Steve Poole on foojay.io - Friends of OpenJDK

AI Found the Bugs. Who's Patching Your EOL Java Code?

Thu, 23 Jul 2026 15:26:53 +0000

Earlier this year an AI model found a flaw in OpenBSD’s TCP stack that had been sitting there for 27 years. The same scanning run turned up a 16-year-old bug in FFmpeg’s H.264 code.

How do you feel about AI being used to discover bugs in open source, across the board and at scale?

Because that’s what’s happening. It’s tough enough dealing with machine-speed vulnerability discovery in code that has active maintainers. What about all the code with no friendly pair of safe hands?

Foojay Podcast #100: Java Podcasters on Why They Started, What Broke, and What They Learned

Mon, 13 Jul 2026 07:05:59 +0000

Foojay Podcast hits episode 100. No plan, no roadmap. It just happened. To mark the occasion, Frank turned the microphone around and invited other podcasters: Adam Bien (airhacks.fm), Jennifer Reif (Breaktime Tech Talks), Kadi McKean and Steve Pool (10xInsights), and Oumaima Zerouali (JCast). Same three questions for each: why did you start, what broke, and what did you learn?

YouTube

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

7 Jackson CVEs in One Day: AI-Assisted Security Research

Mon, 29 Jun 2026 11:47:41 +0000

Quick version check: the affected range for all seven is broadly >=2.10.0 =2.19.0 =3.0.0 <3.1.4 — with some CVEs affecting narrower ranges. If you’re on a supported release, upgrade to 2.18.8, 2.21.4, or 3.1.4. If you’re on an EOL line — 2.13.x, 2.14.x, 2.15.x — jump to the bottom of the page for more specifics or visit HeroDevs Jackson Support

Not a sales pitch

Anyone who knows me knows I dont do that. In this case I’m pointing you at HeroDevs because the Jackson issues are serious, HeroDevs have a solution thats stupidly easy to use and I know the folks behind the fixes. It takes a particular type of engineer to create security fixes and I know they have that skillset. Do your own research.

Did AI Just Break Software Security For Ever?

Tue, 16 Jun 2026 14:51:04 +0000

Whether the answer is yes or no (read on for my opinion) , something fundamental has changed this year. Not one thing. Four things, converging at once.

First: The rate of CVE arrivals

More than 40,000 CVEs were published in 2024, rising to just under 50,000 in 2025. FIRST — the Forum of Incident Response and Security Teams, projects a median of 68,000 for 2026, with realistic scenarios reaching 70,000 to 100,000.

Spring Boot 3.5 Migration and the CRA: When Good Enough Isn't"

Fri, 05 Jun 2026 08:52:01 +0000

Back in April I wrote about what happens to your security posture when Spring Boot 3.5 crosses the EOL line.

The short version: the CVE pipeline dries up, your scanner goes quiet, and the bad actors keep watching upstream for anything they can exploit downstream against the dead code nobody’s patching.

I called them zombie dependencies.

June 30th is coming. In a few weeks, Spring Boot 3.5 reaches end of open-source support. You’ve either got a plan or you haven’t.

Foojay Podcast #95: Is Your Java App Actually Secure, Or Does It Just Look That Way?

Mon, 11 May 2026 09:57:00 +0000

Is your Java application actually secure, or does it just look that way? In this episode of the Foojay Podcast, Frank is joined by Steve Poole and David Welch, both from HeroDevs , to dig deep into the state of Java security in 2025 and beyond.

Steve introduces the concept of zombie dependencies: end-of-life libraries that appear safely dormant but are quietly accumulating vulnerabilities waiting to bite you. David, a co-chair of the CVE Automation Working Group, explains what a CVE actually is, how the identification and disclosure process works in practice, and why AI tools like Mythos are dramatically accelerating the pace at which new vulnerabilities are found — on both sides of the wall.

Spring Boot 3.5 EOL — The CVE Blind Spot Nobody Talks About

Sun, 19 Apr 2026 13:37:13 +0000

Tomorrow I start (o so early) for JCON Europe in Cologne and then, at the tail end of the week, go to Devoxx France to give more talks. If you’re at either, come say hi. Herodevs has a booth at both.

After digging into the CVE stories behind Tomcat 8.5’s end of life , I turned my attention to Spring Boot 3.5. Same question, different framework: what actually happens to your security posture when a project crosses the EOL line?

Spring I/O 2026: Field Notes from Barcelona

Fri, 17 Apr 2026 13:09:24 +0000

Spring I/O 2026 wrapped in Barcelona on Wednesday. Three days at the Palau de Congressos. A thousand-plus developers, five tracks, sixty sessions (or there abouts) Here are the things I’m still thinking about..

Agents everywhere

It was a Spring AI conference with a Spring Boot conference attached.

That’s not a complaint. Count the programme yourself. Across the two main days, roughly a third of the main-track sessions were about Spring AI, MCP, agents, or building on LLMs. Josh Long opened Day 2 at eleven with Bootiful Spring Boot 4 . By twelve, the Auditorium had moved on to The Spring AI Ecosystem in 2026: From Foundations to Agents.

Why Java Developers Over-Trust AI-Generated Code

Thu, 09 Apr 2026 10:45:36 +0000

This article is adapted from The Confidence Trap , part of the “2026 Supply Chain Reckoning” series on my No Regressions newsletter.

Your boss calls you on a Friday afternoon. He’s read all the available data, he tells you with absolute confidence, and he’s decided that migrating from Spring Boot 3.5 to 4.0 will be straightforward. Wants it done over the weekend.

You’d push back. You’d ask which data. You’d point out the breaking changes.

Grails Is Back: Inside the Apache Software Foundation Migration

Wed, 01 Apr 2026 08:48:56 +0000

In the companion article to this one, I looked at the revitalisation of Grails under the Apache Software Foundation: the 18-month migration, the technical modernisation, and the release of Grails 7 as a Top-Level ASF Project. That is the good-news story, and it is a genuinely impressive piece of community engineering.

This article is about the other side of the same coin.

While Grails moves forward, many of the applications built on it cannot move at the same pace. The result is a growing gap between where the framework is heading and where a significant number of production systems actually sit. Understanding that gap, and what options exist for managing it, is what this piece is about.

Grails Is Back: Inside the Apache Software Foundation Migration

Wed, 25 Mar 2026 08:30:21 +0000

Steve Poole | With contributions from James Fredley, Apache Grails PMC Chair

For a technology that many people filed under “legacy,” Grails has been unusually active. While much of the industry’s attention has drifted toward newer frameworks and shinier stacks, something more deliberate has been happening in the background.

Grails has been moving into the Apache Software Foundation (ASF), modernising and positioning itself for the next chapter.

If you have not looked at Grails recently, your mental model is likely several years out of date. And that, in many ways, is exactly the problem.

Shai-Hulud and the npm Worm: How Speed-Optimised Dev Ecosystems Made a Self-Propagating Supply Chain Attack Inevitable

Thu, 12 Feb 2026 11:47:48 +0000

first, a word about ecosystems

Before we dive into Shai-Hulud, before we label it “sophisticated” or “advanced” or “next generation,” we need to be honest about something.

The worm didn’t appear in a broken system. It appeared in the one we deliberately optimised.

In the book Dune, the worm is integral to the ecosystem. The planet, its environment, and the worms are deeply interconnected.

That’s true for the cyber-worm equivalent. The worm is an entirely predictable outcome of the ecosystem in which we, as developers, are part

FOSDEM 2026: Open Source Supply Chains, CRA Compliance, and the Future of Software

Mon, 02 Feb 2026 22:52:20 +0000

(a.k.a. “So… what did you do this weekend?”)

I’m back from four days in Brussels and the uniquely exhausting experience that is FOSDEM. Mentally fried. Physically wrecked. Entirely glad I went.

The Chaos and the Crowd

Around 8,000 people made the trip this year. Some arrived for the first time; many returned as annual pilgrims.

FOSDEM remains a strange outlier in the modern conference world: free to attend, no registration gatekeeping, and no sponsors dictating the tone. You just turn up.

Security Doesn’t Start at Liftoff

Fri, 23 Jan 2026 10:22:31 +0000

This is a follow-on to the article The Real Mechanics of Vulnerabilities in an Upstream/Downstream, Topsy-Turvy EOL World .

What you’ll learn in this article:

The Security Timeline Inversion: CVE disclosure is no longer the true start of the security timeline.
Security Outcomes: Routine maintenance decisions, not reaction speed or tooling, determine security outcomes.
Flawed Indicators: CVE scores, scanners, and compliance deadlines are not effective early-warning systems.
Vulnerability Distortion: Embedded, forked, and end-of-life components obscure vulnerability visibility and responsibility.
Your Mission: Governance and lifecycle changes are necessary to avoid being structurally late to “silent” vulnerabilities.

Are you sitting comfortably?

In February 2025, Apache Tomcat shipped a set of routine point releases. They arrived without urgency, without commentary, and without the kind of noise that can accompany significant security incidents.

The Real Mechanics of Vulnerabilities in an Upstream/Downstream, Topsy-Turvy EOL World

Fri, 19 Dec 2025 13:36:28 +0000

In this article you’ll learn

Why CVEs record that a vulnerability exists, not that a usable fix exists
How vulnerabilities are often discovered and fixed downstream before upstream ever acknowledges them
Why EOL branches continue to accumulate exploitable behaviour even when no CVEs appear
How downstream-only patches break the assumptions scanners and SBOMs rely on
What disclosure actually enables when “just upgrade” is not a viable option

Introduction

There is a tidy, almost academic version of how software security is supposed to work. It appears in conference talks, compliance documents and in the cheerful diagrams seen on marketing slides. It usually looks something like this:

Time to panic? AI and Cybercrime legislation is on your doorstep now

Thu, 10 Apr 2025 07:25:52 +0000

As we settle into 2025, legislation around AI and cybercrime is no longer a distant threat or vague aspiration. It’s here, real, and it’s already changing how companies must build, deploy, and secure intelligent systems.

If you’re a developer, security engineer, or anyone responsible for the software supply chain, it’s time to recalibrate. Here’s what’s coming, who’s shaping it, and what tools are emerging to help navigate the new landscape.

Thinking differently about testing

Mon, 27 Jan 2025 07:26:34 +0000

10x Insights on a different view of quality assurance

I’ve given a few talks about 10x developers, or rather 10x professionals and been involved in process (re)engineering for many teams and projects.

However much you learn about people and their roles - there’s always something new to discover.

In fact, it is amazing how often your worldview is blinkered, how often there’s a different way to do or think about some aspect of your life or your career.

Foojay Podcast #50: JCON Report, Part 2 - Maven, Software Security, Code Quality

Mon, 27 May 2024 08:07:54 +0000

This is part 2 of the interviews we recorded at the JCON conference earlier this month in Germany. In this episode, you get two main topics: Maven and Code Quality.

In the first part, you’ll hear Karl Heinz Marbaise and Steve Poole discuss the Maven project, the repository, Sonaytype, and the security impact of dependencies.

But next to security, we developers are also responsible for creating readable and maintainable code. Miro Wengner, Marit van Dijk, and Hinse ter Schuur dive into this topic, in the second part!

Crowd-Publishing the 10x Java Dev Book

Thu, 02 May 2024 07:17:58 +0000

Java transformed the world of software development as we know it and continues to evolve as a platform and language. Nevertheless, the “enlightenment roadmap ” of a Java developer can be scary. How do you become the 10x Java Developer you always dreamed of becoming?

That’s the question Steve Poole and Olimpiu Pop embarked on to respond. And, what better way to achieve it than to tap into the best resource Java has: its community!

Generative AI and Java - hype or urgent reality?

Mon, 06 Nov 2023 07:59:04 +0000

It’s hard to grasp that it’s been about a year since Chat GPT and other generative AI tools burst onto the scene. We’re all still grappling with, well, everything about them. Whatever equilibrium we eventually find, it’s clear that the world is changing. The whole world mind, not just the IT industry.

Olimpiu Pop and I have debated the situation multiple times, and we realised that there’s lots of rumour around AI and Java but not much in the way of fact.

State of the Software Supply Chain Report: Key Takeaways for Java Developers

Thu, 12 Oct 2023 08:19:25 +0000

Sonatype have just released the 9th edition of their State of the Software Supply Chain Report . It delves into the landscape of open source, software development, and software supply chain security. I thought I’d pull out some highlights for Java Developers!

Software Supply Chains and Open Source

Maven Central hits 1 Trillion downloads

Open source adoption continues to grow, with Java (Maven) being a significant ecosystem.

The report indicates that Java projects and their versions have seen substantial growth. a 28% year-over-year increase in total projects available on Maven Central - hitting the amazing 1 Trillion download number.

Friends of OpenJDK Community Survey

Tue, 06 Jun 2023 08:33:06 +0000

Here’s the idea.

A survey that allows the community to ask the questions they want, including (shock horror) occasional commercial ones.

Often, when a survey’s results are released, the reader is left wanting more, experiencing that perennial “yes but” moment. Typically, the survey data is hidden and unavailable for analysis, and the desired follow-up questions or clarifications are not addressed.

The Foojay survey breaks this pattern. We will make all the data available, within the bounds of GDPR, and you will have the opportunity to propose the questions that should be included. The Foojay Board also has the chance to propose their own questions.

SBOMs: First Steps in a New Journey for Developers

Tue, 14 Feb 2023 10:01:28 +0000

This article is the first in a series about SBOMs, software supply chains, the government and you. Buckle up - it’s going to be a wild ride. Luckily there is cake to see you through.

Software bill of materials, anyone? A year ago, most developers had not heard of the ‘SBOM’ acronym.

Indeed, related terms like “software supply chain” or “security hygiene” were absent from most developers’ vocabularies.

Things are about to change! This year is already shaping up to be the year of SBOMs, of securing the software supply chain, and of the appearance of legislation that enforces better security practices among those involved in software. Whether in creation, testing, deploying, securing or operating, we all have specific security responsibilities in protecting our part of the software supply chain.