Java

Java library vulnerabilities: IBM and Red Hat fix 400+ previously unknown flaws

October 8, 2026

IBM and Red Hat have found and fixed more than 400 previously unknown vulnerabilities in widely used Java libraries through Lightwell, their program for patching open source …

Pre-auth RCE in enterprise Java hits Bonita and OFBiz servers

August 5, 2026

An attacker sends a single web request to a Bonita server and lands inside an internal API that assumed nobody could reach it. The request arrives unauthenticated. From there …

Java 26 ships with new cryptography API and HTTP/3 support

March 19, 2026

Oracle released JDK 26, the 17th consecutive feature release delivered under the six-month cadence the project adopted in 2018. The release includes ten JDK Enhancement …

Java security work is becoming a daily operational burden

February 12, 2026

Security teams in large enterprises already spend significant time tracking vulnerabilities across software supply chains, third-party libraries, and internal codebases. Java …

PRevent: Open-source tool to detect malicious code in pull requests

February 20, 2025

Apiiro security researchers have released open source tools that can help organizations detect malicious code as part of their software development lifecycle: PRevent (a …

Critical RCE bug in SolarWinds Web Help Desk fixed (CVE-2024-28986)

August 15, 2024

SolarWinds has fixed a critical vulnerability (CVE-2024-28986) in its Web Help Desk (WHD) solution that may allow attackers to run commands on the host machine. “While …

Users of JetBrains IDEs at risk of GitHub access token compromise (CVE-2024-37051)

June 11, 2024

JetBrains has fixed a critical vulnerability (CVE-2024-37051) that could expose users of its integrated development environments (IDEs) to GitHub access token compromise. …

The hidden costs of Java, and the impact of pricing changes

November 1, 2023

An overwhelming 98% of all the businesses surveyed use Java in their software applications or infrastructure, and 57% of those organizations indicate that Java is the backbone …

Google delivers secure open source software packages

April 13, 2023

Google has announced the Google Cloud Assured Open Source Software (Assured OSS) service, which aims to be a trusted source of secure open source packages, and the deps.dev …

CI Fuzz CLI: Open-source tool to test Java apps for unexpected behaviors

December 2, 2022

CI Fuzz CLI, the open-source Command-Line Interface (CLI) tool from Code Intelligence, now allows Java developers to easily incorporate fuzz testing into their existing JUnit …

Consumer behaviors are the root of open source risk

October 24, 2022

Sonatype unveiled its eighth annual State of the Software Supply Chain Report which, in addition to a massive surge in open source supply, demand, and malicious attacks, found …

Apache Commons Text flaw is not a repeat of Log4Shell (CVE-2022-42889)

October 19, 2022

A freshly fixed vulnerability (CVE-2022-42889) in the Apache Commons Text library has been getting attention from security researchers these last few days, worrying it could …