> ## Content Index
> Fetch the complete content index at: https://www.nupath.eu/llms.txt
> Use this file to discover other available public pages before exploring further.

# Sovereign Tech Agency celebrates five years with €60m open source investment
- URL: https://www.nupath.eu/sovereign-tech-agency-celebrates-five-years-with-eur60m-open-source-investment/
- Published: 2026-11-03T06:13:14.000Z
- Updated: 2026-11-03T06:13:14.000Z
- Author: Christian Triantafillou Schade
- Tags: News, Germany, #source_Sovereign-Tech-Agency

The Sovereign Tech Agency marked its fifth anniversary with a €60m investment in open source security, expanding its Sovereign Tech Resilience program to include memory safety transition, post-quantum readiness and supply chain security. The agency highlighted the PHP2Shell vulnerability as evidence of the need for sustained public funding to secure critical digital infrastructure. **(SOVEREIGN TECH AGENCY)**

[Newsletter: Our 5-year anniversary, PHP2Shell, Sovereign Tech Resilience relaunch and moreEmail newsletter on 29 October: Our 5-year anniversary, PHP2Shell, Sovereign Tech Resilience relaunch and more On 12 October, we celebrated our five-year anniversary with guests and friends from policy, open source, government, industry, civil society, and academia. It was a wonderful night to look back at our beginnings, and ahead to the future challenges for digital infrastructure and Europe’s digital sovereignty.The critical vulnerability PHP2Shell sent shockwaves through the internet, reminding us all how important long-term investments into open source components are for our collective security. Good news though: The Sovereign Tech Resilience program has expanded to include four new services: memory safety transition, post-quantum readiness, supply chain security, and Cyber Resilience Act compliance. Applications are open.If you’d like to find out about these updates as they happen, you can find the Sovereign Tech Agency on Mastodon, LinkedIn, and Bluesky.Celebrating five years of strengthening open digital infrastructureOctober marks our fifth year anniversary! In 2021, the German Federal Ministry for Economic Affairs and Energy (BMWi) commissioned a small team to work out, in a feasibility study, how public investment in open digital infrastructure could be designed. Five years and more than 110 investments later, that blueprint has since grown into the Sovereign Tech Agency. We have strengthened the open source ecosystem with over €60 million and five programs tailored to how critical open source is developed and maintained.To celebrate all of this, more than 150 guests, policy makers, open source maintainers, representatives from government, industry, civil society, and research, came together on 12 October in Berlin. Digital Minister Dr. Karsten Wildberger held the keynote.Read more about our journey and the anniversary party in our blog.Read moreNew publication: “The Sovereign Tech Agency: From Feasibility to Implementation”Our new report “The Sovereign Tech Agency: From Feasibility to Implementation,” published just in time for our five-year anniversary, traces our journey from feasibility study to the organization we are today. It reflects on what we've learned about designing public funding instruments, working with open source communities, and supporting the long-term maintenance and security of the infrastructure we all depend on.As governments across Europe look to strengthen their digital sovereignty, we hope these lessons can help inform the next generation of public investment in open digital infrastructure.You can find it on our brand-new publications page, that collects all our publications from the last five years in one place.Visit publications pagePHP2Shell exposes the funding gap in open source securityOn 21 October 2026, the PHP project released fixes for two critical security vulnerabilities, collectively known as PHP2Shell. Under certain conditions, these vulnerabilities could allow attackers to execute code on affected web servers without authentication. PHP underpins a substantial share of the web, including public services, businesses, and widely used publishing platforms.In 2024, the Sovereign Tech Agency commissioned the first external security audit of PHP’s core in over a decade. It identified 17 security-related findings and contributed to subsequent work on the underlying problem behind one of the PHP2Shell vulnerabilities.This incident shows once more why securing the software we all depend on takes more than finding vulnerabilities. It takes sustained investment in the people who can fix and prevent them.Read more about PHP2Shell on our blog.Read blog postThe Sovereign Tech Agency was mentioned in several media reports concerning the PHP2Shell vulnerability, among them The Guardian, Frankfurter Allgemeine Zeitung, Süddeutsche Zeitung and Spiegel.Apply for the Sovereign Tech Resilience program, now featuring four new servicesThe Sovereign Tech Resilience program has been running since 2023, with an approach that combines hands-on engineering, audits, and bug-and-fix bounties, delivered together with industry partners at no cost to participating free and open source software (FOSS) projects. It helps critical open source projects build better capacity to avoid, absorb, and handle security issues over time.Sovereign Tech Resilience now adds four new services, memory safety transition, post-quantum readiness, supply chain security, and Cyber Resilience Act compliance, each delivered by a specialized implementation partner. For the two existing services, technical debt management and security audits, we are increasing the number of available service providers to expand capacity and cover a wider range of programming languages and ecosystems.Program details and applicationSovereign Tech Agency out and aboutWe’re in the middle of conference season! Here are some upcoming events our team will be attending. If you’re around, say hi.26 - 30 October 2026: Tara Tarakiyee, Sovereign Tech Agency Lead Technologist, as well as the Sovereign Tech Standards network, are at W3C TPAC 2020 in Dublin, Ireland. 2 - 3 November 2026: Erik Möller, Paul Sharratt, and Luisa von Beust will be at Digital Summit in Berlin, Germany. Don’t miss the panel discussion “AI, Open Source and Digital Sovereignty – A Paradigm Shift in the Making” with Erik Möller on 2 November, 2:45 pm. 25 - 26 November 2026: Laia Domenech Burin will be speaking at Compute! in Paris, France. Her talk “The Invisible Work of the Stack: Measuring the Impact of Public Investment in PyPI” will take place on 25 November, 2:05 pm. Categories: Newsletter![](https://www.google.com/s2/favicons?domain=https://www.sovereign.tech/news/newsletter-october-2026&sz=64)Sovereign Tech Agency![](https://storage.ghost.io/c/6c/f3/6cf31287-c34a-403a-bb6b-49385b3636e9/content/images/2026/07/np-star.png)](https://www.sovereign.tech/news/newsletter-october-2026?ref=nupath.eu)