FOSS stands for Free and Open Source Software. In FOSS projects, the source code is publicly available, and users can inspect, modify, and redistribute it under an open license. Development is often community-driven, with maintainers reviewing external contributions from volunteers, companies, and automated tools.
FOSS matters in cybersecurity because openness improves auditability, but it also creates a large trust surface. Attackers may target maintainers, issue trackers, dependency updates, or pull requests instead of the code itself. That is why software supply chain defenses for FOSS include code review, signed releases, contributor verification, dependency pinning, and provenance checks. In attacks, FOSS can be abused through malicious commits, typosquatting packages, or social engineering that persuades a maintainer to merge harmful changes. In defenses, the same openness helps defenders spot suspicious activity faster and harden the project’s review process.