Linux Foundation Launches Akrites Open-Source Vulnerability Response Initiative
Summary
The Linux Foundation announced Akrites, a shared team to coordinate discovery, disclosure and patching of open-source vulnerabilities, help critical infrastructure deploy fixes, and support packages without maintainers.
Key points
- Akrites will provide a shared Security Incident Response Team to report, validate and address open-source software vulnerabilities before coordinated public disclosure.
- The initiative aims to reduce uncoordinated vulnerability reports and help critical infrastructure deploy fixes before in-the-wild exploitation.
- Akrites is designed to maintain confidentiality and serve as a maintainer of last resort for packages whose maintainers are unavailable.
- The Linux Foundation’s Alpha-Omega fund is providing seed funding; other organizations are contributing engineering resources and additional funding.
- The Linux Foundation said Akrites will measure success by patch deployment, citing the risk that adversaries can use AI to quickly reverse engineer vulnerabilities after patches become public.
Article Details
- Event Type
- Launch of Akrites, an open-source software security initiative establishing a shared Security Incident Response Team.
- Impact
- Akrites aims to coordinate confidential vulnerability reporting, validation, patching, and public disclosure; help critical infrastructure deploy fixes before in-the-wild exploitation; and provide a maintainer of last resort for packages that are no longer maintained. The Linux Foundation said success will be measured by patch deployment, noting that adversaries may use AI to rapidly reverse engineer vulnerabilities after patches are public.
Vendors
Amazon Web ServicesAkrites is supported by Anthropic, AWS, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, andAnthropicAkrites is supported by Anthropic, AWS, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, andChainguardLess than two weeks ago, Chainguard announced Athena, a coalition of over two dozen fintech and technology organizations aimed at addressing OSS bugs before public disclosure.CiscoAkrites is supported by Anthropic, AWS, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, andGitHubAnthropic, AWS, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, and Zscaler, many of which wereGoogleAkrites is supported by Anthropic, AWS, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, andIBMAkrites is supported by Anthropic, AWS, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, andMicrosoftsupported by Anthropic, AWS, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, and Zscaler, manyOpenAIChainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, and Zscaler, many of which were mentioned asThe Linux FoundationThe Linux Foundation on Thursday announced a new industry effort aimed at efficiently addressing vulnerabilities in the open source software (OSS) ecosystem.