Featured Posts

Compliance

Nov 6, 2026

From GDPR to EU CRA: "Best Effort" is Over for Open Source Software

The EU Cyber Resilience Act's reporting clock started on 11 September 2026. PHP2Shell and HTTP2Shell showed what that means for software built on open source.

Compliance

Nov 6, 2026

EU Product Liability Directive: The EOL Open Source Problem

What every organization selling software into the EU needs to know before 9 December 2026. See how the PLD treats EOL open source and a practical path forward.

Compliance

Nov 6, 2026

Your EOL Open Source Is a FedRAMP 20x Problem. Here’s How to Fix It

FedRAMP 20x makes EOL open source a visible NIST 800-53 SA-22 finding. What every federal cloud provider needs to know, and a practical path forward.

Compliance

Nov 6, 2026

Your EOL Open Source Is a Japan Active Cyber Defense Problem. Here’s How to Fix It.

What critical infrastructure operators — and the vendors who serve them — need to know about Japan's Active Cyber Defense law, and a practical path forward.

Announcements

Nov 5, 2026

Introducing Evergreen: CVE Remediation Across Your Entire App

HeroDevs launches the Evergreen for CVE remediation across your application. When a dependency gets no upstream fix, you get a drop-in replacement.

EOL Software

Nov 3, 2026

NGINX Versions, EOL Dates, and Latest Releases (October 2026)

NGINX 1.28 and 1.29 are end of life, and 1.30 follows around April 2027. Get every branch's EOL date, latest release, and the CVEs left open on old versions.

EOL Software

Nov 2, 2026

.NET 9 and .NET 8 Reach End of Support on the Same Day: November 10, 2026

Microsoft moved Standard Term Support from 18 to 24 months, so .NET 9 now retires with .NET 8 on November 10, 2026. Here is why, and how to upgrade to .NET 10.

Security

Oct 28, 2026

CVE-2026-68497: jackson-databind Duration and XMLGregorianCalendar DoS

Unbounded digit runs in jackson-databind Duration and XMLGregorianCalendar strings pin a CPU core for minutes. See affected versions and fixes.

EOL Software

Oct 28, 2026

Jackson Versions, EOL Dates, and Latest Releases (October 2026)

Jackson 2 is not end of life, but 2.18 closes at the end of 2026. Get every Jackson branch's EOL date, latest patch, CVE fixes, and Spring Boot version.

Security

Oct 27, 2026

CVE-2026-111497 in .NET: Brotli Fix Leaves .NET 6 Exposed

Microsoft's out-of-band fix for CVE-2026-111497 (HTTP2Shell) covers .NET 8, 9 and 10. See which .NET versions stay exposed and how to fix .NET 6.

Security

Oct 27, 2026

Black October Is Open Source’s Jurassic Park Moment

The raptors learned to open doors. The AI agents just did too, and open source is standing in the kitchen. Here's what I think happens next.

Security

Oct 27, 2026

CVE-2026-84008 + 5 .NET Crypto CVEs: SAML, CMS DoS on .NET 6

Attacker-supplied CMS messages and signed XML burn CPU and memory in .NET's cryptography packages, including on .NET 6. See who is affected and how to fix it.

EOL Software

Oct 26, 2026

PHP End-of-Life Dates: Support Timeline for Every Version (2026)

The definitive reference for every PHP release, support window, and end-of-life date, plus what EOL means for the millions of applications still running unsupported versions.

Security

Oct 23, 2026

CVE-2026-111497 (Node2Shell): Node.js Brotli RCE, EOL Risk

Node2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder compiled into Node.js. See the fixed versions and why EOL lines stay exposed.

Security

Oct 23, 2026

CVE-2026-92707: MessagePack-CSharp Memory Exhaustion via SignalR

CVE-2026-92707 lets nested array headers turn a 31.5 KiB MessagePack payload into roughly 115 MiB of heap allocation. See affected SignalR versions and fixes.