Xeol provides an AI agent to manage open source software risks by addressing end-of-life, outdated, and unmaintained software issues. The service integrates with existing software composition analysis tools.

Xeol

Xeol (YC S23) | 641 followers on LinkedIn. Deploy an AI agent to find and fix EOL, outdated, unmaintained open source software | Pronounced Zee-O-L.

End-of-life, outdated, and unmaintained open source software are incredibly prevalent. That&#39;s probably why PCI 4, FedRAMP, NIST, and OWASP Top 10 require actively managing them out of your supply chain.

Co-founder of Xeol (YC S23)

ShiHan Wan

Founding Engineer @ Xeol

Zaran Lalvani

Xeol (YC S23)

In exactly one week, we'll be in Denver for the 2024 RH-ISAC Cyber Intelligence Summit! There's still time to register and join us! https://lnkd.in/gMb5Cd2X ?

Retail & Hospitality ISAC

Join RH-ISAC for a threat briefing on March 14 about observed incidents and emerging threats relevant to the retail and hospitality community. This month’s briefing will feature intel and research from XM Cyber , Trustwave , and Xeol (YC S23) .

We cataloged more than 30,000+ deprecated packages from the major package registries and made it searchable. Announcing the launch of EOL explorer! https://lnkd.in/gdfrf6-n The most fun was hacking around limitations of the NuGet registry API to find exact deprecation dates for packages. Since the normal API doesn't directly support dates of deprecation, we had to find a backdoor of sorts using the NuGet catalog to find the exact dates 🤓 We're supporting NuGet, Maven, and Npm to start. Let me know if you're like to see other registries supported. Details: - Top 10,000 most used npm packages - Top 10,000 most used Maven packages. We consider a package deprecated if the source repository is archived, and a version has not been pushed after archive. - All NuGet packages ever marked as deprecated on the registry - In the case that a vendor has announced EOL/deprecation, like Vue or Bootstrap, we prefer that data over any we source directly from the registry.

Benji Visser

Good end-of-life software management is good vulnerability management. Make sense… it closes the loop on potential 0-days and ♾️-days. But one of the biggest “hidden” benefits is helping security teams avoid under the gun EOL remediations. Unfortunately remediating an EOL issue is not just a security patch away. You are left with major version upgrades or package rip-n-replaces. Both challenging to pull off in short time frames with a hot exploit ticking. Good EOL management is: ⏲ Proactive. Security patches do not exist so you are left with upgrade, replace, or de-risk. Planning ahead of EOL dates will reduce your risks. 👥 Collaborative. Like it or not major version upgrades or rip-and-replace of packages require the buy in of engineering teams. 🐛 Good vulnerability management. It's not just closing the gap on unknown vulnerabilities but also reducing the risk of last minute upgrades ⬆ or replacements 🔁 Thank you Caleb Schwartz for inspiring this blog post 🙏🏼 #eolsoftware #endoflifesoftware #eol #vulnerability #management 🛋️ we go into much more details in our blog post https://lnkd.in/eFy_cYuC

EOL == EOS ∈ Deprecated ∈ Unmaintained? 🤔 What does it mean for software to become end-of-life? What about end-of-support? Deprecated? Unmaintained? What about open source software? There are a lot of different terminologies around software support. I want to share how we think through the different terms. As with all things language, a common definition across the board doesn't exist! #eolsoftware #endoflifesoftware #eol #deprecated #unmaintained Read more in our blog post below 👇

End-of-life software is mentioned more and more in compliance frameworks highlighting the emergence of this attack vector. The biggest mention is in PCI DSS 4.0 requiring EOL management starting March 31, 2025 (this is one of the future-dated requirements). NIST SSDF and OWASP Top 10 both call out the dangers of using EOL or outdated software as well. With NIST going deeper into not just EOL software like operating systems but EOL dependencies like open source projects as potent attack vectors. #eolsoftware #endoflifesoftware #eol As always more details in our blog below 👇

EOL software often contains "forever days" -- vulnerabilities which are known and will never be patched because the software is unsupported! Such as was the case described in this article. Most companies have a ton of EOL software because the cost of upgrading is just so high, and takes deliberate oversight and planning. It's often not as simple as clicking merge on a dependabot PR (although it's great when it is!) The great thing is there's been an increased push by the industry around identifying and developing policies around EOL software. Some references to name a few: - PCI 4.0 control 12.3.4 - SSDF task PO.1.2 - OSSF S2C2F requirement SCA-3 L2 And happy to announce that we're working on Common Lifecycle Enumeration project, which will encompasses lifecycle events such as EOL. Will share the document below, we're currently looking for people in the industry to share use cases around software lifecycle events. https://lnkd.in/ezDG_uGe

Are you going to Black Hat Europe 2023? 🎩 📅 Come say hi to us! Let’s talk about OSS Incident Response and End-Of-Life software. #LondonCalling #BlackHatEurope2023 #BlackHat #AppSec #BHEU #BlackHat2023

XEOL

IO:XEOL

Xeol