Sovereign Tech Resilience relaunches with four new services

Sovereign Tech Resilience adds four new services, memory safety transition, post-quantum readiness, supply chain security, and Cyber Resilience Act compliance, and expands two existing services. OSTIF organized security audits that uncovered an arbitrary-code-execution flaw in conda-forge and logic bugs in Rails' Active Storage that could allow unauthorized file access. The curl project ended its paid bug bounty in January 2026 over a flood of low-quality AI reports. By spring, its maintainer Daniel Stenberg reported that these had largely stopped, but that security reports were now arriving at twice the previous year's rate, and far more of them were real. In May, Linus Torvalds called the Linux kernel team's security inbox "almost entirely unmanageable." Finding bugs is getting easier; fixing them is not. For the two existing services we are increasing the number of available service providers to increase capacity and cover a wider range of programming languages and ecosystems: Sovereign Tech Resilience commissions these services from industry partners and delivers them to participating projects.