AI Found the Bugs. Who’s Patching Your EOL Java Code?
Table of Contents Discovery Has Stopped Being the Hard Part530 Bugs Disclosed. About 75 Fixed.The NCSC Says Brace for a Patch WaveRead the Small Print on the Rescue PlansFixes Arrive on the Maintainers' TermsFor Most of Maven Central, There's Nobody ...
-
BoxLang AWS, Azure, and Google Secrets Manager Module Released
Table of Contents One Pattern to Rule Them AllInstallationInstallationCommandBoxVia CommandBoxVia BoxLang OS BinaryHow Configuration Resolution WorksPer-Application Configuration (Application.bx)Global Server Configuration (boxlang.json)Real-World Usage: Datasource ConfigurationBuilt-In Caching: Performance Without CompromiseLocal Development SupportEnvironment Variable SupportThis Is a BoxLang+ FeatureGet Started Every production application …
-
This Dependency Update Looked Exactly Like an Account Takeover
Table of Contents The gap CVE scanners cannot seeMarshalHow the scoring actually worksTry it on your own pom.xmlWhat ships todayWhat is in the pipelineLinksI pointed a scanner I have been building at an old Spring project, and it flagged javax.activation. …
-
7 New Vulnerabilities in Jackson in One Day: This Is What AI-Assisted Security Research Looks Like
Table of Contents Not a sales pitchWhat Just HappenedHow findings like this are now getting madeThis is mainstreamSeven VulnerabilitiesThe Critical RCEsThe Access Control and Deserialization BypassesThe Validator Is the VulnerabilityThe Creaking Disclosure PipelineWho’s EffectedIf you are on an EOL streamWhat …
-
Quarkus Unpacked: Insights from the Foojay Podcast
Table of Contents What is Quarkus?How does Quarkus compare to Spring, Micronaut, or other frameworks?Is Quarkus more modern because it is newer?Does Quarkus replace the JVM?What is Quarkus live reload?How does build-time optimization work?How does this differ from JIT and …
-
Did AI Just Break Software Security For Ever?
Table of Contents First: The rate of CVE arrivalsSecond: AI detection of vulnerabilities becoming the normThird: The breaking of an old asymmetryFourth: Regulators got impatientThe maths no longer worksThink about Y2KThe response doesn’t wait for the disasterThe asymmetry that should …
-
Spring Boot Migration and the CRA: When Good Enough Isn’t
Table of Contents If You’re Already on 4.0The zombie problem followed youIf You’re Still on 3.5The technical risk is growing. The legal risk is about to change.What “Without Undue Delay” Actually Means NowArticle 14 and the 24-hour clockThe calculation changes …
-
Tiberius: A Security Testing Framework for LLM Applications in Java
Table of Contents 1. The Problem2. What Tiberius Does2.1 Fixture-Based Regression Testing2.2 Guardrail Validation Against Real Attack Data2.3. Probabilistic Security Contracts2.4. Bias Testing2.5. Model Fingerprinting3. Attack Coverage3.1 Buff Mutations4. Integration5. The Case for Shared Attack Datasets6. Security Testing as a …
-
Introducing bx-jwt: Enterprise-Grade JSON Web Tokens for BoxLang
Table of Contents The Fluent Builder — jwtNew()The BIF FunctionsHMAC Sign and VerifyRSA Sign and VerifyJWE Encryptionalg:none RejectionHMAC Minimum Key Lengths (RFC 7518 §3.2)Algorithm AllowlistClock Skew ToleranceAuthentication MiddlewareToken Refresh with Grace PeriodKid-Based Key RotationSigning (JWS)Encryption (JWE) JWT authentication is everywhere. …
-
BoxLang v1.13.0: Compatibility, Concurrency, and Formatter Maturity
Table of Contents New FeaturesCharacter-Aware Trimming — trim(), ltrim(), rtrim()getClassMetadata() by Absolute PathSystemExecute() Environment ControlsThe BoxLang Formatter Goes Production-ReadyAsync & Concurrency HardeningMiniServer: Security & ReliabilityCompatibility WinsChangelog Highlights BoxLang 1.13.0 is a stability-first release with deep compatibility work and runtime hardening. …