VANCOUVER, British Columbia – July 8, 2026 – ActiveState, a global leader in open source software security and software supply chain management, today announced that the ActiveState Curated Catalog has been named Best Open Source Security P…
Containers have become foundational to modern software development. They power CI/CD pipelines, enable cloud-native architectures, and accelerate deployment cycles. But as container adoption reaches near universal scale, a troubling pattern…
Your secure open source foundation Open Source Security for CISOs & Teams Open Source Management for Engineering Leaders Secure Open Source for Developers Open Source Vulnerability Management Open Source Compliance and SBOM Generation Secur…
A comprehensive breakdown of the North Korean-linked attack that weaponized one of JavaScript’s most trusted libraries, and the architecture that makes it impossible to repeat. Axios is a promise-based HTTP client for JavaScript. It handles…
Why Waiting to “Get Organized” Before Securing Your Open Source Supply Chain Is the Most Expensive Mistake You Can Make I talk to engineering and security leaders every week. The conversations are remarkably similar. Some organizations don’…
Containers have become a cornerstone of modern software development. They allow developers to package applications with all necessary dependencies and run them consistently across environments, drastically reducing headache around environme…
Security flags the CVE. Engineering owns the sprint. Neither team pulled in that dependency, the AI did. Here's the real root cause of the dev-security conflict, and how to end it. The post The Dev vs. Security Conflict Root Cause Isn’t Cul…
Gartner predicts 50% of CISOs will rebrand to cyber resilience by 2028. A rebrand without re-architecture isn't resilient. Here's where the rebuild actually has to start. The post Beyond the Buzzwords: Why True Cyber Resilience Starts at th…
Security sets the policy. Engineering controls the pipeline. Nobody fully owns the risk. Here's the structural gap behind 30 years of vulnerability ownership confusion and how to close it. The post What Your SBOM Isn’t Telling You: Hidden D…
Non-developers are shipping things to prod that pull in open source packages your security team can't see, own, or remediate. Here's why your governance model needs to catch up. The post Your Data Scientists Are Shipping to Prod. Who Owns t…
AI coding assistants are adding open source dependencies faster than scanners can manage. This guide covers the toolchain engineering leaders need to govern open source risk without slowing down their teams. The post Beyond the Scanner: How…
Security sets the policy. Engineering controls the pipeline. Nobody fully owns the risk. Here's the structural gap behind 30 years of vulnerability ownership confusion — and how to close it. The post The Ownership Problem Behind Modern Soft…