TMCnet News
Eclipse Foundation and OWASP Join Forces to Strengthen Open Source Security and CRA ReadinessBRUSSELS and WILMINGTON, Del., July 30, 2026 (GLOBE NEWSWIRE) -- The Eclipse Foundation, one of the world’s largest open source software foundations, and the Open Worldwide Application Security Project (OWASP), a global nonprofit foundation dedicated to improving software security, today announced a Memorandum of Understanding (MoU) to strengthen open source security and support industry readiness for the European Union’s Cyber Resilience Act (CRA). The agreement combines the Eclipse Foundation’s expertise in open source governance, industry collaboration, and regulatory readiness with OWASP’s globally recognised security projects, standards, education, and community. The organisations will develop resources to help open source maintainers, stewards, manufacturers, and software teams strengthen security practices and respond to evolving regulatory requirements. “Open source is critical digital infrastructure, but responsibility for securing it is distributed across a complex global ecosystem,” said Mike Milinkovich, executive director of the Eclipse Foundation. “With AI accelerating both software development and vulnerability discovery, and the first CRA obligations taking effect in a matter of weeks, the need for practical, coordinated action is increasingly urgent. By bringing together the expertise and communities of the Eclipse Foundation and OWASP, we can reduce fragmentation and help organisations put stronger security and regulatory readiness practices into action.” The CRA introduces mandatory cybersecurity requirements for products with digital elements made available in the EU, including products built with or dependent on open source software. Its vulnerability and incident reporting obligations for manufacturers take effect on 11 September 2026, requiring organisations to establish the processes and technical capabilities needed to identify, manage, and report serious security issues. The regulation also formally recognises open source software stewards as important participants in the software supply chain. Although their responsibilities differ from those of commercial manufacturers, stewards will play an important role in supporting secure development, vulnerability management, transparency, and cooperation across the open source ecosystem. “Security guidance only makes a difference when developers, maintainers, and organisations can put it into practice,” said Andrew van der Stock, executive director of the OWASP Foundation. “By working with the Eclipse Foundation, we can extend the reach and impact of OWASP’s security expertise while giving open source communities clearer, more actionable ways to strengthen the software supply chain and prepare for the CRA.” Although the CRA is a European regulation, its implications extend globally. Any organisation that makes software-enabled products available in the EU must understand its responsibilitie, including how it develops, integrates, documents, maintains, and secures the open source components on which those products depend. With more than 96% of commercial codebases containing open source software, according to the OpenLogic 2026 State of Open Source Report, CRA readiness is an urgent consideration across the global software industry. Under the MoU, the Eclipse Foundation and OWASP intend to collaborate across five principal areas:
Initial priorities are expected to include practical guidance for open source stewards, joint CRA readiness webinars, resources supporting software bill of materials (SBOM) adoption and software supply chain security, and community events, workshops, and maintainer roundtables. The two organisations also participate jointly in the Eclipse Foundation’s Open Regulatory Compliance Working Group (ORC WG), which brings together open source foundations, global enterprises, and industry stakeholders to develop practical resources for navigating the growing impact of software regulation on open source. The organisations do not intend to create competing security frameworks. Instead, they will work to align and amplify existing initiatives, improve adoption, and help organisations embed sustainable security and regulatory readiness practices across the software lifecycle. For more information about the Eclipse Foundation’s work on open source regulatory compliance, visit orcwg.org. To learn more about OWASP’s community-led software security projects, standards, and educational resources, visit owasp.org. About OWASP About the Eclipse Foundation Media contacts: 514 Media Ltd (France, Italy, Spain) Nichols Communications (Global Press Contact) 
|
