Open-source software is the backbone of modern digital infrastructure — yet it’s also becoming one of its weakest links. As cyberattacks grow more sophisticated, open-source ecosystems have emerged as prime targets for malicious actors. The sheer ubiquity of open-source code in commercial and enterprise software has dramatically expanded the attack surface — and defenders are now scrambling to catch up.
A sobering picture has emerged from multiple cybersecurity reports in 2024 and early 2025: open-source vulnerabilities are widespread, detection is lagging, and traditional security practices are no longer enough.
A Widening Attack Surface with Inadequate Oversight
“Open source is indispensable and dangerously neglected,” said Jason Soroko, senior fellow at certificate lifecycle management firm Sectigo. His warning is echoed by recent data: 86% of codebases contain known vulnerabilities, and the number of open-source files in applications has tripled since 2020.
This growth hasn’t been matched by adequate governance or security. Traditional package scanning tools now miss more than 20% of dependencies, particularly those introduced via AI coding assistants or unconventional build practices. The result? A growing set of blind spots that attackers are all too eager to exploit.
Soroko calls this a “mandate for proactive governance.” It’s no longer enough to scan and hope — organizations must rethink how they secure the open-source code they rely on.
Wake-Up Calls from the Field
TuxCare’s 2025 Enterprise Linux and Open Source Landscape Report offers one of the most comprehensive insights into the current state of open-source security. Among its key revelations:
-
A 25% increase in overall vulnerabilities year-over-year
-
A 12-fold increase in Linux-specific vulnerabilities
-
A steep decline in confidence in open-source supply chain security — from 23.81% to 12.31%
Michael Canavan, TuxCare’s Chief Revenue Officer, underscores the core issue: “There is a significant disconnect between the perception of risk and actual threats.” Many organizations mistakenly believe vulnerability volumes are stable — but data proves otherwise. This false sense of security undermines strategic planning, budget allocation, and incident readiness.
The Supply Chain Threat: Trust is Fracturing
Trust in the open-source supply chain is quickly eroding — and for good reason. High-profile breaches like the XZ Utils backdoor and the CrowdStrike incident, which reportedly cost Fortune 500 companies billions, have shaken confidence across the industry.
Nearly 84% of IT professionals surveyed by TuxCare were aware of the XZ incident — a figure that speaks to its impact. In response, 70% of organizations are now re-evaluating their open-source supply chain protocols.
Canavan urges a zero-trust approach: “Open source isn’t the problem. Unverified and unmanaged consumption is.” Key practices such as Software Bill of Materials (SBOM) enforcement, routine dependency audits, and source code provenance checks must become standard.
Automation Alone Is Not the Answer
Interestingly, the report also found a dramatic drop in the reliance on full automation in security — from 14.48% to 2.56%. This shift reflects a growing realization: while automation is vital, it’s not a silver bullet.
“Automation is essential, but it can’t replace judgment,” Canavan noted. Human expertise is still required to:
-
Prioritize vulnerabilities
-
Validate patches
-
Conduct meaningful incident responses
The most resilient organizations are blending automated workflows with strategic human oversight.
A New Wave of Malicious Code
Another report by application security firm Apiiro has further spotlighted the growing danger of malicious open-source code. Researchers there discovered thousands of instances of malicious code in repositories, many obfuscated to evade detection.
“Obfuscation methods evolve continuously,” said Matan Giladi, a security researcher at Apiiro. “This makes detection and separation from benign code extremely challenging.”
To address this, Apiiro released two tools now available on GitHub:
-
Semgrep Rules – Target dynamic code execution and obfuscation patterns with minimal false positives.
-
Prevent – Enforces real-time security policies on pull requests within CI/CD pipelines.
These tools are designed to identify threats earlier in the development lifecycle — not after they’ve already entered production environments.
Managing False Positives in Threat Detection
One challenge in malicious code detection is minimizing false positives — particularly when scanning for encoding and obfuscation patterns. Many legacy scanning solutions either produce overwhelming alerts or miss key threats entirely.
Giladi emphasized the importance of context-aware detection: “Most false positives come from detections of encoded data, which attackers love — but so do some outdated developer practices.”
By aligning with coding standards (like those from Google or Microsoft), organizations can reduce noise and sharpen focus on real threats.
Open Source: Ubiquitous, Yet Risky
The latest Open Source Security and Risk Analysis (OSSRA) Report from Black Duck drives home just how widespread — and potentially risky — open-source code has become:
-
86% of commercial codebases contain known open-source vulnerabilities
-
81% contain high- or critical-risk vulnerabilities
-
The average application now contains over 16,000 open-source files
-
90% of open-source components found were four years or older
-
jQuery was the most frequent offender among high-risk vulnerabilities
Perhaps most concerning: only 77% of dependencies were identifiable via package managers. The remaining 23% — often introduced through AI assistants or untracked scripts — remain dangerously invisible.
What Needs to Change — Now
Open-source software isn’t inherently insecure — but the way organizations consume and manage it often is. To meet today’s threats, businesses must:
✅ Shift from passive to proactive defense: Don’t just scan; monitor continuously
✅ Audit all dependencies, not just direct ones
✅ Treat software supply chains like physical ones: track, verify, and secure every link
✅ Use both automation and human review for optimal coverage
✅ Enforce SBOMs and zero-trust frameworks in software development pipelines
✅ Educate developers on secure coding practices and modern threats
Final Thoughts
We’ve entered a new era of software development where everything is interconnected, and every line of code is a potential attack vector. Open source powers innovation, but it also carries inherent risks when unmanaged.
From high-profile breaches to silent infections, the message is clear: we must no longer treat open-source security as an afterthought. The tools, data, and insights are available — it’s time for organizations to act decisively, rethink their strategies, and embed security deeply into their development culture.
Because in this environment, inattention is vulnerability — and vulnerability is an open invitation to attack.
