ActiveState Your One Stop For Secure Trusted Open Source

By Jacqueline Winter, CFO and CISO, ActiveState Every finance team knows what an unbooked liability does. It accrues quietly, it lands in several places at once, and it surfaces the day someone outside the company asks a question you can't answer. Open source governance has become that kind of liability, and it now has a name. The AI Remediation Bill , research ActiveState published on October 20, 2026 with Moving Horizon, surveyed 307 security, governance, platform, and engineering leaders at enterprises with 1,000 or more employees. Its finding is uncomfortable for anyone who sits on an audit committee. The downstream cost of AI-assisted development is real, it is spread across engineering, operations, compliance, and security, and each team pays its share out of its own budget. Engineering's share is one line on the bill Start with the line that is easiest to count. Engineers spend at least 139 hours a year, more than 17 working days, fixing or revisiting AI-assisted develop...

By Shane Warden, Principal Architect, ActiveState Someone tried it on October 17 On October 17, 2026, an Amazon honeypot logged an exploit attempt against PHP2Shell, a pair of critical remote code execution bugs in PHP tracked as CVE-2026-109618 and CVE-2026-109619. The PHP project shipped a fix on October 21 at 14:00 UTC. Between roughly 02:00 and 08:00 UTC that morning, AWS saw more attempts from several anonymized sources. After the release, new exploits hit its sensors within hours. [2] AWS doesn't know how the October 17 actor found the exploit early. I don't either, but I do know that the disclosure and solution arrived in a world with attacks already underway. What broke, and what to do now Both bugs live in PHP's memory management and error handling code, which broadens the risk. On Apache with mod_php, CVE-2026-109618 fires on an unauthenticated request before any application code runs. The PHP Foundation also confirmed remote code execution on PHP-FPM through appl...

By Pablo Bleck, Manager, Tools & Infrastructure, ActiveState Say a coding agent opens a pull request on a Thursday afternoon. It was asked to fix a flaky test, and along the way it bumped one direct open source dependency. The manifest diff is one line. The lockfile diff runs to several hundred, and somewhere inside it, a transitive package nobody on the team has evaluated entered the build. CI goes green. A reviewer approves the source change. The new package ships with the next release. Every check in that pipeline did its job. None of them was built to answer the question that matters here: did anyone choose this package? When a developer typed the install command, that person owned the choice. When an AI tool proposes the change, the choice has no owner unless your pipeline assigns one. Key takeaways A green CI run on a dependency pull request confirms the build, the tests, lockfile consistency, and that no known advisory or denied license matched. Whether anyone chose the pac...