Social Media Ideas for Maven Security

Dependency Confusion Attacks in Maven: How They Work and Why Your settings.xml Makes You Vulnerable

In 2021, a security researcher breached Apple, Microsoft, PayPal, and 32 other organisations without writing a single exploit. He just uploaded a package. This article explains exa...

Security Baked Into the JVM: why fork Apache River and OpenJDK?

The more distributed a system, the harder it is to secure. Code crosses JVM boundaries. Objects are serialized across trust boundaries. Third-party proxies run inside your process....

Top Java Security Vulnerabilities and How to Prevent Them in Modern Java

With the increasing number of security threats, organizations have invested heavily in cybersecurity initiatives to protect their applications, infrastructure, and sensitive data....

Detecting Bugs and Vulnerabilities in Java With SonarQube

The security audit report landed unexpectedly. It highlighted a critical vulnerability in our payment processing module. We had passed all unit tests. We had passed all integration...

MCP Security Starts After Tool Approval | Focused Labs

Approving an MCP server once for production is the first step in securing MCP. The real danger comes after that when the surface that the model is interacting with changes slowly b...

A Complete Guide to MFA in Spring Security 7

Multi-Factor Authentication (MFA) is a security mechanism that requires users to verify their identity using multiple authentication methods before gaining access to an application...

Homebrew to Packages: No ID, No Service

Homebrew, the unofficial but default package manager for many Apple Mac users, now has safeguards to prevent supply-chain attacks. The approach mimics how GitHub just fortified npm...

Valid certificates, stolen accounts: how attackers broke npm's last trust signal

On May 19, 633 malicious npm package versions passed Sigstore provenance verification. They were cleared by the system because the attacker had generated valid signing certificates...

Apache CXF Flaw Exposes Systems to LDAP Injection Attacks

Apache CXF users are facing a significant security risk following the disclosure of a new vulnerability that exposes systems to LDAP injection attacks, potentially allowing unautho...

Authorization using jCasbin

Learn how to use jCasbin to define an access control model for Java applications, making use of standard approaches such as ACLs and RBAC. The post Authorization using jCasbin fir...

Securing Financial APIs in 2026: Implementing Global Request Interceptors and Automated Audit Trails in Spring Boot

With the recent surge in security vulnerabilities across the Spring ecosystem in the first half of 2026, relying on scattered security validation inside individual REST controllers...

Shai-Hulud Clone ‘Miasma’ Compromises 32 Red Hat npm Packages

The threat group behind the notorious Mini Shai-Hulud worm last month put the complete source code for the malware into a GitHub repository, essentially open sourcing the threat so...

Survey: Spring Developers Have a Blindspot When It Comes to Container Security

SAN JOSE — A survey from BellSoft found that Spring developers don’t know their Dockerfiles affect their security posture, aren’t using hardened images and can’t name their complia...

The New Shape of Supply-Chain Trust

One poisoned extension, one package install, one CI workflow. Any of them can now be the first domino. That is the uncomfortable lesson from the latest Shai-Hulud activity and Git...

Architectural Collapse: How Extension Poisoning, Node Vulnerabilities, and Infrastructure Fog Enabled the GitHub Reposit...

Enterprise perimeter defenses are fundamentally built on an obsolete assumption that the developer’s workstation is a secure, trusted anchor point. The massive security breach exec...

The attack that hijacked Claude Code came through Sentry. Datadog, PagerDuty, and Jira have the same exposure.

A single fake error report hijacked Claude Code in controlled testing — the agent ran the attacker's code with the developer's full privileges, and not one alert fired. EDR, WAF, I...

The Design Layer and Your Security Stack: A Practical Integration Guide

The governance layer is well-built. The detection layer is well-funded. The design layer is the upstream question neither answers — and it is complementary to both....

Quantum-Resistant ML-KEM and ML-DSA in Java

Learn how to use quantum-resistant ML-KEM and ML-DSA in Java to securely establish a shared secret key. The post Quantum-Resistant ML-KEM and ML-DSA in Java first appeared on Bael...

Azul Addresses the Java Runtime Security Blind Spot Autonomous AI Can Now Exploit

Azul launched a free JVM vulnerability risk assessment to address the blind spot that autonomous AI exploitation tools are increasingly

Securing Amazon Bedrock and SageMaker Endpoints: A Practitioner's Guide

In November 2025, a Sysdig research team watched an attacker compromise an AWS environment, enumerate Amazon Bedrock, disable model invocation logging, and achieve full administrat...

Hugo van Kemenade: Security: line goes up

Like many other projects, CPython is experiencing a huge increase in security reports. CVEs per year #Last month, PSF Security Developer-in-Residence Seth Larson posted a chart of...

Основы Spring security

В данной статье я подробно и простыми словами описал, как работает Spring Security, что он делает, как и за счёт чего он обеспечивает безопасность приложения. Читать далее

Oxygen XML Editor, Author and Developer Desktop - Security and Data Integrity

Securing the AI Host: Spring AI MCP Server Communication With API Keys

Abstract This is a continuation of the first article in this series, Building a Spring AI Assistant with MCP Servers: A Step-by-Step Tutorial, and describes how one may address a s...