TooMuchCoding Newsletter #37
Hi!
We’ve got a wild week ahead - the Spring team just dropped a tsunami of first milestone releases after a 10-week radio silence, and they came bearing gifts in the form of patching over 90 CVEs. Meanwhile, the AI safety crowd is getting increasingly nervous about what happens when their creations go rogue, JDK 27 is locking in its feature set with some genuinely memory-saving improvements, and observability tooling is getting smarter by the minute. Also, security researchers are watching threat actors get very comfortable with automation - not quite Skynet, but the writing’s on the wall. I guess you could say the threat landscape is escalating - sorry, I’ll see myself out.
Grab a hot beverage.
Let’s go. I do hope that you’ll enjoy the reading!
This Week’s Highlight
Spring News Roundup: First Milestone Releases for Boot, Framework, Data, Security, Modulith, Batch
After a 10-week break, the Spring team unleashed a coordinated wave of first milestone releases that hits you right in the CVE count. Spring Boot 4.2.0-M1 and Spring Framework 7.1.0-M1 are the headliners, but the real story is that they patched over 90 vulnerabilities across the ecosystem - we’re talking remote code execution through Java deserialization, denial-of-service attacks, the usual suspects that make your security team pull their hair out. Spring Data’s introducing Redis JSON support, Spring Batch is getting modernized, and Spring Security’s tightening its belt. This is the kind of “we’ve been working heads-down” release that justifies the silence.
https://www.infoq.com/news/2026/08/spring-news-roundup-aug17-2026/
Marcin’s comment: 90 CVEs patched in one go - that’s either “finally we caught our breath” or “we were holding back the flood gates.” Either way, you’ll want to test these milestones before production decides to do it for you.
Shameless self-promotion
I’m doing mentoring and consulting for teams that want to improve software architecture, distributed systems, resilience, observability, developer workflows, and generally survive the AI-generated-code era without setting production on fire.
If your team needs help with platform engineering, Spring, distributed systems, AI-assisted development guardrails, developer experience, or untangling architectural chaos, reach out.
https://toomuchcoding.com/consulting
AI
Leading AI Developers Warn of Looming AI-Enabled Cyberattacks
The big names - OpenAI, Anthropic, Google, Microsoft - just released an open letter that basically says “we’ve created something that could be weaponized, and we’ve got maybe a few months before someone does it.” They’re warning about AI-orchestrated attacks against major institutions, the kind where coordination, target selection, and payload delivery all get automated and scaled. This isn’t doom-mongering from basement hackers; this is the people who built the tech admitting they’re concerned. The window to fortify defenses is apparently very narrow.
https://www.cbsnews.com/news/openai-anthropic-ai-cyber-threat-warning/
Marcin’s comment: When the AI companies themselves are warning you about AI-enabled attacks, maybe skip the “but surely it won’t happen” take and start patching.
Judge rules Trump administration illegally punished AI firm Anthropic
A federal judge handed Anthropic a win by ruling that the Trump administration unlawfully retaliated against the company for its public criticism of government policy and concerns about AI safety. The court rejected the “national security” justification as a blank check for silencing critics or retroactively labeling firms as supply chain risks. It’s a reminder that even in the age of AI panic, the First Amendment still applies to tech companies that speak up.
https://www.cbsnews.com/news/judge-rules-trump-administration-illegally-punished-ai-firm-anthropic/
Marcin’s comment: Invoking national security to muzzle corporate critics is the kind of move that makes lawyers very happy and judges very unimpressed.
Security
CISA Adds Six Exploited Flaws to KEV
The Cybersecurity and Infrastructure Security Agency (CISA) added six newly exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including a high-severity bug in Citrix NetScaler ADC and Gateway that threat actors are actively abusing. Here’s the kicker: CISA noted that attackers are increasingly using AI to automate the exploitation of known, persistent software flaws - so your “we’ll patch it later” approach is now getting machine-gunned by automation.
https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html
Marcin’s comment: AI isn’t replacing the need for patching; it’s just making the cost of not patching exponential.
CISA Vulnerability Review
CISA released a comprehensive review of insecure software, and the verdict is unsurprising but brutal: most breaches don’t result from zero-days or fancy hacking techniques - they result from basic security failures. The review gives organizations a framework for prioritizing patches based on risk, exposure, and exploitability potential, with a hard focus on which vulnerabilities are most likely to get automated exploitation. Basically, stop pretending you need exotic attack vectors when the low-hanging fruit is rotting on the ground.
https://www.cisa.gov/resources-tools/resources/cisa-vulnerability-review
Marcin’s comment: “Advanced threat actors” sounds cooler than “you forgot to update Tomcat in 2019,” but both result in the same bill.
JVM
Java SE 25 Release Notes / Oracle GraalVM 25.3.4.1
Oracle released GraalVM 25.3.4.1 as an innovation release based on JDK 25.0.4.1, and it’s bringing compressed 32-bit object references to Native Image by default. That means your memory footprint shrinks and performance stays competitive while explicitly capping your heap to 32 GB - a sweet spot for most containerized workloads. This is the kind of “boring but meaningful” improvement that actually makes your cloud bills go down.
https://docs.oracle.com/en/graalvm/jdk/25i/docs/release-notes/
Marcin’s comment: 32-bit object references by default - it’s like Java finally admitted that not everyone needs 512 GB of heap.
Java 27 So Far
JDK 27 just hit release candidate status with nine features locked in and a September 2026 release on the horizon. The standout improvements include post-quantum ML-KEM key encapsulation for TLS 1.3 (because someone realized quantum computers might show up eventually), G1 becoming the default garbage collector everywhere, and compact object headers slashing header size from 16 to 8 bytes. That last one cuts typical heap usage by 10-20%, which is the kind of “we’re not doing anything fancy, just being smarter” win that everyone can celebrate.
https://www.infoq.com/news/2026/08/java-27-so-far/
Marcin’s comment: Compact object headers shaving 10-20% off heap usage while Structured Concurrency quietly advances toward production - Java’s getting lean and focused.
JDK 27 features, release date: What Java devs need to know
This piece digs into JDK 27’s memory optimizations, specifically highlighting JEP 534 which compresses object headers from 16 to 8 bytes. The memory savings compound across typical applications, and it’s paired with Structured Concurrency hitting its seventh preview phase - a signal that virtual threads are maturing and async programming models are stabilizing. By September, you’ll have a release that’s simultaneously lighter and more structured.
https://daily.dev/posts/jdk-27-features-release-date-what-java-devs-need-to-know-aaaism2vc
Marcin’s comment: 8-byte object headers and seventh-preview Structured Concurrency - JDK 27 is the “we listened to your heap complaints” release.
Spring
Spring Boot 4.2.0-M1 Release Notes
Spring Boot 4.2.0-M1 is shipping with support for AMQP 1.0 specification, so if you’ve been waiting for proper message broker interoperability, the wait is over. Graceful server shutdowns are now coordinated through Eclipse Jetty’s GracefulHandler instead of Spring’s own logic - cleaner separation of concerns. And here’s the bit that’ll affect most of you: RestTemplate support is formally deprecated in favor of RestClient, so start planning your migration if you haven’t already.
https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.2.0-M1-Release-Notes
Marcin’s comment: RestTemplate deprecation is the kind of nudge that says “we’re serious about this RestClient thing” without kicking you out the door immediately.
Spring Ecosystem Delivers Milestone Releases, Addresses Over 90 CVEs
The security impact of this milestone wave can’t be overstated - Spring Integration alone shipped a critical Java deserialization RCE (CVE-2026-59307) that would’ve kept security teams up at night. Beyond the emergency patches, Spring Data 2026.1.0-M1 is adding Redis JSON support for more sophisticated data modeling, and Apache Kafka observability is getting modernized across the ecosystem. This is the kind of coordinated release where you get security fixes and feature momentum simultaneously.
Marcin’s comment: A Java deserialization RCE in Spring Integration plus Redis JSON support in the same release - that’s crisis management wrapped in feature delivery.
Observability
OpenTelemetry plugin for JetBrains IDEs
JetBrains expanded its OpenTelemetry plugin beyond Rider to cover IntelliJ IDEA, GoLand, PyCharm, and WebStorm in the 2026.2 release. The plugin surfaces logs, metrics, traces, and service maps from your local instrumented applications directly inside the IDE - no separate observability backend required. You’re literally debugging with production-grade observability data without leaving your editor, which is the kind of developer experience improvement that actually saves time.
https://blog.jetbrains.com/platform/2026/08/opentelemetry-plugin-for-jetbrains-ides/
Marcin’s comment: Traces and service maps in your IDE without spinning up Jaeger - JetBrains just made observability the path of least resistance.
OpenTelemetry eBPF Instrumentation (OBI)
The OpenTelemetry project released v0.12.1 of its eBPF Instrumentation tool, delivering zero-code auto-instrumentation for Kubernetes and Linux workloads. It captures traces, runtime metrics, and network relationships with minimal overhead - no bytecode weaving, no agent flags, no manual setup. The latest version adds enhanced Node.js runtime metrics, so polyglot environments get better visibility without doubling down on instrumentation complexity.
https://opentelemetry.io/docs/zero-code/obi/
Marcin’s comment: eBPF-based zero-code instrumentation for Kubernetes - it’s like observability found the eject button and pressed it.
Ask O11y - Agentic Observability for Grafana
Grafana introduced Ask O11y, an AI investigation agent embedded directly in the Grafana workspace that turns your live observability data into incident-ready answers. You query your telemetry in plain language, and the agent builds traceable investigations with metrics, logs, traces, and automated RCA reports using MCP tools. It’s not replacing human judgment - it’s accelerating the busywork of “where did this break and why.”
https://grafana.com/grafana/plugins/consensys-asko11y-app/
Marcin’s comment: An AI agent for root cause analysis inside Grafana - the incident response playbook just went conversational.
That’s all for now.
Thanks again for being here, and see you in the next one.