01 · Maintain
Agentic workflows
Agents do the maintenance work that overloaded maintainers can’t.
- Triage vulnerability reports
- Write and update patches
- Build and test every fix
Project POSSUM · Public Goods Foundation
Securing open source software, at AI speed and scale.
Prosperous Open Source Software Universe Maintenance
AI has democratized and accelerated the ability to find and exploit vulnerabilities. POSSUM is a public good that patches open source, ships fixes through a secure registry, and notifies the vulnerable.
The signal · CVEs over time2000s → 2026
Before
Finding zero-days took elite, well-funded teams.
Now
Frontier models find and exploit them autonomously, for anyone.
§ 01 · The Problem · Case Study
Why it’s getting worse.
Three structural failures, seen through a real example: the PHP2Shell vulnerability (Oct 2026), and how POSSUM would have changed the outcome.
| The problem | PHP2Shell · what happened | With POSSUM |
|---|---|---|
Capacity Maintainers can’t absorb 100× more reports. Open source maintainers are underpaid and under-resourced. AI discovery efforts like OpenAI Daybreak and Anthropic’s Project Glasswing deepen the bottleneck. | Coverage The PHP Foundation only released patched versions of PHP 8.2–8.5. Widely used versions were left out.Patched · 52% No patch · 40% Share of PHP sites by version | Coverage POSSUM picks up where maintainers leave off, backporting fixes to widely deployed versions with AI coding agents. |
Distribution Fixes aren’t reaching the masses fast enough. Enterprise security products are expensive, and the package registries everyone uses have limited built-in security. | Early resolution The original flaw was discovered in 2024, but wasn’t prioritized because no exploit was known yet. | Early resolution AI agents cut the cost of fixing known vulnerabilities, so there’s no need to wait for an exploit. |
Disclosure Today’s security practices are broken. Secret embargo periods don’t work when anyone can discover the same vulnerability in parallel. | Rapid response The vulnerability leaked on Oct 20, before fixes were released. | Rapid response The POSSUM secure registry can rapidly distribute known mitigations before a full fix is available. |
§ 02 · Product · Patch
How we ship fixes.
A secure registry rapidly responds in a security crisis.
02 · Govern
Secure registry
Security is built into the registry itself.
- Secure builds
- Cooldown periods
- Malware scanning
03 · Respond
Rapid distribution
Fixes reach users fast, even before upstream ships.
- Mitigations before a full fix
- Backports to widely used versions
- Drop-in for npm, pip and cargo
§ 03 · Product · Monitor
How we notify the vulnerable.
We find vulnerable versions in proprietary code without waiting on first-party cooperation.
01
The open Internet
Websites, packages and binaries.
02
Index
Find proprietary software running across the Internet.
03
Classify
Per-language detection models: C/C++, JS, Rust, Python, Java.
04
Detect
Discover outdated open source code, without source access.
05
Patch
Findings feed the Patch pipeline.
§ 04 · Landscape
Securing the economy with partners.
| Category | What they provide | What they get in return |
|---|---|---|
01 Package managers | Distribution channels to every developer | Hardened, more secure packages for their users |
02 Enterprise security products | Detection techniques, vulnerability findings and hardened artifacts | Collaborative distribution with package managers |
03 AI models for security | AI analysis and patching capabilities | Secure defaults for coding agents |
▸ Our roleA public good that secures open source for everyone, working with these partners.