1/ WHAT AN INSANE AND SCARY week in security. It's only going to get worse. Here's what happened in the last 7 days. If you write code for a living, a lot of this hits close to home. 🧵 2/ LiteLLM got hit by a supply chain attack. Version 1.107.0 on PyPI and Docker shipped a credential stealer and a backdoor. The likely cause? Stolen GitHub CLI tokens from three engineers. Pin to 1.106.2 and rotate your cloud and AI keys. 3/ PHP shipped emergency patches for two critical RCE flaws (PHP2Shell). No login needed. Someone tried to exploit it 4 days before it was even public. Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. 4/ GitLab has a CVSS 10.0 flaw. Unauthenticated code execution on self-managed instances. It affects every version back to 7.0. That's 12 years of releases. 5/ Node.js has a Brotli decoder bug that could allow remote code execution. Fixed in 22.23.4, 24.22.1 and 26.12.1. Still on Node 20? No fix is coming. It's end of life. 6/ AI coding tools are a target now too. OpenCode had a flaw that let a malicious MCP server run code on your machine during sign-in (Windows and WSL). Update to 1.18.33. Be careful which MCP servers you connect to. 7/ Secrets are leaking everywhere. Railway says an intruder may have read customer environment variables. Meta had GitHub repos accessed with stolen employee credentials. If your secrets live on a platform, plan for the day you have to rotate them. 8/ Zero-days in the tools meant to keep us safe. BeyondTrust Remote Support was exploited for weeks before anyone knew. Ivanti Connect Secure is being chained into root access. Both are on CISA's exploited list. 9/ And it's not just software. Attackers heated supermarket fridges in France to 50°C. Some hardware wallets bought through resellers had implants that steal seed phrases. SafePay ransomware has hit 600+ orgs and wipes backups. 10/ Why do I think it gets worse? Researchers used a public AI model to build a full Chrome exploit in 6 days. Attackers are using AI agents to break into companies at scale. Finding bugs is getting cheap. Patching is not. 11/ What you can do this week: • Update PHP, Node and GitLab • Pin your dependencies • Rotate tokens you haven't touched in a while • Turn on 2FA everywhere, especially GitHub • Review the MCP servers and AI tools you've installed Stay safe out there. 🔒

Spring Cloud Bus has been consolidated into Spring Cloud Stream. The 5.0.x branch remains in the Bus GitHub repo until OSS support for it ends at the end of July 2027. github.com/spring-cloud/spri… The docs in the new location. docs.spring.io/spring-cloud-…

The Spring Cloud team is pleased to announce the release of Spring Cloud 2025.1.4 and 2026.0.0-RC1. 2026.0.0-RC1 contains a number of features to try out and 2025.1.4 contains several important fixes. spring.io/blog/2026/10/23/sp… spring.io/blog/2026/10/23/sp…

Spring AI 2.1.0-M1 is out 🍃 🧩 Message parts: ordered text, reasoning, tool calls & media 🤖 OpenAI Responses API: reasoning + tool calling on GPT-5.4+ 📥 VectorStore.upsert() for pre-computed embeddings Feedback welcome: spring.io/blog/2026/09/25/sp… #SpringAI #Java

On behalf of the Spring Cloud team we are please to announce the first milestone of Spring Cloud 2026.0.0. This is the first release of Spring Cloud which is compatible with Spring Boot 4.2.x. See our blog for more details: spring.io/blog/2026/09/24/sp…

The Spring release train has been updated from a two week long train to a single day 🤯 spring.io/blog/2026/09/21/re…

The #Devnexus #CFP has been extended to September 30. We would love to hear from you. Submit your talk(s) at devnexus.com

I did a video which I think you might enjoy if you really want to understand how to approach Spring and @SpringBoot, from a very fundamental perspective. Watch this, understand it, and I promise you'll be MUCH better prepared for working with Spring Enjoy! piped.video/watch?v=R6XF9x49…

Not a small Feat. #springofficehours #PhilWebb watch more at piped.video/live/4MYFKQkvwNw…

Spring Office Hours: S5E17 - Spring Boot 4.1 with Phil Webb nitter.siddz.com/i/broadcasts/1yJAPPelg…

Yup! It's official, @springcloud contract goes to stubborn.sh !

Today, we are announcing a transition for Spring Cloud Contract. All maintenance, support, and ownership of the project will be officially transferred to one of its original creators, @MGrzejszczak , under Stubborn.sh spring.io/blog/2026/07/06/sp…

Episode 8 of Fundamentals of Software Engineering is up. Nate and I dig into open source sustainability, AI tooling realities, and why the token crisis matters for developers. Catch the recording here👇🏻 piped.video/kaY8uvnbfis

the new @SpringBoot 4.1 brings with it a ton of nice new features including auto configuration for @MongoDB-backed @springbatch job repositories. I wrote about it here! spring.io/blog/2026/06/21/sp…

No, Broadcom did not close source Spring. Spring is still Apache 2.0. Still on GitHub. Patches still ship to the public repos. Nothing about the license changed. But there's a real story here, and it's bigger than Spring. 🧵

🚀 Spring AI 2.0.0 GA is now available! 🏗️ Improved foundations: Spring Boot 4 baseline, null-safety, Jackson 3, re-designed options 🤖 Agentic improvements: unified tool calling, tool search, self-correcting output 🔌 MCP 2025-11-25 spec integration spring.io/blog/2026/06/12/sp…

The Spring Cloud team is pleased to announce the release of Spring Cloud 2025.1.2. This release contains bug and CVE fixes and a handful of enhancements. In addition this releases introduces compatibility with @springboot 4.1.0. spring.io/blog/2026/06/11/sp…

The Spring Cloud team is pleased to announce the release of Spring Cloud 2025.0.3. This release contains bug and CVE fixes. In addition, this will be the final open source release of the 2025.0.x release train, open source support ends this month. spring.io/blog/2026/06/11/sp…

Hello 👋🏻 Spring Boot 4.1

🚀 Spring AI 2.0.0-RC2 is out and one more step to GA! ✅Configurable HTTP clients for OpenAI & Anthropic ✅ Restored Spring Framework < 7.0.4 compatibility ✅ Multi-turn thinking fixed for Ollama & OpenAI, bug fixes and more on spring.io/blog/2026/06/09/sp…