Featured Posts

Security

May 18, 2026

CVE-2026-42945: NGINX Rift Heap Buffer Overflow Hits Ingress NGINX

How the “NGINX Rift” vulnerability creates an unauthenticated RCE risk for retired Ingress NGINX deployments.

Migration

May 18, 2026

Spring AI 2.0 Is Coming Soon. Your Boot 4.0 Migration Does Not Have to Start Tomorrow.

Spring AI 2.0 GA is scheduled for May 28. Here is what teams on Spring Boot 3.x need to know about the Boot 4.0 requirement, the real migration scope, and how to approach the upgrade without putting production at risk.

EOL Software

May 15, 2026

Spring Boot Managed Dependencies Still Get CVEs After EOL: May 2026 Patch Round-Up

24 upstream CVEs landed across Tomcat, Netty, Thymeleaf, Jetty, and pgjdbc in a single month — every one reachable through the Spring Boot managed-dependency BOM on at least one EOL line.

EOL Software

May 15, 2026

Angular v19 Goes EOL May 19. Angular 22 Is Coming the Same Month. Here Is How to Navigate Both.

Angular v19 reaches end of life on May 19, 2026. Angular 22 is expected to ship around the same time. For enterprise teams, the overlap of an EOL deadline and a new major release is real pressure — and it is manageable if you plan for it correctly.

Security

May 15, 2026

Spring Framework April 2026: 3 Web Stack DoS and Cache Poisoning CVEs

How a single April 17 release addressed three independent denial-of-service vectors in the Spring 5.3, 6.1, 6.2, and 7.0 web stack, with two of those branches receiving fixes only on commercial subscriptions

EOL Software

May 14, 2026

Angular EOL Security in 2026: AI Tooling Is Widening the Gap

Why the gap between modern Angular AI tooling and EOL versions is becoming a critical security risk.

Security

May 13, 2026

Mini Shai-Hulud: Another npm Supply Chain Worm, and Why "Just Update" Isn't the Answer

The TanStack compromise shipped 84 malicious package versions with valid SLSA Build Level 3 provenance attestations. Cryptographic signing worked exactly as designed, and that's the problem.

Compliance

May 13, 2026

Your EOL Open Source Is an EU Cyber Resilience Act Problem. Here’s How to Fix It

What All Organizations shipping software into the EU need to know — and a practical path forward.

Open Source Ecosystem

May 13, 2026

How a Group of Developers Took Back Control of Enterprise Java: The Spring Story, And Why It Still Matters

HeroDevs is proud to be the Platinum sponsor of "Spring: The Documentary," a new film from Tech Documentaries telling the story of how Spring transformed enterprise Java. Watch it on CultRepo's YouTube channel.

Security

May 12, 2026

CVE-2026-22610: XSS Vulnerability in Angular Template Compiler via Unsanitized SVG Script Attributes

A cross-site scripting vulnerability in Angular's Template Compiler allows attackers to inject and execute malicious scripts through SVG elements. Applications running Angular 18.x and earlier have no upstream patch available. NES for Angular delivers a remediated package for all affected EOL versions.

EOL Software

May 12, 2026

Jetty End of Life Dates: Jetty 9, 10, 11, and 12 (2026 Guide)

Complete EOL timeline for every modern Eclipse Jetty release, the Servlet and Jakarta EE specs each version implements, and what to do now that Jetty 9, 10, and 11 are no longer published to Maven Central.

Security

May 11, 2026

30 CVEs in Two Months: What the Spring Numbers Tell Us About the Future of Open Source Security

Why the CVE explosion is breaking traditional security models—and what enterprises must do next.

Security

May 11, 2026

Spring Security April 2026: 7 CVEs Including Two Critical Authorization Bypasses

How a single April 21 advisory cycle reshaped the Spring Security threat model from CVSS 9.6 client registration through 8.1 servlet path matching

Security

May 8, 2026

CVE-2026-40982: Critical Spring Cloud Config Server Directory Traversal (CVSS 9.1)

A pre-auth path traversal in spring-cloud-config-server lets unauthenticated attackers read arbitrary files on the host. Affects 3.1.x through 5.0.x, with no upstream fix for EOL branches.

Security

May 8, 2026

CVE-2025-55752: Relative Path Traversal in Apache Tomcat Rewrite Valve

How a regression in Tomcat's URL rewrite pipeline bypasses /WEB-INF/ and /META-INF/ protections and opens a path to remote code execution when PUT is enabled