When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
The Data Drop's report on open-source maintainers identifies that having only one or two sets of eyes on critical pieces of software means that sooner or later something breaks — and it tends to do so in spectacular fashion, given its ubiquity. So, what happens when these projects, which are widely used across software, go underfunded or understaffed?
In 2014, the same year as Heartbleed, Shellshock made waves: a vulnerability in the Bash shell that's present in Linux, macOS, and Unix-type systems. The problem was traced back to a line of code present since 1989, displaying how even software that's thought to have all the bugs hammered out of it can still fall prey to attacks. A quick look at Bash's commit history shows it's almost exclusively maintained by Chet Ramey.
In 2016, ImageMagick was exploited, providing attackers with remote code execution. This library is used for image manipulation across a wide range of software, in webpages, mobile apps, and more. A 2020 analysis revealed that hundreds of security issues had been found over the years in its extensive codebase. Nearly every code contribution in the past couple of years has been done by an individual named Dirk Lemstra .
Contemporary examples include 2021's Log4Shell exploit, a critical vulnerability in the Apache Log4j logging library used in millions of servers. The libwebp image-handling library saw a zero-day vulnerability in 2023, and the xz compression library used across Linux and iOS was compromised in 2024.
Linux kernel nears record 2,000 vulnerabilities per release as AI bug hunters scour 40 million lines of code
Google freezes open-source bug bounty program amid flood of invalid AI slop submissions
Researchers easily trick Fortune-500 companies' AI agents into running arbitrary code — supply-chain attack via llms.txt guidance file illustrates how data has become code
Key points in the report mention specific repos, which might be under threat. Somewhat unsurprisingly, the low number of overall maintainers and the unpaid nature of the work make it unattractive to perform.
The main time-zone file used across Linux-based operating systems is maintained pro bono by Paul Eggert, a UCLA teacher. Core-js, a piece of support software that lets new JavaScript work in old browsers and is estimated by the author to be used in half of the busiest websites in the world, is handled by Denis Pushkarev. He once had to endure criticism from the community because he added a command-line message to the library's installer asking for help or a job.
The HarfBuzz library developed by Behdad Esfahbod is a cornerstone in ligatures and text shaping in Middle Eastern languages. In those writings, a letter changes shape and/or orientation according to what's around it. Esfahbod handles that vast majority of the project's code, and doesn't mention public or corporate funding.
Libjpeg-turbo handles JPEG images on Android, Firefox, LibreOffice, and every Chromium-based browser. It's kept ship-shape by D.R. Commander aka DRC, who occasionally is contracted for library-specific work , though at arguably modest values of "3-4 figures rather than 6 or 7." Libxml2, just like the label says, handles XML reading and writing across numerous applications and operating systems. Nick Wellnhofer, the original maintainer, stepped down in September 2025, after years of work with little income.
The SQLite project provides a one-file database that's exceedingly easy to integrate into most software, instead of complicated, resource-heavy databases, while still retaining standard SQL language and accouterments. Thanks to its ease of use, it found its way into an astonishing number of applications. Examples include WhatsApp, Dropbox, Android, Windows, and all major browsers.
Hacker turns 25 cents into 46 billion fake Bitcoins to steal $770,000
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/modern-software-is-built-on-the-backs-of-low-paid-maintainers-opening-the-door-to-potential-threats-report-details-critically-underfunded-projects-that-remain-understaffed-or-unfunded#main
- https://www.tomshardware.com/my-account
- AMD and Intel will work together to create a single PyTorch code path for AI inference on CPUs
- You can now modify the vBIOS on Nvidia gaming GPUs without flashing thanks to a solo developer’s project
- NVIDIA Advances Agentic Security for Media, From European Public Service Broadcasting to Global Content Production
- US restarts three shut-down nuclear reactors to feed AI data centers
- Electronics hobbyist converts $120 DDR5 SODIMM kit into ‘$1000’ desktop kit to fight RAM crisis
Informational only. No financial advice. Do your own research.