Featured Posts

Security

Aug 4, 2026

July 2026 .NET Patch Tuesday: 14 CVEs Also Affect .NET 6

How fourteen of Microsoft's seventeen July Patch Tuesday .NET fixes reach back into the end-of-life .NET 6 line, and why the advisory metadata will mislead your scanner

EOL Software

Aug 4, 2026

Is Node.js 18 End of Life, and Is It Safe to Keep Running?

Node.js 18 stopped receiving security patches on April 30, 2025 and what that means for production and how to move forward.

Security

Aug 3, 2026

MessagePack-CSharp Patches 12 CVEs Affecting .NET 6 and SignalR

How attacker-controlled sizes, recursion depths, and dictionary comparers produced a twelve-CVE denial-of-service batch across every MessagePack-CSharp release line

Security

Aug 3, 2026

Node.js July 2026 Security Release: 11 CVEs, Node 18 and 20 EOL

Eleven CVEs were patched upstream in Node 22, 24, and 26, including three High-severity flaws in HTTP/2 and the Permission Model. Node 18 and 20 received nothing, and the two EOL lines still pulled more than 136 million downloads in July.

EOL Software

Aug 3, 2026

Quarkus Versions, EOL Dates, and Latest Releases (July 2026)

Understand Quarkus support lifecycles, identify end-of-life versions, and plan your migration to supported LTS releases.

Compliance

Jul 31, 2026

How DORA Treats Unsupported and End-of-Life Software

DORA has applied to EU financial entities since January 2025. Unsupported components are a resilience problem you must document.

Announcements

Jul 30, 2026

HeroDevs Announces Never-Ending Support (NES) for React

Security, Compliance, and Business Continuity for End-of-Life React 16 and React 17

Security

Jul 29, 2026

CVE-2026-66066: Rails Active Storage Arbitrary File Read and RCE

How an unsafe libvips default in Active Storage lets an unauthenticated attacker read server files and escalate to remote code execution

Compliance

Jul 29, 2026

The Compliance Cost of Running Nuxt 3 After July 31, 2026

Mitigating Compliance Risks for Nuxt 3 Applications Post-End-of-Life

Security

Jul 28, 2026

CVE-2026-64645: Next.js SSRF Vulnerability in rewrites() and redirects() Explained (and How to Fix It)

A Critical Look at Server-Side Request Forgery Risks and Remediation Paths for Supported and EOL Versions.

EOL Software

Jul 27, 2026

Nuxt 3 Reaches End of Life on July 31, 2026: What Are Your Options

What End of Life means for organizations still running Nuxt 3

EOL Software

Jul 23, 2026

Hibernate 6.6 Isn't End-of-Life. It's in "Limited Support." That Distinction Matters.

Navigating the security risks of Hibernate’s "limited-support" phase and preparing your applications for the shift to End-of-Life.

Security

Jul 22, 2026

CVE-2026-55602: http-proxy-middleware router Host-Header Routing Bypass

How unanchored substring matching in the router proxy-table lets a crafted Host header route requests to an unintended backend

Security

Jul 21, 2026

CVE-2026-42533: Critical NGINX Heap Overflow Hits EOL Ingress-NGINX

How an ordering bug in NGINX's two-pass script engine lets an unauthenticated request corrupt worker memory in EOL Ingress NGINX

Security

Jul 21, 2026

Spring Boot Managed Dependencies Still Get CVEs After EOL: July 2026 Patch Round-Up

13 upstream CVEs landed across Netty, Tomcat, Logback, pgjdbc, and Jackson this month, with three of them High-severity. Which Boot version you run determines which fixes reach you.