ActiveState @ActiveState

ActiveState enables DevOps, InfoSec, and Development teams to improve their security posture while simultaneously increasing productivity and innovation. activestate.com Vancouver, BC Joined November 2008

Tweets

15K
Followers

4K
Following

2K
Likes

3K

ActiveState @ActiveState

3 weeks ago

If a CVE lands on your team today, can you answer “are we exposed” in minutes, not days? A governed source with a contractual SLA (5 business days for critical, clock starting at upstream fix availability) turns that into a scheduled event instead of a fire drill. Worth checking before you need the answer.

0 0 0 108 0

View Details

ActiveState @ActiveState

3 weeks ago

A flaw just landed on CISA’s Known Exploited Vulnerabilities catalog. The remediation clock started the day it was listed, not the day your team got around to checking. Could you answer “are we exposed” right now, in minutes? Most teams can’t. That’s not a scanning problem. Read the full article: buff.ly/IJinydh

0 0 1 130 0

View Details

ActiveState @ActiveState

3 weeks ago

Read the full article: buff.ly/YSN4H2O

0 0 0 15 0

View Details

ActiveState @ActiveState

3 weeks ago

319 of 639 packages carried it in May. 111 days dormant. Then it resurfaced in four new packages, straight past npm's own malware scanner. Same week: CVE remediation across 21 major vendors got slower, not faster. Link below for the full article

1 0 0 121 0

View Details

ActiveState @ActiveState

4 weeks ago

Famous last words right before production goes down on a Friday at 5PM 🙃

0 0 0 102 0

View Details

ActiveState @ActiveState

4 weeks ago

Anthropic, Google, and OpenAI's coding-agent tooling has critical flaws sitting in the permission and sandboxing code wrapped around it, not in the models themselves. Jonny Rivera on why the wrapper is the attack surface, not the agent: buff.ly/uUuJ1Om

1 0 1 92 0

View Details

ActiveState @ActiveState

4 weeks ago

@ComputerWeekly Read the full conversation on where open source security is headed, and what actually closes the gap: buff.ly/tHcXeex

0 0 0 9 0

View Details

ActiveState @ActiveState

4 weeks ago

@ComputerWeekly Open source is in 98% of the software running today. Her read on why that finally matters: 'I'm hoping people are standing up and paying attention now, with just the pure number of attacks on the software supply chain that we've seen.'

1 0 0 18 0

View Details

ActiveState @ActiveState

4 weeks ago

Why did open source security stay an afterthought for so long? Our CEO Abby Kearns has an answer: 'It's a shortcut we were all happy to live with.' Via Alex Scroxton at @ComputerWeekly

1 0 0 68 0

View Details

ActiveState @ActiveState

4 weeks ago

Full breakdown from Rebecca Banks: buff.ly/QSCXHRU

0 0 0 8 0

View Details

ActiveState @ActiveState

4 weeks ago

The fix: govern what comes in before it becomes next quarter's maintenance backlog, not slow AI down trying to catch up after the fact. Full breakdown in the reply below. Where does this show up first on your team: the roadmap, the backlog, or a Slack thread nobody's resolved yet?

1 0 0 12 0

View Details

ActiveState @ActiveState

4 weeks ago

AI-assisted engineering teams: 63% say their scope grew in the past year. 45% are working longer hours. Both numbers point to time spent maintaining code that's already shipped, not time spent writing it.

1 0 0 92 1

View Details

ActiveState @ActiveState

a month ago

Today, the EU Cyber Resilience Act's Article 14 obligations become enforceable. If you sell products with digital elements into the EU, you now have 24 hours to report an actively exploited vulnerability from the moment you know, even in products that shipped years ago. A scanner report sitting in a dashboard isn't a compliance answer. A defined, auditable process is. Non-compliance sits in the CRA's highest penalty tier: up to €15 million or 2.5% of global annual turnover, whichever is greater. December 2027 is the deadline everyone's watching. Today is the one that just quietly became real. Start closing the visibility gap now. Read the release: buff.ly/LV9lylc

0 0 2 64 0

View Details

ActiveState @ActiveState

2 months ago

Today is International Women in Cyber Day 🎉 At ActiveState, these 17 women are building, innovating, and driving our team forward every single day. To our team, partners, and community: Drop a comment below to tag and celebrate the ActiveState women who’ve made an impact on your work. 💙 #InternationalWomeninCyberDay

0 0 0 87 0

View Details

ActiveState @ActiveState

2 months ago

"Open source is really having a bit of an existential crisis," says Abby Kearns, ActiveState CEO, in a new @computerweekly interview. AI agents pulling packages, developers choosing convenience over scrutiny, governance treated as a compliance checkbox. The conversation has to change, from scan-and-alert to actually managing risk. Read the full piece: buff.ly/h04y022

0 0 0 76 0

View Details

ActiveState @ActiveState

2 months ago

Scoping your migration? We wrote up what changes on October 22, the options, and the question most teams skip: buff.ly/vNuWkuA

0 0 0 15 0

View Details

ActiveState @ActiveState

2 months ago

We surveyed 250 DevSecOps leaders: 83% named outdated base images as the root cause of their most recent vulnerabilities. 90% are still running lightly modified public images with little to no hardening. We wrote about this gap in June 2025.

1 0 0 17 0

View Details

ActiveState @ActiveState

2 months ago

Minimus is shutting down. The founders built Twistlock before this, and John Morello wrote NIST SP 800-190. A 60-day maintenance window and refunds for enterprise customers is a more graceful exit than most vendors manage. An open letter to their customers (a thread):