OpenSSF Community Day Europe 2026

OpenSSF Community Day Europe 2026

07:30 CEST

Registration + Badge Pick-up Congress Hall Foyer

09:00 CEST

Keynote: Welcome & Opening Remarks - Steve Fernandez, OpenSSF General Manager, The Linux Foundation South Hall 3B

09:10 CEST

Keynote Sessions To Be Announced South Hall 3B

09:25 CEST

Keynote: Who Funds the Toolchain? Secure Infrastructure for GLIBC and the GNU Toolchain - Kris Borchers, Senior Technical Program Manager, OpenSSF & Carlos O'Donell, Distinguished Engineer, Red Hat South Hall 3B

09:45 CEST

Keynote Sessions To Be Announced South Hall 3B

10:00 CEST

Break South Hall 3C

10:30 CEST

SCORED Opening Remarks South Hall 3A Who Pays When Debug Breaks? Supply-Chain Liability Under the CRA and the Product Liability Directive - Annika Kristin Niemann, iRights.Law Rechtsanwälte South Hall 3B

10:40 CEST

Ghost In The Codebase - Why Your LLM Needs a SCA/SAST Babysitter - Luca Galli, Open Systems AG South Hall 3A

10:55 CEST

Preparing for the Vulnpocalypse: Using OSS-CRS To Find and Fix Bugs Before They Find You - Jeff Diecks, OpenSSF; Laura Guazzelli, Linux Foundation & Andrew Chin, Georgia Institute of Technology South Hall 3B

11:02 CEST

The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort - Aleksandr Churilov, Independent Researcher South Hall 3A

11:20 CEST

Defending Bare-Metal: Lessons Learnt From AI Security Analysis of Metal3 and OpenStack Ironic - Dmitry Tantsur, Red Hat & Tuomo Tanskanen, Ericsson Software Technology South Hall 3B

11:22 CEST

SandScope: A Behavioral Audit Layer for MCP Tools in LLM Agent Supply Chains - Zhuoran Tan, University of Glasgow South Hall 3A

11:42 CEST

Librarian Catches Thief: Surfacing Supply Chain Attack Campaigns via Document Similarity in an AI Agent Skill Registry - Gale Fagan, Brightflag South Hall 3A

11:45 CEST

From First PR To Hardening Guide: Structured Security With Gemara - Hannah Braswell, Red Hat South Hall 3B

12:02 CEST

When Models Meet Loaders: Deserialization Risk in Huggingface - Xiang (Shawn) Guo, Victoria University of Wellington South Hall 3A

12:05 CEST

The SLSA Tooling Cake - Adolfo García Veytia, Carabiner Systems South Hall 3B

12:22 CEST

SoK: What Software Supply Chain Security Can Learn from Decades of Physical Supply Chain Risk Management - Linus Kühl, FH Münster South Hall 3A

12:25 CEST

One Scan To Rule Them All: Towards Shared Open Data Infrastructure - Philippe Ombredanne, AboutCode & Stephen Augustus, Bloomberg South Hall 3B

12:40 CEST

Lunch South Hall 3C

13:55 CEST

Canary in the Code Mine: Predictive Risk Scoring for Open-Source Supply Chain Security - Timothy Brennan, Raytheon South Hall 3A Operationalizing the CRA and Shaping OpenSSF’s Community Roadmap - Roman Zhukov, Red Hat; Daniel Appelquist, Samsung Electronics; Madalin Neag, OpenSSF; Megan Knight, Arm South Hall 3B

14:17 CEST

No Snake Oil: Verifying Python Package Builds - Jens Dietrich, Victoria University of Wellington South Hall 3A

14:30 CEST

GAME SHOW!! GAME SHOW!! Part Dva!! - Adrianne Marcum, Linux Foundation & Christopher Robinson, OpenSSF South Hall 3B

14:37 CEST

Hurry Up and Wait: Malware Detection Timelines and Minimum Release Age for npm - Dominic Tassio, University of Kansas South Hall 3A

14:55 CEST

When Maintainers Move On: Detecting and Communicating Abandoned Open-source Projects - Felix Lange, SAP SE South Hall 3B

14:57 CEST

Did You Forkget It? Detecting One-Day Vulnerabilities in Open-source Forks With Global History Analysis - Romain Lefeuvre, IRISA, Inria South Hall 3A

15:15 CEST

Break South Hall 3C

15:45 CEST

Software Dark Matter: Gazing at Uncharted Files to Navigate SBOM Integrations - Abhishek Reddypalle, Purdue University & Dennis Roellke, Bloomberg South Hall 3A The Kernel Does Not Negotiate: Building the Tooling To Say No To AI Agents - Sal Kimmich, NoLabs South Hall 3B

16:04 CEST

When Dependencies Become Lemons: A Multivocal Review of Cheap Trust Signal Collapse in the Software Supply Chain - Ranindya Paramitha, North Carolina State University South Hall 3A

16:10 CEST

Verifiable AI Provenance: Closing the Attestation Gap in the Machine Learning Supply Chain - Sheng Sun, Dell & Sarah Evans, Dell Technologies South Hall 3B

16:23 CEST

Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation - Aman Sharma, KTH Royal Institute of Technology South Hall 3A

16:30 CEST

Applying VEX To Vulnerability Information Sharing in Multi-tier Automotive Supply Chains - Yuta Kiyoumi, Honda Motor Co., Ltd. & Akihiko Takahashi, Fujitsu South Hall 3B

16:42 CEST

When SBOMs Differ: A Large-Scale Empirical Study of Generation, Dependency Structure, and Regulatory Alignment - Lukas Gehrke, Technical University of Munich South Hall 3A

16:50 CEST

Securing Africas Open Source Ecosysetm: Community Health, Building Trust, Resilient, Sustainable Software - Ejiro Oghenekome, Independent; Victoria Ottah, Accessibility Nigeria ; Sal Kimmich, NoLabs; Christopher Robinson, OpenSSF; Amir Montazery, OST... South Hall 3B

17:01 CEST

Mind the Gap: How SBOM Specification Ambiguities Lead to Divergent Software Bills of Materials. An Empirical Tool Study - Philippe Boinot, ANSSI; Olivier Zendra & Alan Prado, Inria Rennes South Hall 3A

17:20 CEST

SBOMs Are Useless Without Discoverability - Mario Fahlandt & Koray Oksay, Kubermatic South Hall 3B Over the Shoulder: Improving SBOM Accuracy by Watching the Build - Sanchit Sahay, New York University South Hall 3A

17:35 CEST

Keynote: Closing Remarks - Steve Fernandez, OpenSSF Managing Director, The Linux Foundation South Hall 3B