Prague – October 07, 2026 -- The Open Source Enterprise Resiliency Alliance (OSERA), backed by Deutsche Bank, Goldman Sachs, Morgan Stanley, NatWest and Royal Bank of Canada, is now fully operational just 100 days after its intent-to-form announcement, delivering patches for more than 50 widely used open source projects in the Spring and Java ecosystems. The Fintech Open Source Foundation (FINOS), the financial services arm of the Linux Foundation, disclosed the milestone at Open Source Summit Europe.
Six Premier members fund a shared patching model to cut duplicate security work
OSERA was built to address a structural inefficiency: financial institutions rely on overlapping open source stacks, often fixing the same vulnerabilities independently. Research cited by FINOS found that one in five financial institutions maintain separate internal teams running private forks of identical projects, a "fork tax" that inflates maintenance costs and technology risk across the sector.
A remediation standard shipped within three weeks of launch
OSERA published the first version of its patching and attestation standard just three weeks into operation, developed jointly by financial institutions, patch producers and open source infrastructure vendors. The standard defines the requirements a fix must meet before it can be trusted and deployed at scale across member organizations.
Dov Katz, Managing Director and Distinguished Engineer at Morgan Stanley and Chair of the OSERA Remediation Standards Working Group, said the rapid release of v0.1 demonstrated the sector's appetite to set its own bar for what a patch must prove before production use, particularly as institutions consume open source from multiple vendors and coalitions simultaneously.
Vendor maintainers now operate under severity-based SLAs for newly disclosed CVEs
The first wave of remediations covers publicly disclosed CVEs across more than 50 Spring and Java projects, with secure package updates and standard attestations available immediately for OSERA members' production use. Going forward, vendor maintainers will address newly disclosed vulnerabilities on these managed lines under severity-based software license agreements.
OSERA targets 80 patches monthly as platform build accelerates toward November
The alliance has set a delivery schedule through the end of 2026, aiming to produce a minimum of 80 patches per month. Under the SLA structure, vendor maintainer Moderne will deliver patches to a secured platform with quarantine gates built by ControlPlane, while HeroDevs, RapidFort, Sonatype and Scott Logic expand participation in the standardization process. OSERA plans to deliver its first end-to-end platform release at the Open Source in Finance Forum NY in November, a step intended to lower cost per patch and expand capacity to handle rising AI-related vulnerabilities. The alliance also plans a per-project sponsorship model allowing firms to directly fund specific dependencies alongside common-pool prioritization.
New EU rules on software resilience raise pressure for coordinated vulnerability response
Regulations including DORA, NIS2 and the EU Cyber Resilience Act are raising expectations for institutions to demonstrate repeatable vulnerability management across complex technology stacks. FINOS said OSERA's governance remains member-led under the Linux Foundation with public source code and open standards, and that institutions can adopt the service without altering existing CI pipelines or development processes.
Deutsche Bank's Peter Thomas, Managing Director and Distinguished Engineer, said initial pilots proved banks can pull hardened, standard-compliant releases through standard corporate proxies with zero friction to existing pipelines. RBC Vice President of DevOps Abe Batthish said the bank is helping lead governance of OSERA's backpatching pipelines, holding vendor maintainers to uniform standards and SLAs regardless of which firm produces a given fix.
Gabriele Columbro, Executive Director of FINOS, said OSERA converts open source resiliency from a fragmented internal burden into a collective operational capability, describing the alliance as the "regulated downstream" complement to upstream commons-security initiatives such as Akrites.