Open source grew up in a hurry, and the security bill is coming due

Key points

• Open source software, meaning code that anyone can read and change for free, now sits inside almost every business app and cloud service.
• The trust-based way maintainers hand out that code was designed for a hobbyist era, not for supply-chain attacks by organised criminals and nation states.
• The XZ Utils backdoor in 2024 showed attackers are willing to spend years posing as helpful volunteers to plant hidden doors into widely used software.
• Companies that depend on open source rarely know who wrote the code running their systems, or whether that person is still alive, let alone paid.
• The fix is boring but urgent: proper inventories of what code you use, and money flowing to the people maintaining it.

Open source had a long, lucky childhood.

For about twenty years, the volunteers who write free software could operate like a lemonade stand on a quiet street. Take what you need. Pay me back whenever. It worked because nobody with real money or real malice was paying attention.

That era is over. The failure mode here is blunt: the same trust that made open source thrive became the attack surface.

What is open source, and why should a normal person care?

Open source is software whose recipe is published for anyone to read and improve. Think of it as the free flour and yeast that almost every bakery uses. Your bank's mobile app, your hospital's booking system, the streaming service you watched last night: all of it sits on top of thousands of these free ingredients, maintained by volunteers who have often never met each other.

Most companies don't know the full list of ingredients in their own software. That is the problem.

How did the trust model break?

It broke because attackers realised the volunteers were the soft target.

The clearest example was the XZ Utils backdoor discovered in March 2024, where someone spent nearly three years pretending to be a helpful contributor on a tiny compression tool used inside Linux, the operating system that runs most of the internet's servers. Commit rights were earned slowly. Then a hidden door appeared that would have let an attacker log into millions of machines. A Microsoft engineer caught it by accident because his database was running half a second slow.

Half a second. That was the margin.

We first covered this backdoor on 7 August 2026, and the detail that keeps coming back is that the maintainer of XZ was a burnt-out volunteer who welcomed the help because nobody else was watching.

Who is exposed?

Everyone who uses cloud services, which is everyone. Amazon Web Services, Azure and Google Cloud all ship customer workloads that pull in hundreds of open source packages behind the scenes. When one of those packages goes bad, the blast radius reaches from a hospital's patient records to a supermarket's till system.

Here is the shape of the problem in plain numbers.

Fact	Figure
Time the XZ attacker spent building trust	About 3 years
Detection method for XZ	Accidental, by one engineer
Typical funding for a critical maintainer	Often zero

Oligo Security, which raised $60 million in August to watch running apps and block attacks in real time, is betting this problem is only getting worse. CISA seems to agree: its open source security playbook for federal agencies, which we covered on 30 July 2026, introduced a trust framework called C4 precisely because the old informal vetting wasn't cutting it.

Should you worry?

You can't audit the code inside your banking app. What you can do is notice which of your suppliers, your employer, your children's school, your GP surgery, actually answer questions about how they check their software. Silence is the answer you should worry about.

For companies, the operational work is unglamorous: know what is in your software, and pay the people keeping it alive.

The lemonade stand is now a utility. Time to act like it.