OpenSSF Community Day Europe 2026

OpenSSF Community Day Europe 2026

10:30 CEST

SCORED Opening Remarks South Hall 3A

10:40 CEST

Ghost In The Codebase - Why Your LLM Needs a SCA/SAST Babysitter - Luca Galli, Open Systems AG South Hall 3A

11:02 CEST

The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort - Aleksandr Churilov, Independent Researcher South Hall 3A

11:22 CEST

SandScope: A Behavioral Audit Layer for MCP Tools in LLM Agent Supply Chains - Zhuoran Tan, University of Glasgow South Hall 3A

11:42 CEST

Librarian Catches Thief: Surfacing Supply Chain Attack Campaigns via Document Similarity in an AI Agent Skill Registry - Gale Fagan, Brightflag South Hall 3A

12:02 CEST

When Models Meet Loaders: Deserialization Risk in Huggingface - Xiang (Shawn) Guo, Victoria University of Wellington South Hall 3A

12:22 CEST

SoK: What Software Supply Chain Security Can Learn from Decades of Physical Supply Chain Risk Management - Linus Kühl, FH Münster South Hall 3A

13:55 CEST

Canary in the Code Mine: Predictive Risk Scoring for Open-Source Supply Chain Security - Timothy Brennan, Raytheon South Hall 3A

14:17 CEST

No Snake Oil: Verifying Python Package Builds - Jens Dietrich, Victoria University of Wellington South Hall 3A

14:37 CEST

Hurry Up and Wait: Malware Detection Timelines and Minimum Release Age for npm - Dominic Tassio, University of Kansas South Hall 3A

14:57 CEST

Did You Forkget It? Detecting One-Day Vulnerabilities in Open-source Forks With Global History Analysis - Romain Lefeuvre, IRISA, Inria South Hall 3A

15:45 CEST

Software Dark Matter: Gazing at Uncharted Files to Navigate SBOM Integrations - Abhishek Reddypalle, Purdue University & Dennis Roellke, Bloomberg South Hall 3A

16:04 CEST

When Dependencies Become Lemons: A Multivocal Review of Cheap Trust Signal Collapse in the Software Supply Chain - Ranindya Paramitha, North Carolina State University South Hall 3A

16:23 CEST

Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation - Aman Sharma, KTH Royal Institute of Technology South Hall 3A

16:42 CEST

When SBOMs Differ: A Large-Scale Empirical Study of Generation, Dependency Structure, and Regulatory Alignment - Lukas Gehrke, Technical University of Munich South Hall 3A

17:01 CEST

Mind the Gap: How SBOM Specification Ambiguities Lead to Divergent Software Bills of Materials. An Empirical Tool Study - Philippe Boinot, ANSSI; Olivier Zendra & Alan Prado, Inria Rennes South Hall 3A

17:20 CEST

Over the Shoulder: Improving SBOM Accuracy by Watching the Build - Sanchit Sahay, New York University South Hall 3A