Jul 2, 2026 · 1 hr 6 min · 11 segments
Hi Spring fans! In this installment we talk to the legendary Spring AI and Spring Framework contributor Sébastien Deleuze about the latest-and-greatest in AI, Kotlin, the framework, and more.
Sébastien DeleuzeGuest
Josh LongHost
So these are vulnerabilities discovered in codebases like Spring, like Spring Boot, Spring Batch, by the community sometimes, by researchers, by whoever, using AI to assist them.
And remember, if people can find these with commodity AI models, then they are effectively already public, right? That means if you can find it, and somebody else can find it with the same tools, and neither of you have any particular extra skill or sense about these sorts of things, then they're effectively open, right? And these CVEs are a big problem that are besieging the industry right now.
and uh and then upgrading your code patch because we always patch the code we always provide fixes for these vulnerabilities before we announce before we public publicly publish the cvs on spring.io security so if you're finding out about a cve on spring.io for security it's too late you've got code in production that is vulnerable and people know about it right And so I would definitely, definitely, definitely, if you're not on vacation like me, I would be talking to your team right now.
One of the things that we've discovered in talking to organizations is that there is a number of people that have very, very slow release cycles.
I mean, and you see this more at large sort of heavy organizations, you know, think banks or governments or whatever.
where they they take months literally to certify new dependencies and new releases that will not work that will not fly it is unacceptable in this day right you need to think about how to get these fixes out into production as quickly as possible.
So these are vulnerabilities discovered in codebases like Spring, like Spring Boot, Spring Batch, by the community sometimes, by researchers, by whoever, using AI to assist them.
And remember, if people can find these with commodity AI models, then they are effectively already public, right? That means if you can find it, and somebody else can find it with the same tools, and neither of you have any particular extra skill or sense about these sorts of things, then they're effectively open, right? And these CVEs are a big problem that are besieging the industry right now.
and uh and then upgrading your code patch because we always patch the code we always provide fixes for these vulnerabilities before we announce before we public publicly publish the cvs on spring.io security so if you're finding out about a cve on spring.io for security it's too late you've got code in production that is vulnerable and people know about it right And so I would definitely, definitely, definitely, if you're not on vacation like me, I would be talking to your team right now.
One of the things that we've discovered in talking to organizations is that there is a number of people that have very, very slow release cycles.
I mean, and you see this more at large sort of heavy organizations, you know, think banks or governments or whatever.
where they they take months literally to certify new dependencies and new releases that will not work that will not fly it is unacceptable in this day right you need to think about how to get these fixes out into production as quickly as possible.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
