@herodevs
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States App Store
Account-level information from X, not a live location or the device used for a specific post.
The EOL experts. We let your developers focus on mission-critical work, while we keep your open-source stack running in the background. #LifeAfterEOL
Worldwide
Joined January 2018
- Tweets1.5K
- Following745
- Followers2.7K
- Likes3.2K
Pinned Tweet
When an open source library hits end-of-life, the risk doesn't announce itself. It accumulates as new CVEs land against code no one is patching.
How Never-Ending Support keeps critical dependencies secure and stable.
#OpenSource #EOL #DevSecOps
143 CVEs. 79 projects. One end-of-life release.
Spring Boot 2.7's last open-source version still carries every one of them, and no patch is coming.
#SpringBoot #OpenSource #AppSec #EOL
You can't manage the risk you can't see. Most EOL exposure hides deep in the dependency graph.
A playbook for inventory, risk assessment, and structured transition planning for EOL open source.
#OpenSource #EOL #RiskManagement
Learn more 🔗 herodevs.com/blog-posts/91-s…
Some questions look simple until you type them out.
EOL software does not break. It just stops getting patched. Every new vulnerability in that version becomes permanent, and attackers scan for exactly that. 🔎
AryStinger (2026) compromised thousands of EOL routers using bugs from 2013 and 2016. Unpatched, permanent, and that was the whole selection criterion.
Inventory it. Segment it. Then get a real patch stream back.
Full breakdown ↓
#EndOfLife #OpenSource #CyberSecurity #VulnerabilityManagement #AppSec
🤖 Made with AI
HeroDevs retweeted
We are hiring at @herodevs!!! 🚀🚀🚀
We are seeking a Senior-Level Software Engineer with expertise in JavaScript and TypeScript to join our Never-Ending Support (NES) team. In this role, you will help maintain, secure, and extend the lifespan of critical open-source JavaScript frameworks and runtimes such as Angular, React, and Next.js, ensuring long-term stability and security for enterprise customers.
If you want to join an amazing company with incredible people, then think no more and apply! Also, you get the chance to join @villaindevs too! 😂😂😂
herodevsinc.applytojob.com/a…
Some exposure doesn't show up on the balance sheet until an auditor finds it.
EOL open source stops getting patches. PCI DSS and GLBA don't stop asking.
#OpenSource #FinTech #Compliance #EndOfLife
Learn more 🔗 herodevs.com/whitepaper/mana…
The board never gets bigger. The tail does. 🐍
CVE-2026-58043: High-severity allowlist bypass in the Node.js Permission Model. CVSS 7.5.
Grant /data/secret1, /data/secret2, /data/secret3 and the radix tree splits at /data/secret — marking that boundary granted. A file nobody allowlisted becomes readable.
#NodeJS #CVE
Learn more about CVE-2026-58043 🔗 herodevs.com/blog-posts/cve-…
Learn more 🔗 herodevs.com/whitepaper/miti…
A Record component annotated JsonIgnore. A request body sending "is_admin": true. It gets through anyway.
CVE-2026-59888 — 6.5 Medium in jackson-databind. The ignore list is built before the naming strategy renames the key, so the renamed key never matches it.
Fixed in 2.18.8, 2.21.4, 3.1.4. Spring Boot 3.1–3.4 are EOL and won't get it.
#Java #Jackson #SpringBoot
Learn more 🔗 herodevs.com/blog-posts/cve-…
