OSERA Delivers Patches and Standards for Open Source Security
News related to:OSERA · 2 min read
PRAGUE, Oct. 7, 2026 /CourierPR/ -- Within 100 days of its formation, the Open Source Enterprise Resiliency Alliance (OSERA) has made significant strides in addressing the security challenges faced by financial institutions. The alliance, backed by six Premier members including Deutsche Bank, Goldman Sachs, Morgan Stanley, NatWest, and Royal Bank of Canada (RBC), has established a new standard for securing open source software, marking a pivotal moment in the industry.
OSERA, a project of the Fintech Open Source Foundation (FINOS), aims to reduce the redundancy and cost associated with addressing security vulnerabilities in widely used open source projects. By providing a shared, open, and transparent method for identifying, fixing, and verifying these vulnerabilities, OSERA seeks to streamline the process for financial institutions, which often rely on the same open source software stacks.
In a matter of weeks, OSERA released the first version of its patching and attestation standard. This standard, developed through collaboration between financial institutions, patch producers, and open source infrastructure leaders, sets out the requirements a fix must meet before it can be trusted and used at scale. The standard enhances the consistency and confidence with which organizations can adopt fixes, thereby mitigating risks in production environments.
The alliance has already delivered secure package updates with standard attestations across more than 50 widely used open source projects in the Java ecosystem. These remediations address publicly disclosed security vulnerabilities (CVEs) and are available for immediate production usage by OSERA members. Moving forward, vendor maintainers will address newly disclosed vulnerabilities on these managed lines under a severity-based software license agreement (SLA).
Dov Katz, Managing Director and Distinguished Engineer at Morgan Stanley, and Chair of the OSERA Remediation Standards Working Group, emphasized the importance of this standard.
Looking ahead, OSERA has defined a target delivery schedule through the end of 2026. The alliance aims to produce a minimum of 80 patches per month. Under the alliance's SLA, vendor maintainer Moderne will deliver patches to a secured platform with quarantine gates, being built by open source security experts ControlPlane. Growing participation from HeroDevs, RapidFort, Sonatype, and Scott Logic will continue to develop the standardization process and accelerate production use of supported software versions.
Gabriele Columbro, Executive Director of FINOS, highlighted the importance of OSERA's approach.
To get involved, financial institutions should join as OSERA members to consume financial services-grade hardened releases. Open source infrastructure vendors should become FINOS members to actively contribute to and ultimately adopt the remediation standards, ensuring their offerings meet the financial industry's needs. Commercial maintainers and patch producers should also consider becoming FINOS members to participate in remediation standards and be eligible to become vendor maintainers under alliance SLAs.
In conclusion, OSERA's rapid progress and commitment to addressing open source security vulnerabilities underscore the industry's collective effort to enhance resilience and protect against cyber threats.