OpenSSF Community Day Europe 2026

On 8 Sept 2025, one phishing email hijacked a maintainer's npm account and pushed malicious versions of chalk, debug and 16 other packages totalling 2.6B weekly downloads. When such a package breaks something that hurts someone, who pays?
Two EU laws finalised in 2024 shape the answer, the Product Liability Directive and the Cyber Resilience Act, and their duties phase in across 2026 and 2027. So we go hands-on: we take this real compromise and walk it, step by step, down the liability chain. The maintainer, it turns out, is the one the law works hardest to shield as non-commercial open source sits largely outside both regimes. The bill lands downstream, on the commercial manufacturer who ships debug inside a product. Under the PLD, a missing security update can itself be a defect, under strict liability. The CRA adds a second layer since it lays a duty on to manage exactly this kind of vulnerability - detect it, report it, patch it - backed by fines, while the "open-source steward" carries a lighter, fine-free load.

As of Sept 11, 2026, the EU CRA mandates short-window reporting for actively exploited vulnerabilities to ENISA. Yet, Linux Foundation research shows 66% of the ecosystem remains unprepared, risking expensive "private forking" traps.

Hosted by the OpenSSF Global Cyber Policy WG, this 75-minute interactive workshop shifts the conversation from abstract legal theory to operational realities a lot of us are facing right now. Following a short briefing, the core 1-hour session unites enterprise engineers, security officers, stewards, open source developers and layers in collaborative 3 breakouts to stress-test real-world CRA challenges. Topics include: governance, open source particularities and CRA personas across varying PDE classifications, as well as secure-by-design mandates, risk assessments, due diligence, SBOMs, vulnerability management and reporting obligations. We conclude with a 15-minute synthesis of mapping live insights directly to OpenSSF roadmap and our work for the upcoming quarters.

Whether you are an enterprise architect trying to keep your product compliant, a steward, or an upstream developer, this workshop offers to tackle your specific use cases.