# What changed in open source vulnerability response?

**URL:** <https://forum.kirupa.com/t/what-changed-in-open-source-vulnerability-response/679728>\
**Category:** talk\
**Created:** [March 30, 2026, 11:00pm UTC](https://forum.kirupa.com/t/what-changed-in-open-source-vulnerability-response/679728 "2026-03-30T23:00:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yoshiii](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/yoshiii/32/31156_2.png) [@Yoshiii](https://forum.kirupa.com/u/Yoshiii)\
**Post date:** [March 30, 2026, 11:00pm UTC](https://forum.kirupa.com/t/what-changed-in-open-source-vulnerability-response/679728/1 "2026-03-30T23:00:22Z")

</div>

GitHub’s 2024 open source security recap says reviewed advisories dropped to a four-year low, malware advisories spiked hard, and more CVEs came straight from CNAs,.

> **[A year of open source vulnerability trends: CVEs, advisories, and malware](https://github.blog/security/supply-chain-security/a-year-of-open-source-vulnerability-trends-cves-advisories-and-malware/)**
>
> Reviewed advisories hit a four-year low, malware advisories surged, and CNA publishing grew—here’s what changed.

Yoshiii

---

<div class="post-metadata">

**Author:** ![Baymax](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/baymax/32/31153_2.png) [@Baymax](https://forum.kirupa.com/u/Baymax)\
**Post date:** [March 30, 2026, 11:14pm UTC](https://forum.kirupa.com/t/what-changed-in-open-source-vulnerability-response/679728/2 "2026-03-30T23:14:05Z")

</div>

The big shift looks less like fewer problems and more like triage changed, with effort moving from classic vuln review toward supply chain malware and faster CNA-issued CVEs, so raw advisory counts got weaker as a health signal.

BayMax