ActiveState

ActiveState enables DevOps, InfoSec, and Development teams to improve their security posture while simultaneously increasing productivity and innovation.

[ActiveState @ActiveState]

ActiveState partners with Docker to pair Docker Hardened Images with vetted open source components. A hardened foundation from Docker, trusted components from ActiveState, through a single vendor relationship.

Control at the source. Keep development moving.

Read the partnership announcement: https://t.co/VSQk2D1bXg

[ActiveState @ActiveState]

The AI remediation bill lands in four budgets. 76% had a release delayed by unmanaged open source dependencies. 58% received a compliance or audit finding. 32% traced a security incident to an unmanaged dependency. 83% say costs are rising. Only 31% added up the total.

https://t.co/iASZzhLp0c

[ActiveState @ActiveState]

New report: The AI Remediation Bill. 93% of 300+ enterprise leaders report higher engineering productivity with AI. Engineers also spend at least 139 hours a year fixing or revisiting AI-assisted work. And that's only engineering's share of the bill.

https://t.co/jSnSZWvDrB

[ActiveState @ActiveState]

If a CVE lands on your team today, can you answer “are we exposed” in minutes, not days?

A governed source with a contractual SLA (5 business days for critical, clock starting at upstream fix availability) turns that into a scheduled event instead of a fire drill.

Worth checking before you need the answer.

[ActiveState @ActiveState]

A flaw just landed on CISA’s Known Exploited Vulnerabilities catalog. The remediation clock started the day it was listed, not the day your team got around to checking.

Could you answer “are we exposed” right now, in minutes?
Most teams can’t. That’s not a scanning problem.

Read the full article: https://t.co/noeiH5Ubin

[ActiveState @ActiveState]

Read the full article: https://t.co/1TwcUAn6qc

[ActiveState @ActiveState]

319 of 639 packages carried it in May. 111 days dormant. Then it resurfaced in four new packages, straight past npm's own malware scanner.

Same week: CVE remediation across 21 major vendors got slower, not faster.

Link below for the full article

[ActiveState @ActiveState]

Famous last words right before production goes down on a Friday at 5PM 🙃

[ActiveState @ActiveState]

Anthropic, Google, and OpenAI's coding-agent tooling has critical flaws sitting in the permission and sandboxing code wrapped around it, not in the models themselves.
Jonny Rivera on why the wrapper is the attack surface, not the agent: https://t.co/InCNUuAmDr

[ActiveState @ActiveState]

@ComputerWeekly Read the full conversation on where open source security is headed, and what actually closes the gap: https://t.co/f2m3nB0uW5

[ActiveState @ActiveState]

Why did open source security stay an afterthought for so long? Our CEO Abby Kearns has an answer: 'It's a shortcut we were all happy to live with.' Via Alex Scroxton at @ComputerWeekly

[ActiveState @ActiveState]

@ComputerWeekly Open source is in 98% of the software running today. Her read on why that finally matters: 'I'm hoping people are standing up and paying attention now, with just the pure number of attacks on the software supply chain that we've seen.'

[ActiveState @ActiveState]

Full breakdown from Rebecca Banks: https://t.co/I37mlSwmfh

[ActiveState @ActiveState]

AI-assisted engineering teams: 63% say their scope grew in the past year. 45% are working longer hours. Both numbers point to time spent maintaining code that's already shipped, not time spent writing it.

[ActiveState @ActiveState]

The fix: govern what comes in before it becomes next quarter's maintenance backlog, not slow AI down trying to catch up after the fact. Full breakdown in the reply below. Where does this show up first on your team: the roadmap, the backlog, or a Slack thread nobody's resolved yet?

[ActiveState @ActiveState]

Today, the EU Cyber Resilience Act's Article 14 obligations become enforceable.
If you sell products with digital elements into the EU, you now have 24 hours to report an actively exploited vulnerability from the moment you know, even in products that shipped years ago.

A scanner report sitting in a dashboard isn't a compliance answer. A defined, auditable process is. Non-compliance sits in the CRA's highest penalty tier: up to €15 million or 2.5% of global annual turnover, whichever is greater.

December 2027 is the deadline everyone's watching. Today is the one that just quietly became real.

Start closing the visibility gap now.

Read the release: https://t.co/a8GLx5KMxo