Security

152 articles in this category.

Jul 23, 2026 Steve Poole

AI finds decades-old flaws at machine speed, but the fixes only reach supported versions. What that means for end-of-life Java, and what to …

Every production application carries secrets: database passwords, API tokens, encryption keys. The question is never whether to manage them …

I pointed a scanner I have been building at an old Spring project, and it flagged javax.activation. The bump was 1.1-rev-1 to 1.1.1. Prior …

Jun 29, 2026 Steve Poole

Seven jackson-databind vulnerabilities, one researcher, one day. Two critical RCEs. This is AI-assisted security research in practice.

I recently had the pleasure of joining the Foojay podcast to talk about Quarkus in depth. The conversation covered a lot of ground, from …

Jun 16, 2026 Steve Poole

AI finds exploits in hours. Patch cycles run 30–60 days. EOL software gets neither. Here's what changed in 2026 and what to do about it.

Jun 5, 2026 Steve Poole

Spring Boot 3.5 reaches EOL on June 30. The legal context is about to change. Here's what 'without undue delay' means when commercial …

Tiberius: A Security Testing Framework for LLM Applications in Java How do you write a regression test for a system that is …

JWT authentication is everywhere. But rolling it correctly — with proper algorithm enforcement, key management, clock skew handling, JWE …

BoxLang 1.13.0 is a stability-first release with deep compatibility work and runtime hardening. This build closes 48 issues, with the …