OpenSSF Community Day Europe 2026

OpenSSF Community Day Europe 2026

Congress Hall Foyer

07:30 • Registration + Badge Pick-up

South Hall 3A

10:30 • SCORED Opening Remarks
10:40 • Ghost In The Codebase - Why Your LLM Needs a SCA/SAST Babysitter - Luca Galli, Open Systems AG
11:02 • The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort - Aleksandr Churilov, Independent Researcher
11:22 • SandScope: A Behavioral Audit Layer for MCP Tools in LLM Agent Supply Chains - Zhuoran Tan, University of Glasgow
11:42 • Librarian Catches Thief: Surfacing Supply Chain Attack Campaigns via Document Similarity in an AI Agent Skill Registry - Gale Fagan, Brightflag
12:02 • When Models Meet Loaders: Deserialization Risk in Huggingface - Xiang (Shawn) Guo, Victoria University of Wellington
12:22 • SoK: What Software Supply Chain Security Can Learn from Decades of Physical Supply Chain Risk Management - Linus Kühl, FH Münster
13:55 • Canary in the Code Mine: Predictive Risk Scoring for Open-Source Supply Chain Security - Timothy Brennan, Raytheon
14:17 • No Snake Oil: Verifying Python Package Builds - Jens Dietrich, Victoria University of Wellington
14:37 • Hurry Up and Wait: Malware Detection Timelines and Minimum Release Age for npm - Dominic Tassio, University of Kansas
14:57 • Did You Forkget It? Detecting One-Day Vulnerabilities in Open-source Forks With Global History Analysis - Romain Lefeuvre, IRISA, Inria
15:45 • Software Dark Matter: Gazing at Uncharted Files to Navigate SBOM Integrations - Abhishek Reddypalle, Purdue University & Dennis Roellke, Bloomberg
16:04 • When Dependencies Become Lemons: A Multivocal Review of Cheap Trust Signal Collapse in the Software Supply Chain - Ranindya Paramitha, North Carolina State University
16:23 • Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation - Aman Sharma, KTH Royal Institute of Technology
16:42 • When SBOMs Differ: A Large-Scale Empirical Study of Generation, Dependency Structure, and Regulatory Alignment - Lukas Gehrke, Technical University of Munich
17:01 • Mind the Gap: How SBOM Specification Ambiguities Lead to Divergent Software Bills of Materials. An Empirical Tool Study - Philippe Boinot, ANSSI; Olivier Zendra & Alan Prado, Inria Rennes
17:20 • Over the Shoulder: Improving SBOM Accuracy by Watching the Build - Sanchit Sahay, New York University

South Hall 3B

South Hall 3C