Featured Posts

Apache Tomcat Versions and EOL Dates: Tomcat 5.5 to Tomcat 11

A complete reference for every Apache Tomcat release timeline, the Tomcat 9 LTS plan, and what end-of-life means for the enterprise teams still running Tomcat 8.5 and 9 in production.

AI Coding Assistants Are Quietly Breaking Your Compliance Posture. Here’s How to Get It Back.

What senior leadership, security teams, compliance officers, and engineering leaders need to know about AI-accelerated open source adoption — and a practical path to stay compliant without slowing developers down.

Curated Open Source: What Replaces Reactive SCA Scanning in the AI-CVE Era

AI-driven CVE volume, maintainer burnout, and scanner blind spots are dismantling the scan-and-triage playbook. The replacement is curated open source: a deliberate posture where enterprises consume from a narrowed set of libraries with explicit ownership, SLAs, and commercial backing where it's needed.

95 Days to CRA Article 14: Your EOL Open Source Is Now a Compliance Liability

September 11 is when CRA Article 14 vulnerability reporting obligations begin. If your organization has end-of-life open source in production, here is the specific checklist your security and compliance teams need to work through before enforcement begins.

AI Cybersecurity Executive Order 2026: What It Means for EOL Software

A June 2026 executive order builds a national apparatus for AI-assisted vulnerability discovery. It accelerates the half of the lifecycle that hurts EOL software most — finding flaws — without generating patches for the frameworks that no longer have a maintainer.

Spring Boot 3.5 EOL: What the Migration Really Takes

Spring Boot 3.5 reaches open-source end of life on June 30, 2026. The move to 4.x is an 83-change platform migration estimated at 200–500 hours — and AI accelerates the edits, not the judgment.

APRA CPS 230 and the SOCI Act: How EOL Open Source Creates Compliance Gaps

Both APRA CPS 230 and the SOCI Act are now fully in force. End-of-life open source sits at the intersection of their operational risk, supply chain, and incident reporting obligations — and creates compliance gaps no absent maintainer can close.

Miasma npm Worm Steals Cloud Creds and Hijacks CI/CD

When the compromise stops stealing your secrets and starts living in your environment

CVE-2026-46417: Angular Platform-Server SSRF via Hostname Hijacking

Absolute-form request URLs let an attacker hijack the SSR origin and redirect relative HttpClient calls to a domain they control. Angular 4 through 18 are affected with no upstream fix.

AI Doesn't Know Your Framework Is End of Life. That's a Security Problem.

AI coding tools recommend what's popular, not what's supported. When EOL components look "normal" in training data, they become the default — and your vulnerability backlog grows automatically.

Is Drupal 7 affected by CVE-2026-9082 (SA-CORE-2026-004)?

The Drupal Security Team's May 20 advisory leaves Drupal 7 site owners with no answer — not vulnerable, not safe, just unchecked. Here's how we audited core and contrib modules to confirm D7 is not exposed to this highly critical SQL injection.

CVE-2026-44573, CVE-2026-44577, CVE-2026-44572: Three Next.js Vulnerabilities Affecting EOL versions

Three New Next.js CVEs: Middleware Bypass, Image DoS, and Cache Poisoning in EOL Versions. Here is what each one does, who is exposed, and how to resolve them.

68% of Codebases Contain License Conflicts and AI-Generated Code Is Making It Worse

The 2026 OSSRA report documents the largest year-over-year increase in license conflicts in 11 years of data. The driver is AI-generated code — and most organizations are not evaluating it for IP risk.

The Verification Bottleneck: Why AI Found 12 OpenSSL Zero-Days While Curl Killed Its Bug Bounty

The same AI capability that delivered 12 of 12 verified OpenSSL zero-days also killed the curl bug bounty program. Verification — not discovery — is now the bottleneck defining open source security.

Package Override Kill Switches: npm, pnpm, Yarn, Maven, Gradle & NuGet

A copy-paste reference for emergency dependency control across every major package manager — plus what to do when the only safe version of a component is one upstream no longer ships.