Java News Roundup: JDK 28 Schedule, Oracle CPUs, eMudhra Certs, Apache
Oracle, Azul, and BellSoft shipped critical CPU patches as Azul deployed an emergency update blocking eight compromised eMudhra intermediate keys.
By Dillip Chowdary • Oct 26, 2026 • Source: InfoQ
| Check | Do this |
|---|---|
| The claim | What the source actually said — not a recap of a recap |
| Price / term | Confirm on the live listing or vendor page |
| Who it is for | Match the product to your stack before you buy |
| What to verify | Warranty, seller, version, and return window |
Oracle, Azul, BellSoft, and open-source enterprise maintainers published major runtime security updates alongside new framework milestones across the Java ecosystem, as detailed in InfoQ's report. The synchronized releases pair quarterly Critical Patch Updates with emergency out-of-cycle security remediation following Mozilla's disclosure that eight private keys belonging to eMudhra intermediate Certificate Authority certificates were compromised. Upstream distributions patched long-term support branches spanning JDK 8 through JDK 27, while OpenJDK architect Mark Reinhold submitted the formal six-month timeline proposal for the upcoming platform release cycle.
This operational briefing tracks the specific release artifacts, coordinate fixes, framework patches, and trust-store mitigations for platform architects, enterprise Java developers, and site reliability engineers. The report details security advisories across Oracle JDK, Azul Zulu, and BellSoft Liberica, alongside feature updates in WildFly 42, Apache POI 6.0.0, Open Liberty 26.0.0.11 beta, Micronaut 5.2.3, and JobRunr 9.0.2. Teams evaluating production runtime patching schedules, application server baselines, and cryptographic trust boundaries can review all actionable version numbers, schedule windows, and component upgrades below.
The offer: Java News Roundup
The central security payload delivers quarterly Critical Patch Updates across all supported LTS releases alongside emergency revocations for compromised eMudhra certificates. Oracle issued quarterly patches covering versions 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, and 8u511. Downstream OpenJDK distributors mirrored and expanded these fixes. Azul rolled out October updates across Zulu versions 27, 25, 21, 17, 11, 8, 7, and 6, remediating 53 Common Vulnerabilities and Exposures. Concurrently, BellSoft delivered Liberica JDK fixes across versions 25.0.4.1.1, 21.0.12.1.1, 17.0.20.1.1, 11.0.32.1.1, 8u511, 7u521, and 6u521, alongside Patch Set Updates for versions 27.0.1 through 8u512.
On the library and runtime front, major application stacks published feature upgrades and vulnerability fixes. WildFly 42 arrived with virtual thread support inside its Jakarta Concurrency implementation and introduced principal transformer configuration, such as case-principal-transformer, inside the WildFly Elytron token-realm component. Apache POI 6.0.0 set a baseline requirement of JDK 17, enabled cached formula cell values by default in DataFormatter, and pruned deprecated APIs. Meanwhile, Micronaut 5.2.3 resolved 10 CVEs across Micronaut Core 5.2.17 and Micronaut Security 5.4.1, while Open Liberty 26.0.0.11 beta added JSON Web Key rotation and Netty HTTP transport.
How to get Java News Roundup
Engineering groups can obtain the runtime patches immediately from respective vendor distribution repositories and portal download pages. Teams utilizing standard Oracle licensing can pull maintenance builds 27.0.1 down through 8u511 directly from Oracle Technology Network. Liberica JDK users can access CPU packages alongside PSU releases, which consolidate 1,438 collective fixes and backports directly from BellSoft mirrors. Organizations running Azul Zulu can download binaries covering legacy JDK 6 up through modern JDK 27, incorporating the out-of-cycle eMudhra certificate fix that Azul generated on October 21.
Framework updates and developer tooling are available across standard dependency management systems including Maven Central. Apache POI 6.0.0 artifacts can be declared in build files with updated coordinates provided build pipelines run on JDK 17 or higher. WildFly 42 application server bundles are downloadable from the project distribution servers. Micronaut 5.2.3 dependencies, including patched modules for Micronaut Data, Object Storage, and Serialization, are live on package registries. JobRunr 9.0.2 is distributed for enterprise scheduling workflows, and early-access Build 21 for JDK 28 is hosted on the OpenJDK early-access portal.
Advertisement
Tech Pulse Daily
Get tomorrow's pulse first
Join engineers who read Tech Pulse before stand-up. Free, weekday mornings.
How Java News Roundup compares
The coordinated releases highlight distinct operational postures between upstream baseline advisories and aggressive downstream vendor responsiveness. While Oracle executed its scheduled quarterly CPU cycle for primary LTS builds, Azul separated from the standard cadence by shipping an out-of-cycle update specifically for the eMudhra incident. Because standard Java distributions do not enable certificate revocation checks by default, applications relying solely on unpatched standard runtimes remain susceptible to fraudulent certificates. Azul addressed this window directly on October 21 rather than deferring the mitigation to the standard quarterly release scheduled for January.
BellSoft took an expansive maintenance route by shipping separate CPU and Patch Set Update streams, accounting for 144 direct issue eliminations across 1,438 total backported patches. Upstream OpenJDK governance simultaneously advanced forward planning. Java Platform Group chief architect Mark Reinhold proposed the release roadmap leading toward a March 9, 2027 General Availability milestone. That schedule establishes Rampdown Phase One on December 3, 2026, Rampdown Phase Two on January 14, 2027, an Initial Release Candidate on February 4, 2027, and a Final Release Candidate on February 16, 2027.
Who should buy Java News Roundup
Enterprise infrastructure teams running mission-critical TLS endpoints, microservices, and web infrastructure must prioritize applying these runtime updates. Environments executing outbound HTTPS calls or processing external API integrations face immediate risk from the compromised eMudhra intermediate CA private keys. Downstream platforms including Firefox and Chrome blocked the certificates on October 17, Microsoft blocked them on October 20, and Apple followed on October 22. Java teams whose workloads interact with external services need vendor-patched runtimes to enforce revocation boundaries at the virtual machine level.
Application developers operating modern cloud stacks should adopt the framework releases based on architectural requirements. Teams building on Jakarta EE concurrency specifications benefit from WildFly 42 to run tasks over virtual threads and configure Elytron JSON Web Token principal mapping. Workloads parsing office documents require Apache POI 6.0.0 for faster formula processing, while teams securing service-to-service communication can adopt Open Liberty 26.0.0.11 beta to implement workload identity with automatic JWK rotation in JWT Builder and configure customizable server quiesce timeouts beyond the standard 30 seconds.
The catch with Java News Roundup
The primary operational complication centers on cryptographic trust architecture and strict platform upgrade boundaries. Azul emphasized the vulnerability window by noting: "Java makes this worse than it sounds: it does not check certificate revocation by default. Until the certificates are blocked in the JDK itself, a Java application accepts a fraudulent certificate issued with those keys as valid. There was no patch on the day of disclosure, and no quarterly release is due until January." Relying on standard OS trust stores is insufficient if the virtual machine trust store remains unpatched.
Upgrading libraries introduces breaking changes and integration shifts that require codebase remediation. Apache POI 6.0.0 permanently drops support for Java runtimes older than JDK 17 and eliminates deprecated legacy methods, preventing drop-in updates for older enterprise systems. Teams adopting JobRunr 9.0.2 must accommodate a refactored Quarkus JobRunrStarter bean and shift SQL query parameter retrieval to suppliers. In addition, organizations testing early builds must track the proposed schedule review period closing October 29, 2026, while submitting observed runtime anomalies through the official Java Bug Database.
Developer Action Items
- ☐ Inventory whether Framework / Windows / Oracle runs in prod, CI, staging, or on laptops before you debate severity.
- ☐ Confirm the vendor's fixed build for Framework / Windows / Oracle from InfoQ, then schedule the patch window.
- ☐ If you cannot patch today, isolate the service, rotate tokens that sat on the affected surface, and raise the logging floor.
- ☐ Record the decision and residual risk so the next on-call does not re-litigate whether you are exposed.
Java News Roundup FAQ
Why was an out-of-cycle update required after the October 2026 Critical Patch Update?
Mozilla disclosed that eight private keys belonging to eMudhra intermediate Certificate Authority certificates were compromised, allowing potential attacker impersonation. Because Java does not check certificate revocation by default, vendors like Azul released emergency updates on October 21 to block the fraudulent certificates in the runtime trust store.
What are the key architectural changes in the Apache POI 6.0.0 release?
Apache POI 6.0.0 requires a minimum baseline of JDK 17 and removes deprecated methods across its Microsoft Documents API. The DataFormatter class now enables the useCachedValuesForFormulaCells method by default, reading cached values for formula cells instead of recalculating them dynamically.
What milestones are proposed for the upcoming OpenJDK platform release schedule?
Chief architect Mark Reinhold proposed Rampdown Phase One on December 3, 2026, Rampdown Phase Two on January 14, 2027, an Initial Release Candidate on February 4, 2027, a Final Release Candidate on February 16, 2027, and General Availability on March 9, 2027.
What security and concurrency features shipped in WildFly 42?
WildFly 42 introduced support for virtual threads within its Jakarta Concurrency implementation. Its WildFly Elytron security component added principal transformers, such as case-principal-transformer, to adjust Java Principal instances extracted from JSON Web Tokens before security evaluation.
Sources
Author
Dillip Chowdary
Writes Tech Bytes coverage of AI, engineering, and the tools that actually ship. Editor of Tech Pulse Daily.
Related on Tech Bytes
Advertisement