AI Found the Bugs. Who's Patching Your EOL Java Code?
AI finds decades-old flaws at machine speed, but the fixes only reach supported versions. What that means for end-of-life Java, and what to …
Security
BoxLang AWS, Azure, and Google Secrets Manager Module Released
Every production application carries secrets: database passwords, API tokens, encryption keys. The question is never whether to manage them …
This Dependency Update Looked Exactly Like an Account Takeover
I pointed a scanner I have been building at an old Spring project, and it flagged javax.activation. The bump was 1.1-rev-1 to 1.1.1. Prior …
7 Jackson CVEs in One Day: AI-Assisted Security Research
Seven jackson-databind vulnerabilities, one researcher, one day. Two critical RCEs. This is AI-assisted security research in practice.
Quarkus Unpacked: Insights from the Foojay Podcast
I recently had the pleasure of joining the Foojay podcast to talk about Quarkus in depth. The conversation covered a lot of ground, from …
Did AI Just Break Software Security For Ever?
AI finds exploits in hours. Patch cycles run 30–60 days. EOL software gets neither. Here's what changed in 2026 and what to do about it.
Spring Boot 3.5 Migration and the CRA: When Good Enough Isn't"
Spring Boot 3.5 reaches EOL on June 30. The legal context is about to change. Here's what 'without undue delay' means when commercial …
Tiberius: A Security Testing Framework for LLM Applications in Java
Tiberius: A Security Testing Framework for LLM Applications in Java How do you write a regression test for a system that is …
Introducing bx-jwt: Enterprise-Grade JSON Web Tokens for BoxLang
JWT authentication is everywhere. But rolling it correctly — with proper algorithm enforcement, key management, clock skew handling, JWE …
BoxLang v1.13.0: Compatibility, Concurrency, and Formatter Maturity
BoxLang 1.13.0 is a stability-first release with deep compatibility work and runtime hardening. This build closes 48 issues, with the …