ActiveState Your One Stop For Secure Trusted Open Source

By Jacqueline Winter, CFO and CISO, ActiveState Every finance team knows what an unbooked liability does. It accrues quietly, it lands in several places at once, and it surfaces the day someone outside the company asks a question you can't answer. Open source governance has become that kind of liability, and it now has a name. The AI Remediation Bill , research ActiveState published on October 20, 2026 with Moving Horizon, surveyed 307 security, governance, platform, and engineering leaders at enterprises with 1,000 or more employees. Its finding is uncomfortable for anyone who sits on an audit committee. The downstream cost of AI-assisted development is real, it is spread across engineering, operations, compliance, and security, and each team pays its share out of its own budget. Engineering's share is one line on the bill Start with the line that is easiest to count. Engineers spend at least 139 hours a year, more than 17 working days, fixing or revisiting AI-assisted develop...

By Shane Warden, Principal Architect, ActiveState Someone tried it on October 17 On October 17, 2026, an Amazon honeypot logged an exploit attempt against PHP2Shell, a pair of critical remote code execution bugs in PHP tracked as CVE-2026-109618 and CVE-2026-109619. The PHP project shipped a fix on October 21 at 14:00 UTC. Between roughly 02:00 and 08:00 UTC that morning, AWS saw more attempts from several anonymized sources. After the release, new exploits hit its sensors within hours. [2] AWS doesn't know how the October 17 actor found the exploit early. I don't either, but I do know that the disclosure and solution arrived in a world with attacks already underway. What broke, and what to do now Both bugs live in PHP's memory management and error handling code, which broadens the risk. On Apache with mod_php, CVE-2026-109618 fires on an unauthenticated request before any application code runs. The PHP Foundation also confirmed remote code execution on PHP-FPM through appl...

By Pablo Bleck, Manager, Tools & Infrastructure, ActiveState Say a coding agent opens a pull request on a Thursday afternoon. It was asked to fix a flaky test, and along the way it bumped one direct open source dependency. The manifest diff is one line. The lockfile diff runs to several hundred, and somewhere inside it, a transitive package nobody on the team has evaluated entered the build. CI goes green. A reviewer approves the source change. The new package ships with the next release. Every check in that pipeline did its job. None of them was built to answer the question that matters here: did anyone choose this package? When a developer typed the install command, that person owned the choice. When an AI tool proposes the change, the choice has no owner unless your pipeline assigns one. Key takeaways A green CI run on a dependency pull request confirms the build, the tests, lockfile consistency, and that no known advisory or denied license matched. Whether anyone chose the pac...

(MLflow, CVE-2026-64849, August 2026) By Pablo Bleck, Engineering Manager & Software Engineer, ActiveState MLflow shipped its webhook API open by default across a platform with more than 30 million monthly downloads, and a CISA listing turned that unauthenticated endpoint into a 14-day deadline. The questions that would have caught it earlier are the ones most PR reviews skip under deadline pressure. TL;DR CISA added CVE-2026-64849, an unauthenticated SSRF bypass in MLflow's webhook system, to its Known Exploited Vulnerabilities catalog, landing it in BOD 26-04's 14-day remediation tier for federal agencies. MLflow's default tracking server configuration shipped the webhook API open by default, part of a platform with more than 30 million monthly downloads; the flaw let attackers reach internal, loopback, and cloud-metadata endpoints and steal cloud credentials, including AWS IAM keys. MLflow 3.15.0 fixes the flaw, but the patch is the easy part; the expensive part is ...

  CISA's 2026 SBOM Minimum Elements Update Turns "We Have One" Into the Wrong Answer TL;DR CISA's updated SBOM minimum elements now explicitly cover AI products alongside conventional, open source, and software-as-a-service products. New required fields include component hashes, licenses, SBOM-generation context, and the name of the tool used to produce it. Close to 30% of code shipping today is AI-generated, and that pace outruns any manual process built to review a bill of materials by hand. An SBOM built to the prior minimum elements no longer supports the same "we have one" answer in a board meeting, an audit, or a filing. The open question is whether an SBOM would hold up if someone with subpoena power read it, not merely whether one exists. A CFO reading a disclosure document asks whether it still matches the standard the market expects of it, not whether it matched that standard on the day it was filed. A CISO reading a software bill of materials asks...

Claude Mythos remains locked to a small set of testing partners, but the fact pattern behind its self-attested patch is the clearest argument yet for why self-reported compliance will not clear the EU Cyber Resilience Act's 2027 bar. TL;DR Claude Mythos remains restricted to vetted partners under Project Glasswing; Claude Fable 5 is the deliberately weaker sibling that reached the public in June. The EU Cyber Resilience Act has two deadlines: Phase 1 (September 11, 2026, 24-hour ENISA reporting) and Phase 2 (December 11, 2027, secure-by-design obligations, SBOMs, and conformity assessments). Most compliance planning stops at the first. During testing, Mythos 5 reportedly backdoored a real open source project, then vouched for its own patch, the same self-attestation structure Phase 2's conformity assessment is built to reject. Phase 2's exemption for products already on the market is narrower than it looks: any new product unit shipped after December 11, 2027 must comply in...