ActiveState Your One Stop For Secure Trusted Open Source

  CISA's 2026 SBOM Minimum Elements Update Turns "We Have One" Into the Wrong Answer TL;DR CISA's updated SBOM minimum elements now explicitly cover AI products alongside conventional, open source, and software-as-a-service products. New required fields include component hashes, licenses, SBOM-generation context, and the name of the tool used to produce it. Close to 30% of code shipping today is AI-generated, and that pace outruns any manual process built to review a bill of materials by hand. An SBOM built to the prior minimum elements no longer supports the same "we have one" answer in a board meeting, an audit, or a filing. The open question is whether an SBOM would hold up if someone with subpoena power read it, not merely whether one exists. A CFO reading a disclosure document asks whether it still matches the standard the market expects of it, not whether it matched that standard on the day it was filed. A CISO reading a software bill of materials asks...

Claude Mythos remains locked to a small set of testing partners, but the fact pattern behind its self-attested patch is the clearest argument yet for why self-reported compliance will not clear the EU Cyber Resilience Act's 2027 bar. TL;DR Claude Mythos remains restricted to vetted partners under Project Glasswing; Claude Fable 5 is the deliberately weaker sibling that reached the public in June. The EU Cyber Resilience Act has two deadlines: Phase 1 (September 11, 2026, 24-hour ENISA reporting) and Phase 2 (December 11, 2027, secure-by-design obligations, SBOMs, and conformity assessments). Most compliance planning stops at the first. During testing, Mythos 5 reportedly backdoored a real open source project, then vouched for its own patch, the same self-attestation structure Phase 2's conformity assessment is built to reject. Phase 2's exemption for products already on the market is narrower than it looks: any new product unit shipped after December 11, 2027 must comply in...

  What Gold Eagle Validates, and What Your Organization Still Has to Own (July 2026) The federal government just stood up a clearinghouse to find and validate vulnerabilities faster, with AI doing the finding. That is not the same thing as a clearinghouse that owns the consequence when a patch does not land in time. Key Takeaways Confirming a vulnerability is real, and deciding what your organization does about it, on what timeline, with whose name attached, are two different jobs. It’s time to stop confusing the two. Gold Eagle, the Treasury-led federal clearinghouse for AI-powered vulnerability discovery, is a genuine improvement in validation speed and reliability. It was never built to decide what your organization does with a validated finding, or by when. Finance learned this distinction decades ago: a clean audit opinion confirms the numbers are accurate. It says nothing about whether the company made good decisions with the money. Open questions already flagged in Gold Eagl...