Scaling Security WordPress Reinvents Protection and Apache Bolsters Infrastructure While Zephyr Expands Ecosystem

Robert Jacobi:

Good day and welcome to OCN, the Open Channels News broadcast. Today is September 16th, 2026, and I’m your host, Robert Jacobi. Today, 3 stories about open source growing up without growing closed. WordPress is rebuilding its security process for an era of AI-assisted vulnerability research. The Apache Software Foundation is putting real money and infrastructure behind the next generation of open source. And semiconductor maker GigaDevice is moving deeper into the Zephyr ecosystem. Different layers of the stack, same basic problem. Open source is being asked to operate at a scale that the original models of volunteer contribution, informal infrastructure, and slow-moving governance were never really designed for.

We lead with security. The Repository reports that WordPress has announced a new core security initiative after a major increase in vulnerability reports, much of it driven by better AI-assisted security research. The WordPress security team itself says the volume of incoming reports has risen substantially over the past year as frontier AI models have become much better at analyzing code and identifying potential vulnerabilities.

That sounds like a win. More eyes on the code should mean safer software, and it can, but there is a very practical problem. Finding a possible vulnerability is now getting dramatically cheaper. Confirming it, prioritizing it, fixing it, testing, coordinating release, and getting that release deployed are still expensive human jobs.

So WordPress is responding with what it calls the Core Security Initiative, built around 3 priorities. First, a better and more automated security release process, including stronger end-to-end testing, so fixes can ship more reliably. Second, breaking down the existing backlog of open security reports by adding more contributors and working toward getting known findings as close to zero as possible. And third, using AI on the defensive side as well, applying AI-assisted scanning and tooling to find vulnerabilities before attackers do.

That last part is the important piece. For the past couple of years, a lot of the AI and security conversation has sounded like an arms race. Attackers get AI, defenders get AI, everyone gets AI, everyone scans faster, and somehow security magically improves. But faster scanning by itself does not solve the real operational problem. If AI generates 10 times as many findings, you need a system that can absorb 10 times as much noise without missing the one report that actually matters.

This is where open source gets particularly interesting. A commercial software company can decide to hire 100 more security engineers. An open source project has to coordinate maintainers, volunteers, sponsor contributors, disclosure systems, release managers, hosting companies, and millions of site operators. WordPress powers an enormous part of the web. Its security process is effectively infrastructure. So the core security initiative is less about AI finding bugs and more about scaling the machinery around those findings. That is going to be one of the defining security questions for open source over the next few years. Not whether AI can discover vulnerabilities, but whether communities can build processes fast enough to turn discovery into actual security.

That brings us to the Apache Software Foundation. In its new fiscal year 2026 annual report, the ASF says it has now passed 10,000 committers, ending the year with 10,225 people contributing across 302 projects. That is an immense and huge community.

The more interesting part of the report is what Apache is building underneath it. The foundation is investing in trusted release infrastructure, software supply chain standards, security tooling, and responsible AI. Apache says multiple projects are now testing the second alpha phase of Apache Trusted Releases, a system designed to modernize the release process with automated policy checks, artifact verification, signatures, checksums, software bills of materials, and release attestations.

Again, well, it sounds like plumbing, and it is plumbing, but plumbing is what makes everything else work. Open source has spent decades making it easy to publish code. The next challenge is making it easier to answer basic trust questions about that code. Where did this artifact come from? Was it changed? What dependencies are inside it? Who approved the release? Can I verify what I downloaded is what the project actually intended to ship?

Apache is also putting significant resources behind AI. Its Responsible AI initiative has a stated target of $10 million, with early support including $1.5 million from Anthropic and another $250,000 from Alpha Omega, focused on sustainable open source security. The foundation is also helping advance supply chain standards including CycloneDX, Package URL, Common Lifecycle Enumeration, and VEX practices. These are not flashy announcements, but they matter because open source increasingly sits underneath critical systems that were never designed around casual trust.

Apache projects issued more than 1,700 software releases during the year. 11 projects graduated to top-level status. 10 new projects entered the Apache Incubator. That is a lot of code moving through a lot of systems, and it reinforces the largest theme today: open source is not just a licensing model or a Git repo. At this scale, it’s an operating model that needs durable infrastructure, governance, security, funding, and standards. Community over code still works, but only if the community has the tools to support the code.

Finally, open source keeps moving further down the stack. Business Wire reports that semiconductor company GigaDevice has joined the Zephyr Project as a silver member while also becoming a silver member of the Linux Foundation. Zephyr is an open source real-time operating system designed for embedded devices, the small computers inside industrial equipment, IoT systems, consumer electronics, smart home devices, wearables, sensors, and really just about everything that has a chip and needs to do something useful.

GigaDevice says it will deepen support for its GD32 microcontroller portfolio inside the Zephyr ecosystem, contribute more code upstream, and work to bring more of its MCUs into Zephyr’s mainline support. This may sound like a niche hardware story, but it points to something much bigger.

For years, embedded development was defined by fragmented vendor software, proprietary toolchains, custom operating systems, and hardware-specific development environments. It’s slowly changing. Projects like Zephyr create a common open layer across different hardware platforms. For developers, that means more portable code, more reusable tooling, and less dependence on one vendor’s proprietary software stack. For hardware manufacturers, supporting open-source ecosystems increasingly becomes part of the product strategy. The silicon is still important, of course, but a chip with weak software support can be a very expensive paperweight.

GigaDevice already provides Zephyr-related code through its GD32 GitHub repos, and the company says its engineers will continue contributing code and technical support to the wider community. The next step is upstreaming more of that work so developers can use GD32 hardware directly through the main Zephyr ecosystem rather than relying on vendor-specific forks. That’s the part worth watching. Open source becomes more valuable when it reduces friction between platforms instead of creating one more platform to maintain. And as embedded devices become more connected and more exposed, the ability to share security practices, tooling, updates, and standards across hardware vendors becomes increasingly important.

That’s our thread for today. WordPress is trying to scale security operations because AI is making vulnerability discovery dramatically faster. Apache is investing in release infrastructure, supply chain trust standards, and responsible AI because open source now supports systems that demand much stronger guarantees. And GigaDevice is moving deeper into Zephyr because the open source model is spreading all the way down into the hardware ecosystem.

3 different communities, 3 different layers of technology, but they are all confronting the same transition. Open source won because it made collaboration easier. The next phase is about making that collaboration sustainable, secure, verifiable, and scalable. The code can be open, the process around it still has to work.

And that’s OCN for September 16th, 2026. I’m Robert Jacobi. Be open and stay secure.