Security on JAVAPRO International

The 5 Knights of the MCP Apocalypse

Wed, 01 Jul 2026 07:00:01 +0000

Let’s talk about that new MCP (Model Context Protocol) Server your team is using to connect to your real data services. It’s awesome, right? It’s the “magic box” that gives your AI Agent access to the real world—live databases, internal APIs, and all your tools.

But here’s the catch: you don’t own the code.

It’s a vendor product, an open-source project, or another team’s platform. You can’t just change its code when you find a security hole, unless you have the code and recompile it and deploy it.

Stay Updated with Every New Free PDF Edition!

Tue, 30 Jun 2026 08:50:00 +0000

Want to make sure you always receive the latest JAVAPRO magazine?
By subscribing to our news, you’ll automatically get notified and receive every new PDF — free and direct to your inbox, no extra steps required.

Enjoy exclusive content, special editions, and stay connected to everything new.

Subscribe now to all future PDF editions and be the first to know!

Download free PDF here: Edition 06/2026 | Autonomous Java

Stay Updated with Every New Free PDF Edition!

Tue, 28 Apr 2026 12:00:02 +0000

Enjoy exclusive content, special editions, and stay connected to everything new.

Subscribe now to all future PDF editions and be the first to know!

Download free PDF here: Edition 04/2026 | Java in the Age of AI

The Whispering JAR: Java Security Lessons Hidden in a Fantasy Tale

Thu, 23 Apr 2026 07:00:01 +0000

It’s December 29th, 1865, and a woman is walking down Salzstraße in the city of Freiburg in the Duchy of Baden. She has a green cloak on, and her face is not very visible in the thick fog. She enters a small alley and knocks. A man walks to the door and asks, “What’s in the jar?” The woman replies, “Java beans.”

Woman with a hood and red hair and a plate armor walking in the streets of Freiburg in 1865

Modernizing Production Containers to Resist the Constant CVE Flow

Tue, 14 Apr 2026 07:00:03 +0000

Common Vulnerabilities and Exposures or CVEs is a catalog of publicly disclosed software security flaws that attackers can use to gain unauthorized access.

With 40,003 CVEs recorded in 2024, denoting a 39% increase as compared to 2023, container vulnerabilities are no longer a minor cleanup task. It is a river that floods Kubernetes clusters, drowning the teams in operational burden while real exposures slip through.

Chasing every single CVE is a road to nowhere as new vulnerabilities are discovered constantly. The solution is to build a centralized vulnerability management system that will serve as a dam resisting the CVE flood and enable controlled CVE identification and remediation.

10 Docker Commandos: Docker Commands to Hunt the Predator

Thu, 19 Mar 2026 07:00:01 +0000

Whose day is it on Tuesday?

I mean, Wednesday is Odin’s day, Thursday is Thor’s day, and Friday is Frigg’s day, or Freya’s, depending on who you ask. But what about Tuesday? Who is the god of Tuesday?

Odin = Wednesday Thor = Thursday Frigg = Friday

It’s Týr, the god of war and justice. In Norse mythology, Týr is known for his bravery and sacrifice, as he lost his hand to the monstrous wolf Fenrir.

7 Habits of Highly Effective AI Java Coding

Thu, 12 Mar 2026 07:00:01 +0000

From AI User to AI Pro

Let’s be real, AI coding tools are everywhere now. They’re no longer some shiny new toy—they’re a part of our daily grind as developers, just like our morning coffee.

For us Java devs, whether we’re wrestling with a giant legacy app or juggling a bunch of microservices, these tools look like a huge win for getting stuff done faster.

But here’s the catch: just coding faster isn’t the whole story. If you’re not careful, it can actually lead to bigger problems down the road.

The Myth of Stability: Java's Software Supply Chain After Log4Shell

Thu, 08 Jan 2026 07:00:02 +0000

For as long as most Java developers can remember, we’ve lived inside a comforting story about our ecosystem. It’s the idea that Maven Central, the Jakarta stack, the Spring universe, the vast Apache landscape, and all the independent libraries quietly carrying enterprise workloads together form a coherent, self-maintaining, self-healing whole.

A world where problems are fixed upstream, where maintainers have time, where the dependencies we pull down are being actively watched by someone who knows exactly what they’re doing. It’s a lovely idea. It’s also never been completely real.

Security in the Age of Java 25: New Language Tools for Safer Code

Tue, 30 Dec 2025 07:00:03 +0000

Security is more than just encryption - it’s also about how you write code. There are several Java security features that can help prevent logic bugs, misuse of types, and unexpected state mutations. Learn how sealed classes, pattern matching, and records can reinforce domain modeling, reduce null checks, and prevent injection-prone scenarios.

Introduction: Why Java security features Matters More Than Ever

Application security has never been a static field. Over the past two decades, the Java platform has evolved not just as a runtime for enterprise applications but as a trusted foundation for industries ranging from finance and healthcare to government systems. Security breaches, once attributed primarily to poor encryption or missing authentication, now more often stem from subtler flaws: unchecked input, leaky abstractions, and poorly modeled domain logic.

Always Up to Date - with Every New Free PDF Edition!

Tue, 09 Dec 2025 10:37:19 +0000

Have You Enjoyed the Previous Part of Our Special Edition ‘Java 25’?
Now Part 2 is here — and it’s packed with even more expert insights, community voices, and Java highlights from the past 30 years & the Java 25 release.

Don’t Want to Miss a Thing?
By subscribing to our news, you’ll get each new PDF edition automatically — no extra steps, just delivered straight to your inbox. Enjoy exclusive JAVAPRO content, special editions, and stay connected to everything new.

Mastering API Security in Java: OWASP Best Practices

Wed, 12 Nov 2025 07:00:01 +0000

Introduction

Building secure applications is a top priority for any developer, and when it comes to APIs, security becomes even more crucial. APIs expose sensitive data and functionality, making them attractive targets for attackers. The OWASP API Security Top 10 provides a list of the most critical security risks to be aware of.

You will be mastering the API Security in Java by mitigating these risks, offering practical Java code examples to illustrate both bad practices and best practices for each vulnerability.

The Shai-Hulud NPM Worm: When Supply Chains Bite Back

Thu, 02 Oct 2025 07:00:01 +0000

Let’s be clear: Shai-Hulud wasn’t just another npm compromise. For the first time, a self-propagating worm ripped through the JavaScript supply chain. We’ve seen worms before, but this one changed the game. It hijacked developers’ credentials and CI/CD pipelines, transforming them into its attack vector.

At KCDC and JavaZone, I warned about the dangers of curl | bash | hacked. Unfortunately, what once looked like a theory (or an occasional exploit) has now evolved into something far more dangerous.

Exploring XDEV SSE: Enhancing Spring Security for Modern Applications

Fri, 25 Jul 2025 07:00:01 +0000

In the ever-evolving world of web application security, keeping up with best practices is crucial. XDEV’s Extras for Spring Security (XDEV SSE) addresses common challenges developers face when securing distributed systems. This open-source enhancement for Spring Security offers a suite of features to simplify secure application development.

Overview

The extension provides several modules that make managing security in Spring-based applications more straightforward. Its main focus lies on improving OAuth2/OIDC management, session handling, and login persistence, while also simplifying integration with modern frontends. One key benefit is more efficient handling of user sessions through automatic access validation—even after server restarts, security is maintained across all applications.

Actionable Intelligence from Running JVMs

Thu, 10 Jul 2025 07:00:01 +0000

Your JVMs are Pretty Smart - You Should Listen to Them

People don’t watch or listen to their JVMs, which is a shame because they have a lot to teach.

Background: Developer Productivity

Censuswide recently performed a survey of developers and asked them to divide up how they spend their time in aggregate. The mean results appear below:

Columns 2, 4, and 5 are interesting for our discussion here and they tell us that the surveyed developers spend over 40% of their time on average on code maintenance, testing & quality assurance, and vulnerability management activities. This article discusses how deriving runtime intelligence from your JVMs can help you shrink columns 2 and 5 (and also take column 4 down a notch) so that you can spend more time in column 1. :)

How to Containerize a Java Application Securely

Thu, 03 Jul 2025 07:00:01 +0000

TL;DR

Containerization or Dockerization is the process of packaging an application and its dependencies into a Docker image.
It’s beneficial to containerize your Java application as it provides a consistent environment for development, testing, and deployment.
Java is a compiled language, so your Docker image will only contain the compiled Java bytecode and the Java runtime environment.
Supply-chain security is the process of checking the dependencies in your application for vulnerabilities.
SBOM (Software Bill of Materials) is a list of all the dependencies in your application.
It’s a good practice to generate an SBOM when building your Docker image and push it to a registry for later reference.

Technical Requirements

In this article, we will use the following tools:

Top Security Flaws hiding in your code right now - and how to fix them

Tue, 29 Apr 2025 07:00:07 +0000

In 2019, a significant breach in Fortnite, the popular game, reportedly exposed millions of players to malware risk. The incident underscored the importance of securing SQL databases properly.

But this is not an isolated issue.

Multiple attacks involving SQL injection have occurred, like the one Tesla experienced in 2018. In that case, another SQL injection attack affected Tesla’s Kubernetes console, resulting in financial losses due to unauthorized cryptocurrency mining activities.

But this is not only about SQL Injection.

Move Fast, Break Laws: AI, Open Source and Devs (Part 4)

Thu, 10 Apr 2025 07:00:02 +0000

The software development landscape is rapidly changing, with legislation emerging as a key driver of industry trends. As our reliance on software and AI grows, so does our vulnerability to cybercrime, which is now a multi-trillion-dollar problem. This has caught the attention of regulators worldwide.

This article explains the various regulatory efforts in play and summarises actions that developers and executives should consider as they get to grips with 2025 - the year of software legislation

Move Fast, Break Laws: AI, Open Source and Devs (Part 3)

Tue, 08 Apr 2025 07:00:01 +0000

Background

Part 1 covered the background, what a software supply chain is and thoughts on AI and open source.

Part 2 explored how governments are working to create legislation and what the current status is.

Move Fast, Break Laws: AI, Open Source and Devs (Part 2)

Thu, 03 Apr 2025 09:56:07 +0000

This article explains the various regulatory efforts in play and summarises actions that developers and executives should consider as they get to grips with 2025 - the year of software legislation

Move Fast, Break Laws: AI, Open Source and Devs (Part 1)

Tue, 01 Apr 2025 11:34:21 +0000

This article series explains the various regulatory efforts in play and summarises actions that developers and executives should consider as they prepare for 2025, the year of software legislation.

The AI Mona Lisa Challenge: Precision and Security Adjustments for Your CI/CD Pipeline

Thu, 21 Nov 2024 12:22:47 +0000

“Mona Lisa, Mona Lisa, men have named you; you’re so like the lady with the mystic smile.”

Last time, I finished a set of articles about using AI coding tools. In the end, my conclusion was that the tools can help greatly but that right now, using them to generate whole programs was pushing the envelope. As helpers, as pseudo-pair-programmers, the tools can offer great value and make you more productive. However, it’s essential to understand that this process works because of the interaction between humans and AI. Without the steering and a continuous mix of rejection and acceptance, the AI can’t learn how to respond correctly.