My retirement day job is looking after the security committee at Apache Software Foundation. So if you're interested in how we're coping after going from getting 50 vuln reports a month to over 800 (yeah those extra 750 are AI) come say hi at #emfcamp (I'll mention it briefly in my Sun talk too, but the talk has nothing about vulnerabilities, security, Apache, or Heartbleed).
@iamamoose *nods^ suddenly seeing 2-3 reports a week on an Eclipse project I was involved with ~20 years ago. 😭
Jul 13, 2026, 8:44 PM@iamamoose are these real vulnerabilities that are being discovered? Are they redundant?
@ben they're mostly rubbish. A large number are things that are outside the threat model, repeats. We do get the odd real issue, but those are usually low severity. Stats on the percentage of that peak last month are a bit delayed as triage takes a while, but we'll give all the stats eventually.
@iamamoose Mark, you said "outside of the threat model". Is that threat model documented anywhere? I ask because I think the threat model could be used to filter security issues and I would like to see Apache's
@florenciocano right! That's actually part of the solution. Each project is responsible for creating their own threat model and we've been working with them to ensure they're published and llm-findable, not just from a list on security.apache.org but in SECURITY.md files etc
@florenciocano @iamamoose are the threat models seeing many updates to reflect the AI situation?
Also sorry to have missed the talk despite being there - was it recorded?