Linux Foundation Report Reveals Why Companies Fork Open Source Projects and Maintain Internal Patches
A recent Linux Foundation Research survey of 567 specialists examines how organizations handle modifications to open source components they depend on. The February report titled ROI for Open Source Software Contribution reveals that companies rarely leave external code untouched once it enters production systems.
Many teams add missing functionality, improve integration with internal systems, or accelerate security fixes that upstream maintainers cannot deliver on schedule. Some of these changes are contributed back, while others remain in long-lived private branches. The study focuses on practical patterns of contribution, forking, and the resulting security and maintenance challenges.
Survey Participants and Methodology
The research was conducted in October and November 2025 among subscribers, participants, and partner communities of the Linux Foundation. After validation, 567 respondents remained. Participants averaged 12 years of open source experience and 14 years in IT overall. Developers, engineers, and architects made up 28% of the sample, while 19% worked in systems administration and infrastructure.
Company sizes varied: 29% from organizations with fewer than 250 employees, 31% from mid-sized firms (250–4,999), and 40% from enterprises with 5,000 or more staff. Fifty-one percent represented IT vendors, 35% came from non-IT businesses, and 14% worked in government, non-profit, or educational institutions.
Contribution Patterns and Forking Practices
Seventy-two percent of organizations that use open source also contribute to it. Contributions extend beyond code to documentation, testing, user support, event organization, and project governance. Technical changes show clear business motivations: organizations most often fix components their products already rely on, yet a substantial share also implement new features.
Common working models include using components unchanged (68%), returning patches upstream (49%), maintaining internal forks (45%), hiring external specialists (28%), and participating in project governance (26%). Many organizations apply different strategies to different components.
Reasons for Internal Forks
Among 238 respondents who answered questions about forking, 54% cited development of proprietary features and 44% mentioned integration with internal systems. Security fixes and regulatory requirements were noted by 37%. Additional drivers included slow or abandoned upstream projects (34%), bug fixes (32%), faster release cycles (29%), quality and stability concerns (28%), performance optimization (25%), and license compatibility (18%).
The average organization maintains 86 internal forks, spending 60 hours on each per release cycle. Larger companies show significantly higher numbers: enterprises with 5,000+ employees average 136 forks and 11,152 total hours per cycle.
Security and Supply-Chain Implications
Internal forks create new vulnerability management challenges. A private security patch may leave the component appearing vulnerable in standard scanners if the public version number is retained. Conversely, a fork may miss subsequent upstream fixes. Proper tracking requires recording the exact upstream commit, the list of internal patches, and an owner responsible for synchronization.
The report also shows the largest gaps between business-critical technologies and actual contributions in programming languages and runtimes (53% critical vs 17% contributing), databases (56% vs 25%), and operating systems (59% vs 29%). Thirty-six percent of respondents reported frequent product delays due to missing features or fixes, rising to 54% among the largest organizations.
Active participation yields measurable benefits: 44% of contributors frequently secure desired features in project roadmaps, 55% receive faster responses on bugs and security issues, and 66% report accelerated product development. The study underscores that sustained engagement with upstream projects reduces long-term technical debt when internal branches would otherwise become permanent, untracked products.
Related articles
PyPI Explores Prefix Reservation for Organizations Under PEP 752 to Prevent Name Squatting
PEP 752 proposes reserving package name prefixes for organizations on PyPI, allowing control over entire families of related package names rather than individual entries. The change addresses dependency confusion and name squatting risks where attackers register packages with familiar prefixes like google-cloud- or opentelemetry- to exploit user trust. Analysis of over 800,000 PyPI projects by CodeScoring shows that prefixes are rarely controlled by a single owner, with ecosystems like aws- managed by hundreds of accounts. The proposal introduces implicit namespaces and new metadata for clients and proxies while preserving the flat namespace model familiar to Python developers. PEP 755 will define the governance process for granting prefix rights, limiting applications to organizations and requiring clear justification. Existing packages receive backward compatibility exceptions, and the mechanism does not transfer across repositories.
Suspicious Certificate Issuer Detected in MAX Messenger Windows Update Package
A detailed observation from a security researcher highlights an unexpected change in the code signing certificate for the MAX messenger desktop client on Windows. The August update package was signed by an individual named Konstantin Syomochkin instead of the usual Communication Platform LLC. This discrepancy raised concerns about potential supply chain interference linked to recent EU sanctions against the developer. The certificate was issued shortly after sanctions and belongs to a person based in Astana, Kazakhstan, with limited public ties to the VK team. Official MSI installers downloaded directly from the MAX website remain signed by the company, while the client-triggered update differs in both version and signer. The researcher recommends that VK verify the download chain through Mail.ru trackers to rule out tampering. Installation of the update was declined pending further clarification.
LiteLLM Supply Chain Poisoning Exposes 195TB of Credentials Across 2500 Organizations
A detailed forensic report from CloudSEK and Hudson Rock reveals that attackers compromised the LiteLLM CI/CD pipeline by poisoning the Trivy security scanner dependency. The malicious Trivy tag allowed theft of PyPI publishing tokens, leading to the upload of tainted LiteLLM versions 1.82.7 and 1.82.8. Within a 40-minute attack window these packages were downloaded over 119,000 times, exfiltrating 195TB of credentials including AWS, Azure, GCP keys, GitHub tokens, SSH keys, Kubernetes configs, and AI provider API keys. NVIDIA and multiple other major technology firms were confirmed among the victims. The incident highlights critical weaknesses in dependency pinning practices and the absence of automated detection for malicious package behavior on PyPI. Experts warn that AI infrastructure components are becoming high-value targets for future supply-chain campaigns.
Where Secrets Really End Up in Docker Images: Testing 8 Common Methods
A detailed analysis of eight different approaches for handling secrets during Docker image builds reveals that most methods leave sensitive data exposed in layers, configuration files, or build history. Experiments conducted on Ubuntu 24.04.1 LTS with Docker Engine 29.1.3 and BuildKit v0.26.2 showed that simply using RUN rm after COPY or overwriting files fails to remove secrets from immutable layers. Environment variables via ENV and build arguments via ARG both persist in image metadata and history. Only BuildKit Secrets with --mount=type=secret and multi-stage builds that avoid copying secrets into the final stage successfully prevent leakage. The study demonstrates that secrets can be extracted from saved images without running any containers. Developers are advised to adopt these two secure patterns to protect credentials in container supply chains.