HeroDevs

The EOL experts. We let your developers focus on mission-critical work, while we keep your open-source stack running in the background. #LifeAfterEOL

[HeroDevs @herodevs]

When an open source library hits end-of-life, the risk doesn't announce itself. It accumulates as new CVEs land against code no one is patching.
How Never-Ending Support keeps critical dependencies secure and stable.

#OpenSource #EOL #DevSecOps

[HeroDevs @herodevs]

https://t.co/8bltg4MXMw

[HeroDevs @herodevs]

Your EOL open source stack isn't tech debt anymore — it's a compliance liability.

CRA reporting duties kicked in this month, and they apply to products already shipped. Join our COO live to see where EOL becomes a finding under CRA, NIS2 & DORA.

🗓️ Sept 17, 11am ET
Link in comments.

[HeroDevs @herodevs]

Learn more 🔗 https://t.co/IKCZ31lMVT

[HeroDevs @herodevs]

143 CVEs. 79 projects. One end-of-life release.

Spring Boot 2.7's last open-source version still carries every one of them, and no patch is coming.

#SpringBoot #OpenSource #AppSec #EOL

[HeroDevs @herodevs]

Learn more 🔗 https://t.co/DM7z4eFfp9

[HeroDevs @herodevs]

You can't manage the risk you can't see. Most EOL exposure hides deep in the dependency graph.
A playbook for inventory, risk assessment, and structured transition planning for EOL open source.
#OpenSource #EOL #RiskManagement

[HeroDevs @herodevs]

Learn more 🔗 https://t.co/5qfvnDdwoU

[HeroDevs @herodevs]

One day. 91 Spring security advisories. 20 projects.All of 2025 produced 16.Most aren't in NVD yet — if your scanner is quiet, that's the feed lagging, not you being fine.#Spring #Java #CVE

[HeroDevs @herodevs]

Learn more 🔗 https://t.co/wLfnZeCAEq

[HeroDevs @herodevs]

Some questions look simple until you type them out.
EOL software does not break. It just stops getting patched. Every new vulnerability in that version becomes permanent, and attackers scan for exactly that. 🔎

AryStinger (2026) compromised thousands of EOL routers using bugs from 2013 and 2016. Unpatched, permanent, and that was the whole selection criterion.
Inventory it. Segment it. Then get a real patch stream back.

Full breakdown ↓
#EndOfLife #OpenSource #CyberSecurity #VulnerabilityManagement #AppSec

[Eduardo Roth @eduardoRoth]

We are hiring at @herodevs!!! 🚀🚀🚀

We are seeking a Senior-Level Software Engineer with expertise in JavaScript and TypeScript to join our Never-Ending Support (NES) team. In this role, you will help maintain, secure, and extend the lifespan of critical open-source JavaScript frameworks and runtimes such as Angular, React, and Next.js, ensuring long-term stability and security for enterprise customers.

If you want to join an amazing company with incredible people, then think no more and apply! Also, you get the chance to join @villaindevs too! 😂😂😂

https://t.co/SwCWuWTGcD

[HeroDevs @herodevs]

Learn more 🔗 https://t.co/pyDQ0bRtUX

[HeroDevs @herodevs]

Some exposure doesn't show up on the balance sheet until an auditor finds it.

EOL open source stops getting patches. PCI DSS and GLBA don't stop asking.

#OpenSource #FinTech #Compliance #EndOfLife

[HeroDevs @herodevs]

Register here → https://t.co/ZlsEjVK2Tg

[HeroDevs @herodevs]

The bug hunt no longer runs on human hours.

vJUG Connect, live from Amsterdam JUG. Steve Poole moderates two panels on whether AI just broke software security for good.

Uber, Cursor, JetBrains, Sonatype, Snyk, Picnic, Backbase, Rabobank.

🔴 Thursday, Aug 27. 9:00 – 11:30 AM PDT

#Java #AI #AppSec

[HeroDevs @herodevs]

Learn more about CVE-2026-58043 🔗 https://t.co/thqTvorQjm

[HeroDevs @herodevs]

The board never gets bigger. The tail does. 🐍

CVE-2026-58043: High-severity allowlist bypass in the Node.js Permission Model. CVSS 7.5.

Grant /data/secret1, /data/secret2, /data/secret3 and the radix tree splits at /data/secret — marking that boundary granted. A file nobody allowlisted becomes readable.

#NodeJS #CVE

[HeroDevs @herodevs]

Learn more 🔗 https://t.co/DTteFycZQF

[HeroDevs @herodevs]

When an open source library hits end-of-life, the risk doesn't announce itself. It accumulates as new CVEs land against code no one is patching.
How Never-Ending Support keeps critical dependencies secure and stable.

#OpenSource #EOL #DevSecOps

[HeroDevs @herodevs]

Learn more 🔗 https://t.co/lMDaTJdtgw

[HeroDevs @herodevs]

A Record component annotated JsonIgnore. A request body sending "is_admin": true. It gets through anyway.
CVE-2026-59888 — 6.5 Medium in jackson-databind. The ignore list is built before the naming strategy renames the key, so the renamed key never matches it.
Fixed in 2.18.8, 2.21.4, 3.1.4. Spring Boot 3.1–3.4 are EOL and won't get it.
#Java #Jackson #SpringBoot