BellSoft

SSHole (CVE-2026-123158) can bypass OpenSSH password authentication on some musl-based Linux systems running without PAM.

BellSoft shipped fixed packages for every supported Alpaquita branch within a day of disclosure. If you run sshd, update OpenSSH and restart the service.

Details and affected configurations: bell-sw.com/blog/securing-…

50 MB is possible for a real Java REST service.

But once you assess the footprint gains against the trade-offs, things get interesting.

@cat_edelveis tested it with Spring Boot and Quarkus:
youtu.be/2f0LUg5_GvQ

Catch potential NullPointerExceptions while building your Java app.

@cat_edelveis shows how to set up JSpecify + NullAway and try them on a Spring Boot project with a deliberately planted null bug.

Follow the tutorial: bell-sw.com/blog/java-null…

Our Spring container security survey found that 64% of respondents did not recognize how Dockerfile maintenance can affect security.

InfoQ picked up that number in a new piece on patching at scale.

With dozens or hundreds of services, base-image updates stop being a repo-by-repo task and become a platform problem. The article shows where buildpacks fit into that shift:

infoq.com/news/2026/08/b…

What happens when a value object reaches synchronized through an Object reference? With JDK 28 preview features enabled, only identity objects have monitors. If the reference points to a value object, monitor acquisition throws IdentityException.

Use a separate identity object when you need a lock. #Java