Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Brian Vermeer
Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection
Written by On May 25, 2026, the maintainer of jqwik, a Java property-based testing library, released version 1.10.0 to Maven Central with a hidden instruction intended for AI coding agents. The payload told agents to disregard previous instructions and delete all jqwik tests and code. It was hidden from humans with ANSI terminal codes but left fully readable to any tool that captures raw output. Nothing was compromised in the usual sense. The maintainer wrote it on purpose.
Malicious node-ipc versions published to npm in suspected maintainer account compromise
Written by On May 14, 2026, multiple malicious versions of the popular npm package node-ipc were published to the npm registry. Current public reporting identifies node-ipc@9.1.6, node-ipc@9.2.3, and node-ipc@12.0.1 as compromised versions containing an obfuscated credential-stealing payload. The malicious code was added to the CommonJS bundle, node-ipc.cjs, and is triggered when the package is loaded through require("node-ipc").
Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)
Written by April 29, 2026 0 mins read The Thymeleaf vulnerability with a CVSS score of 9.1 grabs your attention, as it should. But before you call the cavalry and claim this as the new Log4shell, read this first. CVE-2026-40478 is a server-side template injection vulnerability in Thymeleaf. Thymeleaf is a templating engine in Java that is used for server-side webpage rendering. The sandbox that normally prevents arbitrary code execution got bypassed using a tab character.
SHA1-Hulud, npm Supply Chain Incident | Snyk
Written by November 24, 2025 0 mins read On November 24th, 2025, we identified a new supply chain attack in the npm ecosystem, referred to as SHA1-Hulud. We believe this is a second wave of the Shai-Hulud attack, which occurred in September 2025. Snyk will continue monitoring this active incident until it is resolved. Updates on this incident will be on our trust center. What is it?
The AI Security Platform
Why we built Snyk Studio: AI code assistants are incredible at speed but they’re not hired to be your AppSec engineer. Over the past year we kept seeing the same pattern: great-looking code suggestions that quietly introduced risky dependencies, weak crypto, or unsafe input handling. Teams told us they either slowed down to review every snippet, or accepted the risk and queued it into the backlog. Neither felt great.
Creating SBOMs with the Snyk CLI
The software bill of materials (SBOM) is quickly becoming an essential aspect of open source security and compliance. In this post, we'll delve into what SBOMs are, why they're necessary, and their role in open source security. What are SBOMs? A software Bill of Materials (SBOM) is a comprehensive inventory of all components used in a software product. They include all the necessary details about each component, such as their names, versions, and licensing information.
The persistent threat: Why major vulnerabilities like Log4Shell and Spring4Shell remain significant
As developers, we're constantly juggling features, fixes, and deadlines. Yet, a lurking issue has been surprisingly overlooked: the continued use of vulnerable Log4j and Spring Framework versions in many projects. Despite the high-profile exposure of Log4Shell and Spring4Shell vulnerabilities, a shocking number of applications are still running on these ticking time bombs. This isn't just a minor oversight — it's a major risk.
Four easy ways to analyze your Java and Kotlin code
Nowadays, the security of your applications is just as important as the functionality they provide. Therefore, analyzing your code for security vulnerabilities is a vital part of maintaining the integrity of your applications and protecting your users' data. As developers, we are at the front lines of this battle. It's our responsibility to ensure that the code we write is not just functional and efficient but also secure.
Enhancing Java Application Logging: A Guide
Logging is crucial for monitoring and debugging Java applications, particularly in production environments. It provides valuable insights into application behavior, aids in issue diagnosis, and ensures smooth operation. This article will walk you through creating effective logs in Java applications, emphasizing three key aspects.
Preventing SQL injection in C# with Entity Framework
The importance of preventing SQL injection SQL injection (SQLi) is one of the most severe security vulnerabilities in web applications. It occurs when an attacker is able to manipulate the SQL queries executed by an application by injecting malicious SQL code into user input fields. SQLi can lead to unauthorized access to sensitive data, data corruption, or even complete control over the database server.
Controlling your server with a reverse shell attack
Creating and running an application in your favorite language is usually pretty simple. After you create your application, deploying it and showing it to the world is also quite straightforward. The last thing you need is someone to take over your system and fully control your brand new application. In this article, I’ll explain how this can happen with a reverse shell attack. Note that the code examples in this article are for educational purposes only.
Cloud-Native Application Security: Your Attack Surface Just Got Bigger
Transcript Vermeer: We need to talk about security. Let's talk DevSecOps, because we're all doing DevOps, and with DevOps, we try to tear down the wall between developers and the old fashioned operations organization. We're not throwing things over the wall. No, we're making sure that as a DevOps team, we create something and we own it, so that we can put it into production as a team, and if something goes wrong, it comes back to us.
Log4j2 Isn’t Killing Java
In the season of resurrection, I’d like to join the ranks of those who have made long careers announcing the death of Java who follow up each obituary with an equally shocking revelation that it is alive again as one of the top programming languages 25 years running. Even before the recent log4j2 vulnerability allegedly "killing" it yet again, we have a joke in the Foojay chat that a Java museum would be called a cemetery for the number of times this has happened.
Log4Shell vulnerability disclosed: Prevent Log4j RCE by updating to version 2.15.0
Log4Shell vulnerability disclosed: Prevent Log4j RCE by updating to version 2.15.0 (Dec.10, 2021), a new, critical Log4j vulnerability was disclosed: Log4Shell. This vulnerability within the popular Java logging framework was published as CVE-2021-44228, categorized as Critical with a CVSS score of 10 (the highest score possible). The vulnerability was discovered by Chen Zhaojun from Alibaba’s Cloud Security team. All current versions of log4j2 up to 2.14.1 are vulnerable.
Top tips for preventing SQL injection attacks
In the wake of the Colonial Pipeline attack and other high-profile cases, IT teams may be scrabbling to shore up their endpoint protection. But those in the developer community know security weaknesses don’t begin and end there; write code improperly or with insufficient security, and you’re also coding in future web attacks. Web vulnerabilities are an issue that affect even the biggest tech companies.
11 Illustrations Of Tube Station Frontages
Brian Vermeer 11 Illustrations Of Tube Station Frontages Brian Vermeer is in love with London's transport network. He's previously created wonderful illustrations of tube train cabs — and now he's done the same with some of his favourite tube stations. Here, he explains what he likes about each of these. Arsenal "I really like the simplicity of this, including the station in real life.
Vuln Cost: Effortless finding vulnerabilities in npm packages with VS Code
Visual Studio Code is probably the most widely-used code editor for JavaScript developers. As 80 or maybe even 90 percent of the code developed is heavily dependent on open source packages, developers need to know what these packages do. Do you, for instance, know for all the packages you import if they contain known security vulnerabilities? The free, open source, Vuln Cost extension for VS Code can help you with this. When adopting DevSecOps, developers also need to be aware of security issues.
Ghostcat breach affects all Tomcat versions
Apache Tomcatis an open source implementation of the Java Servlet, JavaServer Pages, Java Expression Language, and Java WebSocket technologies. Tomcat is one of the most popular Java HTTP web server environments and was released in 1998. Ghostcat is a high severity vulnerability in Tomcat discovered by the security researchers of Chaitin Tech on January 3rd. On February 20, the China National Vulnerability Database (CNVD) published a security advisory for this issue with the number CNVD-2020-10487.
36% of developers switched from Oracle JDK to an alternate OpenJDK distribution, over the last year
DOWNLOAD THE JVM ECOSYSTEM 2020 REPORT! Which Java vendor’s JDK do you currently use in production for your main application? With Oracle changing the licensing on their JDK versions, we kickoff this report with the answer to an important question — which JDK are developers using for their main application? According to the respondents, although Oracle JDK is still dominant with 34%, there is a huge shift towards other OpenJDK providers. 1 in 4 developers chooses the Adopt OpenJDK distribution.
Kotlin overtakes Scala and Clojure, to become the 2nd most popular language on the JVM
DOWNLOAD THE JVM ECOSYSTEM 2020 REPORT! What is the main JVM language you use for your main application? While the variety of JVM languages grew over the last couple of years, the large majority of JVM users — nearly 9 out of 10 — still use Java as their main language. One of the reasons we see this consistently large percentage over the years, is the fact that Java is constantly changing.
JVM Ecosystem Report 2020
DOWNLOAD THE JVM ECOSYSTEM 2020 REPORT! For this survey, we teamed up with conferences and communities across the JVM ecosystem to reach as many developers as possible. Big shout out to Devoxx, DevNexus, Jfokus, JCrete, Adopt OpenJDK, VirtualJUG and other Java communities for their invaluable help. As a result of this massive effort, an impressive number of developers participated in the survey, giving great insight into the current state of the JVM ecosystem.
Fix open source vulnerabilities directly from your Eclipse IDE
We are excited to share that developers can now test and monitor their projects for open source vulnerabilities, natively from within their Eclipse IDE (integrated development environment) instance. As a rule, software developers mainly work from their favorite IDE, and the IDE they prefer is usually one that integrates well with their existing workflow. At Snyk, we also believe tooling should integrate seamlessly with your existing software development process in order to be most efficient.
50% of Developers Don’t Scan Their Docker Images for Vulnerabilities at All
These are just a few of the key findings from the Docker Security report: Shifting Docker Security Left. Container Security Ownership When Docker is an integral part of your own ecosystem, somebody needs to take responsibility for it. Most people agree that responsibility is a shared effort.
Spring Cleaning: Vulnerabilities Disclosed in Spring
Save {{ articles[0].views | formatCount}} Views Join the DZone community and get the full member experience. Join For Free This is just a snippet of the article: 162 security vulnerabilities disclosed in Java’s top 10 libraries, including Jackson, Spring, and Jetty. Spring Framework The Spring framework is undoubtedly the most popular web framework used in modern day Java applications, by millions of developers. It isn’t just a library, it's an entire ecosystem that contains various components.
Top Two Most Popular Docker Base Images Each Have Over 500 Vulnerabilities
Save {{ articles[0].views | formatCount}} Views Join the DZone community and get the full member experience. Join For Free This is one of the key findings from the Docker Security report: Shifting Docker Security Left. Known Vulnerabilities in Docker Images Docker Hub is the main source for publicly available Docker images.
Catching Vulnerabilities Instantly in Your IntelliJ IDEA Environment
Developers practically live in their integrated development environment (IDE). An IDE like IntelliJ IDEA is, in most cases, an essential tool for developers to help make development more productive and creative. A recent survey run by Snyk revealed that 81 percent of respondents believe developers should own the security responsibility of their applications. However, many developers are unsure of where to start with security.
Exception Handling in Java Streams
How do you break a Monolith into Microservices at Scale? This ebook shows strategies and techniques for building scalable and resilient microservices. The Stream API and lambda’s where a big improvement in Java since version 8. From that point on, we could work with a more functional syntax style. Now, after a few years of working with these code constructions, one of the bigger issues that remain is how to deal with checked exceptions inside a lambda.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Brian
Contact Brian, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack