Featured Posts

Security

Aug 21, 2026

CVE-2026-56848: Node.js HTTP/2 RST_STREAM Heap Use-After-Free

How a stream reset submitted inside an active nghttp2 receive callback re-enters the send path and frees the session state the receive loop is still reading, crashing the server process.

Security

Aug 21, 2026

The Real Risks of Running Unsupported Open Source Software

Three concrete exposures come with unsupported open source: unpatchable CVEs, compliance findings, and operational drag.

Security

Aug 18, 2026

CVE-2026-58043: Node.js Permission Model Filesystem Allowlist Bypass

How a radix tree split node in the Node.js Permission Model grants read and write access to files that were never on the allowlist

Security

Aug 17, 2026

CVE-2026-73635 & CVE-2026-73633: Apache Struts Unauthenticated Denial of Service

How two unbounded memory reads in Struts, one in the core localized-text cache and one in the JSON plugin, let an unauthenticated client exhaust the Java heap and take the server down.

EOL Software

Aug 17, 2026

NumPy 2.1 Reaches End of Life on August 19, 2026

The 2.1 branch leaves NumPy’s support window on August 19. If your project is pinned to Python 3.10, the only supported NumPy left to you expires four months later.

Security

Aug 14, 2026

PostgreSQL 14 EOL Nov 2026: 44 CVEs This Year, One Patch Left

The security risk of sticking with an aging database version, and why the CVE spike makes upgrading urgent.

Compliance

Aug 14, 2026

NIS2 and End-of-Life Dependencies: What Compliance Teams Need to Know

NIS2 treats an unsupported dependency as a known, quantifiable risk. If it is not in your risk plan, that is a gap.

Security

Aug 11, 2026

CVE-2026-59888: Jackson Record @JsonIgnore Bypass via Naming Strategy

How a property-collection ordering bug lets renamed JSON keys write to Record components marked @JsonIgnore

EOL Software

Aug 10, 2026

The Top 5 Reasons Why Organizations Choose HeroDevs for Never-Ending Support

Secure and Compliant Legacy Software: Why 800+ Enterprises Trust HeroDevs Never-Ending Support

Security

Aug 7, 2026

Why a Post-End-of-Life CVE Is Different From a Normal Vulnerability

A normal CVE comes with a patch. A post-end-of-life CVE usually does not, and it stays open indefinitely.

Security

Aug 6, 2026

CVE-2026-69149, CVE-2026-68945 and CVE-2026-69151: Angular SSR XSS, Transfer Cache Poisoning, and i18n XSS

How unescaped SSR serialization, ambiguous transfer-cache keys, and translatable event-handler attributes let attackers inject script and poison server-rendered responses across three related Angular vulnerabilities

EOL Software

Aug 6, 2026

Is It Safe to Keep Running End-of-Life Software in Production?

Unsupported software keeps running, but every new vulnerability becomes permanent. How to weigh the risk honestly.

Risk Mitigation

Aug 5, 2026

CVE-2026-55856 Through 55860 and CVE-2026-61700: MariaDB Connector CVEs in Spring Boot

Six MariaDB Connector/J and R2DBC vulnerabilities affect multiple versions of Spring Boot's dependency tree

EOL Software

Aug 5, 2026

Is AngularJS Still Supported in 2026?

The framework has been end-of-life since December 2021. Here is what that means for security, compliance, and your options.

Security

Aug 4, 2026

CVE-2026-39852: Quarkus Authorization Bypass via Matrix Parameters

How a matrix-parameter path-normalization mismatch lets an unauthenticated request slip past Quarkus authorization policies