HeroDevs

Join us May 27 for a live conversation with two members of the Node.js Technical Steering Committee — Matteo Collina (Chair) and Marco Ippolito — moderated by HeroDevs' Javier Perez. On the agenda ✍️ → The path to Node 27 LTS and the new release cadence → Vulnerability handling in the age of AI-generated CVE reports → Staying secure on Node 20 when you can't migrate yet 📅 May 27, 2026 | 11:00 AM EST | Free registration Register → herodevs.com/from-node-20-e… #NodeJS #OpenSource #EndOfLife #DevSecOps #JavaScript #HeroDevs

66% of organizations still aren't familiar with the EU Cyber Resilience Act. Its main obligations hit December 2027. 🏁 Inventory and remediation take months — not weeks. Drop-in replacements close the gap without derailing your roadmap. #CRA #CyberResilienceAct

Bootstrap powers ~19% of the web. Bootstrap 2, 3, and 4 are all end-of-life — no upstream patches, and unfixed XSS CVEs stacking up (CVE-2024-6485, CVE-2025-1647, CVE-2024-6531). Only Bootstrap 5 is still supported. HeroDevs patches the rest. #Bootstrap #CyberSecurity #EOL #OpenSource

AI can write your code. It can't guarantee it's safe. Even the newest models train on data with a shelf life—ask one to scaffold a project and it may pull a library version that's already EOL or carrying known CVEs. #AppSec #AICoding #DevSecOps

🚨 Node.js rounded up 12 CVEs in its June 2026 release, 2 High. Ten reach EOL Node 18 & 20 — 135M+ downloads in June, zero upstream fixes. The pattern to watch: TLS/mTLS trust failures rooted in hostname handling. EOL ≠ unsupported. HeroDevs NES keeps Node 18 & 20 covered. #NodeJS #CVE #AppSec

Anthropic added an in-app browser to Claude Code's desktop app — agents can now read docs, click through sites, and debug their own running apps without leaving the window. The dev toolchain keeps collapsing into the agent. 9to5mac.com/2026/07/10/ant…

Bun just ported 535,000 lines of Zig to Rust in 11 days using AI agents. The footnotes: ~13,000 unsafe blocks and 19 regressions before it stabilized. AI can move legacy code fast. Keeping it safe and supported afterward is still the hard part. bun.com/blog/bun-in-ru…

6 of the 8 major #NextJS versions are past end-of-life. v14 hit EOL on Oct 26, 2025 — and 26 CVEs are now sitting unpatched on end-of-life lines, including a critical 9.1 middleware auth bypass (CVE-2025-29927). #WebSecurity #CVE

Ubiquiti patched 7 critical UniFi OS flaws including CVE-2026-50746 (CVSS 10.0) — a no-auth command injection with 100,000+ instances internet-exposed. Six flaws need no user interaction. A prior UniFi chain hit CISA KEV in June. Update now. #CyberSecurity #InfoSec bleepingcomputer.com/news/security/…

CISA added 4 exploited CVEs to KEV: Adobe ColdFusion (CVSS 10.0, exploited within hours of patch), Langflow IDOR used to steal LLM and AWS keys, and two Joomla RCE flaws. Federal agencies must patch by July 10. #CyberSecurity #DevSecOps securityweek.com/cisa-urges-imm…

17 malicious npm/PyPI packages posed as payment SDKs (PaySafe, Skrill, Neteller) to harvest CI/CD secrets and API keys. The packages used sandbox-evasion and exfiltrated data via ngrok. Audit your lockfiles and rotate secrets now. #SupplyChain #DevSecOps gbhackers.com/npm-and-pypi-m…

Link to full documentary🔗 youtube.com/watch?v=0Gb1z-…

Running an unsupported version of Spring? The risk isn't just technical debt. Yes, your team stops learning and the stack drifts. But the bigger problem is quieter: old software keeps getting new security vulnerabilities, even when the code never changes. The version stayed still. The threat landscape didn't. #Spring #EndOfLife #CyberSecurity #OpenSource #CVE

8 MessagePack for .NET advisories dropped in June 2026. CVE-2026-48109 is the headline. High severity (CVSS 8.2). Out-of-bounds read in the LZ4 path. A crafted payload crashes the process. No try/catch saves it. The fix is easy: MessagePack 2.5.301 or 3.1.7. Unless you're on .NET 6. The EOL SignalR pin freezes MessagePack at 2.1.90 — and Microsoft won't ship another serviced release. That's how end-of-life turns a one-line fix into an unreachable one. HeroDevs NES for .NET delivers the patched builds. Stay secure, migrate on your own timeline. #dotnet #CVE #OpenSourceSecurity #EndOfLife

Spring just had its worst month on record. 🚨 67 CVEs in June — nearly 4x all of 2025, almost half high severity. The catch: once your Spring version goes end of life, new CVEs stop getting evaluated against it. The flaw stays in your code, but your scanner has nothing to match it to. So it reports you clean while attackers see the gap. HeroDevs Never-Ending Support patches the CVEs upstream won't touch — including the silent ones. Security coverage shouldn't have an expiration date. #Spring #CVE #OpenSourceSecurity #EndOfLife #NeverEndingSupport #AppSec

Linux kernel 'Bad Epoll' (CVE-2026-46242) lets any local user get root on servers, desktops, and Android — 99% exploit reliability, no workaround, public PoC out. Affects kernel 5.10-6.11. Patch now; epoll cannot be disabled. #CyberSecurity #DevSecOps thehackernews.com/2026/07/new-ba…

Adobe ColdFusion CVE-2026-48282 (CVSS 10.0) is being actively exploited — attackers hit honeypots within 2 hours of disclosure. ~800 exposed instances online. Patch to ColdFusion 2025 Update 10 or 2023 Update 21 immediately. #CyberSecurity #InfoSec bleepingcomputer.com/news/security/…

AI can generate a million lines before lunch. It can't sign off on a single one. The model writes. The engineer owns it — the review, the CVE, the 2 a.m. page, the audit. AI didn't replace engineering. It raised the price of getting it wrong. 📈 #AI #SoftwareEngineering #AppSec #SupplyChainSecurity #TechnicalDebt

Rancher disclosed 3 critical CVEs on July 1 — including CVE-2026-41052 (CVSS 9.4) enabling full host takeover from a low-privileged project role, plus Fleet secret disclosure and command injection. Patch to Rancher 2.12.10, 2.13.6, or 2.14.2. #DevSecOps #CyberSecurity github.com/advisories?que…

Keycloak 26.6.4 fixes CVE-2026-9795 (High) — privilege escalation via improper scope mapping lets a limited admin inject any realm role into user tokens. Also patches auth bypass and UMA ticket abuse. Upgrade if you run Keycloak FGAPv2. #OpenSource #DevSecOps keycloak.org/2026/06/keyclo…

Ten compliance badges. Two Australian regulators. One you can't earn on end-of-life open source. APRA CPS 230 + the SOCI Act are fully in force. But when a CVE hits an EOL framework, there's no patch, no vendor to register, no remediation plan to write. HeroDevs NES closes the gap. → herodevs.com/blog-posts/apr… #Compliance #OpenSource #APRA