The open-source software underlying critical infrastructure — from financial systems to public utilities to emergency services and electronic health records — is vulnerable to malicious cyberattacks.