Featured Posts

Security

Oct 23, 2026

CVE-2026-111497 (Node2Shell): Node.js Brotli RCE, EOL Risk

Node2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder compiled into Node.js. See the fixed versions and why EOL lines stay exposed.

Security

Oct 23, 2026

CVE-2026-92707: MessagePack-CSharp Memory Exhaustion via SignalR

CVE-2026-92707 lets nested array headers turn a 31.5 KiB MessagePack payload into roughly 115 MiB of heap allocation. See affected SignalR versions and fixes.

Security

Oct 23, 2026

7 New Angular CVEs: No Fix for Angular 19 and Earlier

Seven Angular CVEs, including a one-request SSR denial of service, leave every end-of-life Angular line exposed. See fix versions and who is affected.

Security

Oct 23, 2026

The October 2026 NGINX CVEs and Ingress NGINX

None of the five CVEs fixed in nginx 1.31.7 and 1.30.6 can be reached on a stock Ingress NGINX deployment. Here is why, and why you still need a patch.

Security

Oct 23, 2026

CVE-2026-77711 & CVE-2026-76184: Jetty HttpClient Credential Leaks

Four Jetty CVEs leak proxy credentials, Authorization headers, and plaintext passwords. See affected versions and fixes for EOL Jetty 9.4, 10, and 11.

Security

Oct 23, 2026

Is Drupal 7 affected by CVE-2026-108097 (SA-CORE-2026-014)?

Drupal 7 core isn't exploitable through CVE-2026-108097. Here's how we tested Field UI and why NES for Drupal 7 ships hardening anyway.

Security

Oct 23, 2026

The PHP2Shell Story & The Man Who Keeps PHP Running

By now you've heard about PHP2Shell. Two critical flaws in the core of PHP, found with the help of AI, let an attacker take over a server with a single crafted request.

Announcements

Oct 22, 2026

Moodle 4.3 End of Life: Security Patches Now Available with HeroDevs NES

Moodle 4.3 stopped receiving security fixes on April 21, 2025. NES for Moodle 4.3 and IOMAD 4.3 backports every post-EOL patch so you can upgrade on your own timetable.

Security

Oct 21, 2026

PHP2Shell Is Two Critical PHP Flaws. Most of the PHP on the Internet Can't Take the Patch.

PHP2shell (CVE-2026-109618, CVE-2026-109619) is fixed only in PHP 8.2 and later. Here is how both RCE bugs work and what to do on PHP 8.1 and older.

Security

Oct 21, 2026

CVE-2026-18659, CVE-2026-18660, CVE-2026-18661 & CVE-2026-18662: Jetty Authorization Bypass and Proxy SSRF

How broken security constraint matching and case-sensitive proxy host filtering let unauthenticated attackers reach protected endpoints and internal hosts across Jetty 7.6 through 12.1

Security

Oct 21, 2026

What HeroDevs Joining the .NET Security Group Means for Your App

HeroDevs is a member of the .NET Security Group alongside Microsoft, Red Hat, Canonical, and IBM. For Never-Ending Support (NES) for .NET customers, that means security fixes for .NET 6, 8, and 9 on Patch Tuesday.

Open Source Ecosystem

Oct 20, 2026

HeroDevs Reaffirms Commitment to Open Source Pledge for 2026 with $739K+ in Support

HeroDevs puts $739,137 back into open source in 2026, nearly $20,000per developer, funding ecosystems, maintainers and foundations.

Security

Oct 14, 2026

CVE-2026-88092 & CVE-2026-70188: Critical Kestrel Vulnerabilities in .NET 6

Two critical Kestrel vulnerabilities, CVE-2026-88092 and CVE-2026-70188, let unauthenticated attackers smuggle HTTP requests and inject newlines into request trailers in ASP.NET Core. Microsoft has patched supported .NET versions, and HeroDevs has fixed both for end-of-life .NET 6 in NES release 6.0.47.

Security

Oct 13, 2026

Axios 0.24.x and 0.27.x Vulnerabilities: CVEs Upstream Will Not Patch

Up to 21 CVEs affect Axios 0.24.x and 0.27.x with no upstream fix. Here's each one, where it was fixed upstream, and which NES for Axios already patches.

EOL Software

Oct 9, 2026

Apache CXF Versions, EOL Dates, and Latest Releases (October 2026)

As of October 2026, the latest Apache CXF release is 4.2.3, the maintained lines are 4.2.x, 4.1.x and 3.6.x; 4.0.x and 3.5.x are end of life.