GlassFish 8.0.4 Patches Unauthenticated Domain-Takeover CVE
GlassFish 8.0.4 is a maintenance release that fixes three CVEs, the most serious of which is CVE-2026-12605: an attacker who obtains a leaked administration token can gain full unauthenticated takeover of a GlassFish domain. The release also improves the AutoDeployer and FileArchive components and enhances JNDI diagnostics to make lookup failures easier to trace in production logs.
Teams running GlassFish-based application servers, particularly those with admin consoles reachable from anything other than a tightly locked-down network, should treat this as a priority patch rather than a routine maintenance bump. Token leakage is a common enough failure mode (logging misconfiguration, exposed CI artifacts, shared debug builds) that the practical exposure is broader than "leaked token" might suggest at first glance.
Read more — InfoQ
Gradle 9.7.0 Moves Isolated Projects to Incubating
Gradle 9.7.0 elevates the Isolated Projects feature from experimental to incubating status, a meaningful step toward general availability for the feature that lets Gradle model each project in a multi-project build independently, enabling parallel configuration and more aggressive caching. The release also improves the Configuration Cache for faster incremental builds and strengthens the security infrastructure around PGP key management for plugin and dependency verification.
For large multi-module Java projects, Isolated Projects is the mechanism Gradle is betting on to cut configuration time significantly, since today's configuration phase still largely runs single-threaded even when task execution is parallelized. Moving to incubating status signals the API is stabilizing enough for teams to start evaluating it on non-critical builds.
Read more — InfoQ
Apache Camel 4.22.0 Adds Native MCP Server Support
Apache Camel 4.22.0 introduces camel-ai-tool and camel-mcp-server, letting Camel routes expose themselves directly as Model Context Protocol tools and run as MCP servers without a separate integration layer. This means an existing Camel integration—say, one that already talks to a database, a queue, and a couple of REST APIs—can be surfaced to an AI agent as a set of callable tools using the same route definitions the team already maintains.
This fits a broader pattern across the Java ecosystem this year of established integration frameworks adding first-class MCP support rather than leaving it to bolt-on libraries, following similar moves from Spring AI and Quarkus earlier in 2026. For teams already invested in Camel for enterprise integration, it's a lower-friction path to agentic tool exposure than standing up a new service.
Read more — InfoQ
JDK 27 Release Candidate Slips to August 20, JDK 28 Build 10 Ships
The JDK 27 initial release candidate has been rescheduled from August 6 to August 20, 2026, aligning its build cadence with Oracle's now more frequent Critical Patch Update schedule. JDK 27 is due to succeed JDK 26 as the current release in September 2026. In parallel, JDK 28 Build 10 shipped with resolved issues and updated release notes, continuing the early-access cycle for the release targeted for March 2027.
The slip is procedural rather than a sign of trouble with JDK 27's feature set, which was locked back in June at Rampdown Phase One. Worth tracking mainly for teams planning upgrade windows around the September GA date.
Read more — InfoQ
A2A Java SDK 1.2.0 Improves Authorization for Non-CDI Apps
The Agent2Agent (A2A) Java SDK reached version 1.2.0, adding a TaskStreamLifecycleHook interface for hooking into task streaming lifecycle events and improving authorization flows for applications that don't use CDI (Contexts and Dependency Injection). The latter is a practical fix: plenty of Java services implementing A2A live outside full Jakarta EE/CDI containers, and the previous authorization path assumed CDI availability.
A2A is Google's protocol for agent-to-agent communication, and the Java SDK is one of several official language implementations gaining steady incremental investment as agentic Java services move from prototypes toward production deployments.
Read more — InfoQ
JetBrains TeamCity CVE Sees Active Exploitation
CVE-2026-63077, a vulnerability in JetBrains TeamCity, is under active exploitation according to ongoing reports tracked in this week's Java roundup. JetBrains recommends upgrading to TeamCity 2025.11.7 or 2026.1.3, or applying the available security patch plugin if an immediate upgrade isn't feasible.
Given how central TeamCity is to build and deployment pipelines at many Java shops, an actively exploited CVE in it is a supply-chain-adjacent risk: a compromised CI server can inject malicious artifacts into otherwise trusted release pipelines. Teams running self-hosted TeamCity instances should confirm patch status this week rather than folding it into a routine maintenance cycle.
Read more — InfoQ
