Featured Posts

EOL Software

Oct 9, 2026

Apache CXF Versions, EOL Dates, and Latest Releases (October 2026)

As of October 2026, the latest Apache CXF release is 4.2.3, the maintained lines are 4.2.x, 4.1.x and 3.6.x; 4.0.x and 3.5.x are end of life.

Security

Oct 9, 2026

Apache CXF 3.4 and 3.5 End of Life: 31 Unpatched CVEs and the Fix

Drop-in security support for end-of-life Apache CXF 3.4 and 3.5, covering the 2026 vulnerability wave that upstream fixes never reached.

Security

Oct 8, 2026

CVE-2026-49364, CVE-2026-27446 & 8 More: Apache ActiveMQ Artemis 2026 CVE Round-Up

How ten 2026 advisories, led by pre-authentication flaws present since Artemis 1.0.0, leave every release before 2.57.0 exposed, with no upstream path for any Spring Boot pin.

Announcements

Oct 8, 2026

HeroDevs Never-Ending Support (NES) for Spring Boot Managed Dependencies

HeroDevs Never-Ending Support (NES) for Spring now extends to the managed dependencies that ship inside Spring Boot. If your application is pinned to an end-of-life Spring Boot line and your scanner is flagging a CVE in one of the libraries Spring manages for you, there is now a remediation path that does not require re-architecting your build or rushing a major-version migration. We are rolling this out for both the Spring Boot 2.7 and 3.5 lines, both of which are now past open source end of life: 2.7 since 2023, and 3.5 since 2026. This is worth a few minutes even if you know Spring well. Managed dependencies are the part of the dependency graph most teams cannot cleanly account for. When a library in that set stops receiving security fixes, each new CVE disclosed against the library stays open in production, with no upstream patch coming.

Security

Oct 5, 2026

The Drupal Webform Module Reported 22 Vulnerabilities. We Made Sure Drupal 7 is Covered.

On September 23, 2026, the Drupal Security Team published 22 advisories for the Webform module in one coordinated release. Two of them affect file uploads, and we backported both fixes to Drupal 7 for our Never-Ending Support (NES) customers. When we compared the Drupal 7 patches with the fixes for supported branches, one of them came up short in two places. We closed both gaps and shipped the NEW for Drupal 7 release to customers within about a day of the advisories going out.

Security

Oct 5, 2026

Axios 0.24.x and 0.27.x Vulnerabilities: CVEs Upstream Will Not Patch

Up to 21 CVEs affect Axios 0.24.x and 0.27.x with no upstream fix. Here's each one, where it was fixed upstream, and which NES for Axios already patches.

Security

Oct 1, 2026

CVE-2026-101895: Angular SSR DOCTYPE DoS, No Fix for Angular 5 to 19

How a truncated DOCTYPE declaration traps the SSR HTML parser in an infinite synchronous loop and freezes the Node.js process.

Announcements

Sep 25, 2026

HeroDevs Launches Never-Ending Support (NES) for Axios

SLA-Backed Security Fixes for the Axios 0.x Line.

Security

Sep 25, 2026

Spring Boot Managed Dependencies Still Get CVEs After EOL: September 2026 Patch Round-Up

52 upstream CVEs landed across Tomcat, Netty, Jackson, and Jolokia this month, the largest batch this series has covered. Most of them are invisible to dependency scanners right now. Which Boot version you run determines which fixes reach you.

EOL Software

Sep 15, 2026

Python End-of-Life Dates: Every Version's Support Timeline

A complete guide to Python version lifecycles, support phases, and critical end-of-life dates from 3.8 through 3.14

Security

Sep 10, 2026

CVE-2026-19203, CVE-2026-12611 & CVE-2026-19204: Three Jetty Protocol-Parser Flaws Hit EOL 9.4, 10.0, and 11.0

How a lone line feed, an HTTP/2 teardown race, and an unvalidated WebSocket opcode each let a remote unauthenticated client smuggle requests or take a Jetty server down, with no OSS fix for the 9.4, 10.0, and 11.0 lines.

Security

Sep 10, 2026

Node.js 20 on Google Cloud: October 30 Decommission and Your Options

Upgrading runtimes is rarely top of mind until a deadline forces your hand, and for Node.js 20 runtime in Google Cloud services, that deadline is less than two months away.

Security

Sep 10, 2026

CVE-2026-59313: Spring Framework Server-Sent Events Injection, Scored 9.8 Critical

Spring Framework is the foundation under most of the Java web tier, and its Spring MVC layer includes a functional web framework (WebMvc.fn) where you build endpoints as route handlers instead of annotated controllers.

Security

Sep 9, 2026

CVE-2026-47892 and CVE-2026-59283: Two Spring "Critical" Ratings

How two CISA-ADP Critical scores landed on Spring Framework bugs that require non-default configuration to reach, and the five-minute check that tells you which score describes your deployment.

Security

Sep 8, 2026

CVE-2026-62871: .NET WPF Heap Overflow Enables Local Code Execution

How a crafted TrueType font wraps unsigned 16-bit loop counters in WPF's font subsetter, writes past its heap buffer, and hands code execution to whoever gets a document opened.