Security on foojay.io - Friends Of OpenJDK

Masking a JVM thread dump without breaking the analysis

Wed, 09 Sep 2026 07:32:00 +0000

A few weeks ago I posted on r/java about detecting virtual thread pinning from a plain thread dump. The technical discussion was fine. The comment that stuck with me had nothing to do with pinning: “the problem isn’t taking the dump, it’s that uploading a production dump to a third-party site is against policy”. Not a preference. Policy. And the person saying it was right.

I run ThreadMine, a hosted thread dump analyzer, so that comment describes my own product. This article is about what I built in response: a small open-source CLI that rewrites the dump on your machine before it goes anywhere, in a way that keeps the analysis working. It’s called tm-anon, it’s MIT, and it works with any analyzer, mine included. The interesting part isn’t the tool, it’s the constraint: you can’t just strip everything, because the analyzer needs most of what’s in there.

Solving Gradle metadata and Renovate integration

Wed, 19 Aug 2026 05:53:45 +0000

My current company has settled on using Gradle. It doesn’t make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc.

This week, I worked on improvements to a new project and set up Renovate. Renovate is similar to Dependabot in that it checks for new versions of your dependencies and automatically creates PRs for you. However, I quickly noticed that merges of new dependency versions failed the build. Here’s the full story on why, and how I fixed the issue.

Your AI Assistant Is Choosing Your Dependencies

Tue, 18 Aug 2026 14:01:20 +0000

When I write about bad actors, I sometimes try to imagine where they are and how they work. For this article, it’s clearer than usual because there is some evidence around. You can use your imagination to fill in the gaps.

Imagine there’s a job going in Pyongyang. Long hours, of course, with probably brutal OKRs. The job is creating malicious packages, measured by how many you can publish a week, how many credentials you can steal, etc. The successful candidate will never meet a customer face to face, but they will meet you occasionally via a dependency you add, or one your coding assistant adds for you.

Build Secure AI Chat Applications with BoxLang, RAG, Ollama, and Amazon Bedrock with Dan Card

Thu, 13 Aug 2026 14:52:13 +0000

Build Secure AI Chat Applications with BoxLang, RAG, Ollama, and Amazon Bedrock

AI demos are everywhere. Building an AI-powered feature that can securely work with your documents, databases, and real application data is a very different challenge.

How do you give an AI model access to the right information without exposing sensitive data? Should you use a locally hosted model or a cloud service? How do you move beyond a basic chatbot and build something genuinely useful for your users or organization?

AI Found the Bugs. Who's Patching Your EOL Java Code?

Thu, 23 Jul 2026 15:26:53 +0000

Earlier this year an AI model found a flaw in OpenBSD’s TCP stack that had been sitting there for 27 years. The same scanning run turned up a 16-year-old bug in FFmpeg’s H.264 code.

How do you feel about AI being used to discover bugs in open source, across the board and at scale?

Because that’s what’s happening. It’s tough enough dealing with machine-speed vulnerability discovery in code that has active maintainers. What about all the code with no friendly pair of safe hands?

BoxLang AWS, Azure, and Google Secrets Manager Module Released

Tue, 21 Jul 2026 11:38:18 +0000

Every production application carries secrets: database passwords, API tokens, encryption keys. The question is never whether to manage them – it’s how badly the current approach is going to hurt you.

Hardcoded credentials in config files get committed to repos. Environment variables sprawl across deployment pipelines with no audit trail. Custom integration code for each cloud provider means three different patterns to maintain, test, and rotate. And when a key needs to rotate at 2am? Someone is waking up.

This Dependency Update Looked Exactly Like an Account Takeover

Fri, 03 Jul 2026 08:31:27 +0000

I pointed a scanner I have been building at an old Spring project, and it flagged javax.activation. The bump was 1.1-rev-1 to 1.1.1. Prior releases carried a GPG signature. This one did not.

If you have read the post-mortems of real supply-chain attacks, that pattern should make you sit up. A package that has signed its releases for years suddenly ships one unsigned. The boring explanation is a build pipeline change. The other explanation is that a different person is publishing now, and the signing key stayed behind with the old one. When ua-parser-js was hijacked in 2021, the malicious versions came from a compromised account. When event-stream went bad in 2018, it was a new maintainer nobody had vetted. The artifact looks fine. The metadata around it is what changed.

7 Jackson CVEs in One Day: AI-Assisted Security Research

Mon, 29 Jun 2026 11:47:41 +0000

Quick version check: the affected range for all seven is broadly >=2.10.0 =2.19.0 =3.0.0 <3.1.4 — with some CVEs affecting narrower ranges. If you’re on a supported release, upgrade to 2.18.8, 2.21.4, or 3.1.4. If you’re on an EOL line — 2.13.x, 2.14.x, 2.15.x — jump to the bottom of the page for more specifics or visit HeroDevs Jackson Support

Not a sales pitch

Anyone who knows me knows I dont do that. In this case I’m pointing you at HeroDevs because the Jackson issues are serious, HeroDevs have a solution thats stupidly easy to use and I know the folks behind the fixes. It takes a particular type of engineer to create security fixes and I know they have that skillset. Do your own research.

Quarkus Unpacked: Insights from the Foojay Podcast

Tue, 23 Jun 2026 12:36:54 +0000

I recently had the pleasure of joining the Foojay podcast to talk about Quarkus in depth. The conversation covered a lot of ground, from what makes Quarkus different to the practical trade-offs between JVM and native mode. This post captures the key questions and answers from that discussion, lightly edited for readability.

If you have been following this blog series, note that the third installment on building your own stack with Quarkus is coming next. Consider this a bonus entry that distills the podcast conversation into a format you can read, reference, and share.

Did AI Just Break Software Security For Ever?

Tue, 16 Jun 2026 14:51:04 +0000

Whether the answer is yes or no (read on for my opinion) , something fundamental has changed this year. Not one thing. Four things, converging at once.

First: The rate of CVE arrivals

More than 40,000 CVEs were published in 2024, rising to just under 50,000 in 2025. FIRST — the Forum of Incident Response and Security Teams, projects a median of 68,000 for 2026, with realistic scenarios reaching 70,000 to 100,000.

Spring Boot 3.5 Migration and the CRA: When Good Enough Isn't"

Fri, 05 Jun 2026 08:52:01 +0000

Back in April I wrote about what happens to your security posture when Spring Boot 3.5 crosses the EOL line.

The short version: the CVE pipeline dries up, your scanner goes quiet, and the bad actors keep watching upstream for anything they can exploit downstream against the dead code nobody’s patching.

I called them zombie dependencies.

June 30th is coming. In a few weeks, Spring Boot 3.5 reaches end of open-source support. You’ve either got a plan or you haven’t.

Tiberius: A Security Testing Framework for LLM Applications in Java

Thu, 04 Jun 2026 20:09:09 +0000

Tiberius: A Security Testing Framework for LLM Applications in Java

How do you write a regression test for a system that is non-deterministic by design?

1. The Problem

Large Language Models have moved from research artifacts to production infrastructure. Java applications are embedding them into customer-facing services via Spring Boot, and e.g. LangChain4J — for document summarization, customer support, healthcare assistance, and financial guidance, to name just a few. The deployment surface is growing faster than the security tooling.

Introducing bx-jwt: Enterprise-Grade JSON Web Tokens for BoxLang

Tue, 26 May 2026 10:14:00 +0000

JWT authentication is everywhere. But rolling it correctly — with proper algorithm enforcement, key management, clock skew handling, JWE encryption, and zero security footguns — is anything but trivial. Today, we’re shipping bx-jwt, a production-ready JWT/JWE module for BoxLang that handles all of it out of the box, so you can focus on building, not fighting cryptography.

bx-jwt is part of the BoxLang+ and BoxLang++ subscription tiers — our enterprise-grade module collection built for teams that take security seriously.

BoxLang v1.13.0: Compatibility, Concurrency, and Formatter Maturity

Tue, 19 May 2026 12:11:19 +0000

BoxLang 1.13.0 is a stability-first release with deep compatibility work and runtime hardening. This build closes 48 issues, with the majority focused on CFML compatibility edge cases, concurrency correctness, formatting parity, and miniserver/runtime reliability under real production loads.

While this release is bug-fix heavy, it still introduces several meaningful features and quality-of-life improvements: character-aware trimming, class metadata lookup by absolute path, process environment control in SystemExecute(), SOAP headers, new query column rename capabilities, and safer miniserver routing/security defaults.

Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)

Fri, 15 May 2026 15:31:08 +0000

The Thymeleaf vulnerability with a CVSS score of 9.1 grabs your attention, as it should. But before you call the cavalry and claim this as the new Log4shell, read this first.

CVE-2026-40478 is a server-side template injection vulnerability in Thymeleaf discovered by pentester Dawid Bakaj. Thymeleaf is a templating engine in Java that is used for server-side webpage rendering. The sandbox that normally prevents arbitrary code execution got bypassed using a tab character. And yes, this can lead to a remote code execution if exploited.

Foojay Podcast #95: Is Your Java App Actually Secure, Or Does It Just Look That Way?

Mon, 11 May 2026 09:57:00 +0000

Is your Java application actually secure, or does it just look that way? In this episode of the Foojay Podcast, Frank is joined by Steve Poole and David Welch, both from HeroDevs, to dig deep into the state of Java security in 2025 and beyond.

Steve introduces the concept of zombie dependencies: end-of-life libraries that appear safely dormant but are quietly accumulating vulnerabilities waiting to bite you. David, a co-chair of the CVE Automation Working Group, explains what a CVE actually is, how the identification and disclosure process works in practice, and why AI tools like Mythos are dramatically accelerating the pace at which new vulnerabilities are found — on both sides of the wall.

Spring Boot 3.5 EOL — The CVE Blind Spot Nobody Talks About

Sun, 19 Apr 2026 13:37:13 +0000

Tomorrow I start (o so early) for JCON Europe in Cologne and then, at the tail end of the week, go to Devoxx France to give more talks. If you’re at either, come say hi. Herodevs has a booth at both.

After digging into the CVE stories behind Tomcat 8.5’s end of life, I turned my attention to Spring Boot 3.5. Same question, different framework: what actually happens to your security posture when a project crosses the EOL line?

Why Java Developers Over-Trust AI-Generated Code

Thu, 09 Apr 2026 10:45:36 +0000

This article is adapted from The Confidence Trap, part of the “2026 Supply Chain Reckoning” series on my No Regressions newsletter.

Your boss calls you on a Friday afternoon. He’s read all the available data, he tells you with absolute confidence, and he’s decided that migrating from Spring Boot 3.5 to 4.0 will be straightforward. Wants it done over the weekend.

You’d push back. You’d ask which data. You’d point out the breaking changes.

Best practices for Mastering AI Agents, Subagents, Skills & MCP

Mon, 30 Mar 2026 18:55:59 +0000

A practical guide to the five best practices every developer should apply when working with AI agents, subagents, skills and MCP servers — from choosing the right model and writing precise prompts, to defining agent behaviour with SDD, isolating context with Claude Code subagents, securing MCP calls, and guiding agent response quality with guardrails.

§0 📖 Where This Fits in the Series

This article assumes you already know what MCP is and have used or built at least one Agent.

DPoP: What It Is, How It Works, and Why Bearer Tokens Aren't Enough

Mon, 09 Mar 2026 08:08:06 +0000

DPoP is one of the most exciting developments in the IAM (Identity and Access Management) space in recent years. Yet many backend developers either have not heard of it or are unsure what it actually changes. In this article, I will break down what DPoP is, what problem it solves, and walk through a working implementation with Keycloak and Quarkus.

What is DPoP?

DPoP (Demonstration of Proof-of-Possession) is an OAuth 2.0 security mechanism defined in RFC 9449. Its core purpose is simple: cryptographically bind an access token to the client that requested it. This way, even if a token is intercepted, it cannot be used by another client.

Tomcat TLSv1.3 cipher configuration

Thu, 26 Feb 2026 18:02:34 +0000

A recent update to Apache Tomcat introduced a subtle but significant change to how TLS cipher suites are configured. If your Spring Boot application explicitly configures TLS ciphers, particularly TLSv1.3 ciphers, and runs on Tomcat 9.0.115+ (Spring Boot 2.x), 10.1.52+ (Spring Boot 3.x), or 11.0.18+ (Spring Boot 4.x), your cipher configuration may be silently ignored.

Prior to the change, Tomcat used a single ciphers attribute on the SSL connector to configure cipher suites for all TLS versions. Starting with the versions of Tomcat listed above (Tomcat commit), this attribute was split:

Shai-Hulud and the npm Worm: How Speed-Optimised Dev Ecosystems Made a Self-Propagating Supply Chain Attack Inevitable

Thu, 12 Feb 2026 11:47:48 +0000

first, a word about ecosystems

Before we dive into Shai-Hulud, before we label it “sophisticated” or “advanced” or “next generation,” we need to be honest about something.

The worm didn’t appear in a broken system. It appeared in the one we deliberately optimised.

In the book Dune, the worm is integral to the ecosystem. The planet, its environment, and the worms are deeply interconnected.

That’s true for the cyber-worm equivalent. The worm is an entirely predictable outcome of the ecosystem in which we, as developers, are part

Security Doesn’t Start at Liftoff

Fri, 23 Jan 2026 10:22:31 +0000

This is a follow-on to the article The Real Mechanics of Vulnerabilities in an Upstream/Downstream, Topsy-Turvy EOL World.

What you’ll learn in this article:

The Security Timeline Inversion: CVE disclosure is no longer the true start of the security timeline.
Security Outcomes: Routine maintenance decisions, not reaction speed or tooling, determine security outcomes.
Flawed Indicators: CVE scores, scanners, and compliance deadlines are not effective early-warning systems.
Vulnerability Distortion: Embedded, forked, and end-of-life components obscure vulnerability visibility and responsibility.
Your Mission: Governance and lifecycle changes are necessary to avoid being structurally late to “silent” vulnerabilities.

Are you sitting comfortably?

In February 2025, Apache Tomcat shipped a set of routine point releases. They arrived without urgency, without commentary, and without the kind of noise that can accompany significant security incidents.

SonarQube AI Code Assurance & MCP: Auto-Fix Java (Part 4)

Mon, 19 Jan 2026 15:27:14 +0000

Hola Java developers! 👋

Welcome to the Grand Finale of our series.

Part 1: We turned your IDE into a fortress.
Part 2: We synced the team with Connected Mode.
Part 3: We secured the Supply Chain (dependencies).

We have become excellent at finding bugs. But let’s be honest: Finding them is only half the battle. Who is going to fix them?

We are drowning in a backlog of “Technical Debt,” “Code Smells,” and “Security Hotspots.” You don’t have enough hours in the day to refactor every complex method or research the perfect fix for a regex denial-of-service vulnerability.

Optimizing Java for the Cloud-Native Era with Quarkus

Tue, 06 Jan 2026 21:09:00 +0000

This article explores how Quarkus can help organizations reduce costs, streamline development, and modernize their Java applications for today’s cloud-native environments. It outlines the real-world benefits of adopting Quarkus and highlights how its core features address the performance and scalability challenges commonly associated with traditional Java frameworks.

Quarkus is already being adopted across industries. One example is Orange, a global telecom provider that selected Quarkus to support its 5G API initiative, and benefited from fast startup times, a lightweight footprint, and seamless integration with Kubernetes.

Quarkus: A Runtime and Framework for Cloud-Native Java

Tue, 06 Jan 2026 13:46:50 +0000

Public clouds such as AWS, Microsoft Azure, and Google Cloud, and platforms like Red Hat OpenShift, favor services that start fast and stay lean. Quarkus is engineered for exactly that.

Build time processing reduces runtime overhead and results in rapid startup, a small memory footprint, and frictionless deployment across Kubernetes, OpenShift, serverless, and managed container services in any cloud. If your Java services need to start in milliseconds, run dense on shared nodes, and still feel great to build, Quarkus was made for that job.

Stop the trojan horse in your pom: SonarQube Advace Security

Mon, 22 Dec 2025 10:42:41 +0000

Hola Java developers! 👋

Welcome to Part 3.

In Part 1, we turned your IntelliJ into a security guard.
In Part 2, we connected it to the server to enforce the Quality Gate.

We are feeling good. Our code is high quality. Our logic is sound. But here is the scary reality: In a modern Spring Boot application, you only wrote about 10% of the code.

The other 90%? It comes from Maven Central. It’s Hibernate, Jackson, Apache Commons, Spring Security… You are building a house, and you made sure your bricks are solid. But did you check if the foundation you bought from a stranger is made of explosive material? 🧨

The Real Mechanics of Vulnerabilities in an Upstream/Downstream, Topsy-Turvy EOL World

Fri, 19 Dec 2025 13:36:28 +0000

In this article you’ll learn

Why CVEs record that a vulnerability exists, not that a usable fix exists
How vulnerabilities are often discovered and fixed downstream before upstream ever acknowledges them
Why EOL branches continue to accumulate exploitable behaviour even when no CVEs appear
How downstream-only patches break the assumptions scanners and SBOMs rely on
What disclosure actually enables when “just upgrade” is not a viable option

Introduction

There is a tidy, almost academic version of how software security is supposed to work. It appears in conference talks, compliance documents and in the cheerful diagrams seen on marketing slides. It usually looks something like this:

The 5 Knights of the MCP Apocalypse

Tue, 09 Dec 2025 15:55:41 +0000

Let’s talk about that new MCP (Model Context Protocol) Server your team is using to connect to your real data services. It’s awesome, right? It’s the “magic box” that gives your AI Agent access to the real world—live databases, internal APIs, and all your tools.

But here’s the catch: you don’t own the code. 🚫

It’s a vendor product, an open-source project, or another team’s platform. You can’t just change its code when you find a security hole, unless you have the code and recompile it and deploy it.

Java Security Starts with the JVM

Mon, 10 Nov 2025 12:37:20 +0000

When it comes to Java security, the first thing that comes to mind should be the JVM. If you’re relying on outdated, unpatched, or unsupported Java runtimes, you’re taking unnecessary risks.

In this article, you will learn:

Timely, predictable updates are critical for Java security
Long-term security hinges on long-term support
If your Java runtime is compromised, every application that runs on it could be compromised too
As environments become cluttered with multiple JDK versions and unpatched workloads, organizations lose visibility into what’s deployed

When it comes to securing your Java applications, the JVM might not be the first thing that comes to mind—but it should be. Your JDK isn’t just a runtime; it’s part of your software supply chain. If you’re relying on outdated, unpatched, or unsupported Java runtimes, you’re taking unnecessary risks.