7 Jackson CVEs in One Day: AI-Assisted Security Research
Seven jackson-databind vulnerabilities, one researcher, one day. Two critical RCEs. This is AI-assisted security research in practice.
Security
Quarkus Unpacked: Insights from the Foojay Podcast
I recently had the pleasure of joining the Foojay podcast to talk about Quarkus in depth. The conversation covered a lot of ground, from …
Did AI Just Break Software Security For Ever?
AI finds exploits in hours. Patch cycles run 30–60 days. EOL software gets neither. Here's what changed in 2026 and what to do about it.
Spring Boot 3.5 Migration and the CRA: When Good Enough Isn't"
Spring Boot 3.5 reaches EOL on June 30. The legal context is about to change. Here's what 'without undue delay' means when commercial …
Tiberius: A Security Testing Framework for LLM Applications in Java
Tiberius: A Security Testing Framework for LLM Applications in Java How do you write a regression test for a system that is …
Introducing bx-jwt: Enterprise-Grade JSON Web Tokens for BoxLang
JWT authentication is everywhere. But rolling it correctly — with proper algorithm enforcement, key management, clock skew handling, JWE …
BoxLang v1.13.0: Compatibility, Concurrency, and Formatter Maturity
BoxLang 1.13.0 is a stability-first release with deep compatibility work and runtime hardening. This build closes 48 issues, with the …
Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)
The Thymeleaf vulnerability with a CVSS score of 9.1 grabs your attention, as it should. But before you call the cavalry and claim this as …
1,115 viewsFoojay Podcast #95: Is Your Java App Actually Secure, Or Does It Just Look That Way?
Is your Java application actually secure, or does it just look that way? In this episode of the Foojay Podcast, Frank is joined by Steve …
Spring Boot 3.5 EOL — The CVE Blind Spot Nobody Talks About
Spring Boot 3.5 goes EOL June 30, 2026. But the real risk isn't the migration. It's what happens to CVE reporting once a project reaches end …