TuxCare Joins OpenSSF to Advance Open-Source Security

Today, the Open Source Security Foundation (OpenSSF) announced TuxCare as a new General Member, alongside Aikido, Minimus, ActiveState, and the FreeBSD Foundation.

OpenSSF is a cross-industry initiative of the Linux Foundation focused on securing how open-source software is built, maintained, and consumed. Its work spans community collaboration, technical initiatives, security baselines, signing and provenance, and supply chain integrity across the open-source ecosystem.

For more than a decade, TuxCare has helped organizations keep open-source software secure in production. That work spans live kernel patching, long-term support for end-of-life software, and supply chain integrity – all focused on a problem that has grown more difficult, not less, as open source has become the foundation of modern software.

Two shifts have reshaped what it means to depend on open source. First, the volume of disclosed vulnerabilities has grown faster than many teams can patch. Second, supply chain attacks have become a regular part of how open-source software is compromised – from the xz backdoor and npm package takeovers to malicious copycats and slopsquatting, where attackers register hallucinated package names that AI assistants suggest to developers.

AI is accelerating the problem from both directions: attackers use it to scale and disguise their tactics, while defenders import its insecure output straight into production. Veracode’s 2025 GenAI Code Security Report found that 45% of AI-generated code samples introduced OWASP Top 10 vulnerabilities, with no meaningful improvement across model generations.

For developers and security teams, the result is a new trust burden. Every package pulled into a build raises difficult questions: who built it, what’s inside it, where it came from, and whether it can be trusted. Modern applications often depend on hundreds or thousands of direct and transitive packages. No team can manually audit them all.

Closing that gap at the ecosystem level takes more than any single company can build. It requires cross-industry standards for provenance and signing, coordinated vulnerability disclosure, practical security baselines, and sustained support for the maintainers behind critical open-source projects. OpenSSF is the right home for that work because it provides neutral ground for collaboration across vendors, maintainers, enterprises, and security teams.

Where TuxCare Fits

TuxCare’s role is focused on the operational side of open-source security: helping organizations keep the software they already depend on secure, trusted, and supported for as long as it remains in production.

That is also where SecureChain fits. SecureChain gives enterprises a curated way to consume open-source packages with trust built in by default – from verified provenance and continuous vulnerability patching to long-term protection when upstream support ends.

If hardening your open-source supply chain is on your roadmap, see what SecureChain does.

Summary