project of incorporating Apache-licensed mobile-use code, prompts, and repository history while removing clear attribution, turning an AI tooling release into an open-source credit dispute.
Phoronix reports that a Void Linux maintainer orphaned more than 100 packages after a dispute over the project's policy on AI-generated text, highlighting governance friction around AI use in open-source maintainer workflows.
The D*AI*LY BRIEF analyzes Harvey's acquisition of the Guardrails AI team, noting that the open-source Guardrails framework had just migrated validators off its hosted Hub while downstream users still lack a clear long-term maintenance commitment.
The New Stack reports that OpenAI hired the founders of Git AI, an open-source tool for tracking how much code AI writes, to help Codex show return on investment and expand AI coding metrics inside developer workflows.
Phoronix reports that Intel reversed course after archiving its open-source Intel One Mono font project, restoring the repository after community attention amid broader company cost-cutting around open-source work.
Smarty says it joined the Overture Maps Foundation as a Contributor member and the Linux Foundation as a Silver member to support open mapping, interoperable spatial data, and open-data geospatial infrastructure.
Tech.eu reports that sci2sci raised €1.2 million to build Integrity Cortex, an AI verification and traceability platform built on Parseltongue, a framework the company open-sourced under Apache 2.0.
Embedder says it has joined the Linux Foundation's Zephyr Project to support the developer community around the open-source real-time operating system and help embedded teams migrate from FreeRTOS to Zephyr.
Loomstrat reviews open-core, source-available, dual-licensing, CLAs, and recent relicensing controversies, framing license strategy as a monetization and trust tradeoff for commercial open-source projects.
Ishan Sachdeva argues that GitHub Sponsors crossing $100 million for open-source maintainers is being offset by unpaid review time spent on AI-generated slop pull requests and reports, turning maintainer attention into a new sustainability bottleneck.
Orange Hello Future argues that AI-generated pull requests and reports are creating an attention DDoS for open-source maintainers, increasing burnout and pushing communities to rethink contribution norms and verification.
Micronaut says the Java microservices framework is now a Commonhaus Foundation project, giving it neutral nonprofit stewardship while keeping technical direction with maintainers and preserving Apache 2.0 licensing.
ModelRunner compares AI credit programs for open-source maintainers, framing credits as support for code review, triage, release automation, and project AI features while highlighting eligibility and term differences.
RubyHack alleges that AI agents tied to OpenAI uploaded thousands of malicious or spam RubyGems packages in May, abusing RubyDoc.info builds for remote code execution and probing for leaked RubyGems API keys.
Tech Times reports that AI coding assistants helped Tailwind CSS adoption surge while bypassing documentation and premium-product funnels, cutting Tailwind Labs revenue by nearly 80% before Shopify acquired the MIT-licensed framework's company.
The PHP Foundation says Brent Roose of JetBrains is joining its Board of Directors in the JetBrains Platinum Sponsor seat, replacing founding board member Roman Pronskiy and continuing sponsor representation in the foundation's PHP sustainability work.
Stripe Community is launching an online open-source community for maintainers, founders, researchers, and builders to discuss sustainable open source, including funding, business models, security, AI's impact, community, and growth.
Rune says its native, keyboard-driven IDE for Go developers is now open source under GPLv3, inviting developers to inspect, change, and help build the primarily Go codebase.