The EOL experts. We let your developers focus on mission-critical work, while we keep your open-source stack running in the background. #LifeAfterEOL
Worldwide
- Tweets 1,521
- Following 744
- Followers 2,663
- Likes 3,153
When an open source library hits end-of-life, the risk doesn't announce itself. It accumulates as new CVEs land against code no one is patching.
How Never-Ending Support keeps critical dependencies secure and stable.
#OpenSource #EOL #DevSecOps
1
1
3
301
143 CVEs. 79 projects. One end-of-life release.
Spring Boot 2.7's last open-source version still carries every one of them, and no patch is coming.
#SpringBoot #OpenSource #AppSec #EOL
1
1
1
179
Learn more 🔗 herodevs.com/blog-posts/the-…
51
You can't manage the risk you can't see. Most EOL exposure hides deep in the dependency graph.
A playbook for inventory, risk assessment, and structured transition planning for EOL open source.
#OpenSource #EOL #RiskManagement
1
1
127
Learn more 🔗 herodevs.com/whitepaper/best…
38
Learn more 🔗 herodevs.com/blog-posts/91-s…
39
Some questions look simple until you type them out.
EOL software does not break. It just stops getting patched. Every new vulnerability in that version becomes permanent, and attackers scan for exactly that. 🔎
AryStinger (2026) compromised thousands of EOL routers using bugs from 2013 and 2016. Unpatched, permanent, and that was the whole selection criterion.
Inventory it. Segment it. Then get a real patch stream back.
Full breakdown ↓
#EndOfLife #OpenSource #CyberSecurity #VulnerabilityManagement #AppSec
Made with AI
1
1
1
136
Learn more 🔗 herodevs.com/blog-posts/is-i…
38
HeroDevs retweeted
We are hiring at @herodevs!!! 🚀🚀🚀
We are seeking a Senior-Level Software Engineer with expertise in JavaScript and TypeScript to join our Never-Ending Support (NES) team. In this role, you will help maintain, secure, and extend the lifespan of critical open-source JavaScript frameworks and runtimes such as Angular, React, and Next.js, ensuring long-term stability and security for enterprise customers.
If you want to join an amazing company with incredible people, then think no more and apply! Also, you get the chance to join @villaindevs too! 😂😂😂
herodevsinc.applytojob.com/a…
2
1
3
549
Some exposure doesn't show up on the balance sheet until an auditor finds it.
EOL open source stops getting patches. PCI DSS and GLBA don't stop asking.
#OpenSource #FinTech #Compliance #EndOfLife
1
173
Learn more 🔗 herodevs.com/whitepaper/mana…
45
The bug hunt no longer runs on human hours.
vJUG Connect, live from Amsterdam JUG. Steve Poole moderates two panels on whether AI just broke software security for good.
Uber, Cursor, JetBrains, Sonatype, Snyk, Picnic, Backbase, Rabobank.
🔴 Thursday, Aug 27. 9:00 – 11:30 AM PDT
#Java #AI #AppSec
1
153
The board never gets bigger. The tail does. 🐍
CVE-2026-58043: High-severity allowlist bypass in the Node.js Permission Model. CVSS 7.5.
Grant /data/secret1, /data/secret2, /data/secret3 and the radix tree splits at /data/secret — marking that boundary granted. A file nobody allowlisted becomes readable.
#NodeJS #CVE
1
201
Learn more about CVE-2026-58043 🔗 herodevs.com/blog-posts/cve-…
53
When an open source library hits end-of-life, the risk doesn't announce itself. It accumulates as new CVEs land against code no one is patching.
How Never-Ending Support keeps critical dependencies secure and stable.
#OpenSource #EOL #DevSecOps
1
1
3
301
Learn more 🔗 herodevs.com/whitepaper/miti…
21
A Record component annotated JsonIgnore. A request body sending "is_admin": true. It gets through anyway.
CVE-2026-59888 — 6.5 Medium in jackson-databind. The ignore list is built before the naming strategy renames the key, so the renamed key never matches it.
Fixed in 2.18.8, 2.21.4, 3.1.4. Spring Boot 3.1–3.4 are EOL and won't get it.
#Java #Jackson #SpringBoot
1
2
250
Learn more 🔗 herodevs.com/blog-posts/cve-…
50