October 2026 Critical Patch Update Ships Across All Supported JDK Lines
The quarterly Critical Patch Update for October 2026 is out, and InfoQ's roundup for the week of October 19 collects the vendor releases. Oracle shipped JDK 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33 and 8u511. Azul released CPU builds of Zulu for JDK 27, 25, 21, 17, 11, 8, 7 and 6, covering 53 CVEs in total. BellSoft published Liberica JDK CPU builds (25.0.4.1.1, 21.0.12.1.1, 17.0.20.1.1, 11.0.32.1.1, 8u511, 7u521, 6u521) as well as Patch Set Update releases (27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, 8u512), reporting 1,438 fixes and backports across all lines.
The same week, the JDK 28 release schedule was proposed: Rampdown Phase One on December 3, 2026, Rampdown Phase Two on January 14, 2027, release candidates on February 4 and February 16, and General Availability on March 9, 2027. JDK 28 early-access Build 21 is also available. With Rampdown Phase One about a month away, the feature set (currently ten targeted JEPs, including Value Objects, Structured Concurrency finalization and AOT code compilation) is close to frozen.
For teams on an LTS line, the practical step is the usual one: roll the CPU build into base images and CI toolchains. Teams on the non-LTS JDK 27 should note that 27.0.1 is the first update in that line.
Read more — InfoQ
Eight eMudhra Intermediate CA Keys Compromised, Out-of-Cycle JDK Updates Follow
Mozilla disclosed that the private keys for eight eMudhra intermediate CA certificates had been compromised. Anyone holding those keys could issue certificates impersonating arbitrary websites or services. Browsers and platforms moved quickly: Firefox and Chrome blocked the intermediates on October 17, Microsoft platforms on October 20 and Apple products on October 22. Oracle published security alert CVE-2026-91403 for the Java runtime.
Azul shipped an out-of-cycle Zulu update on October 21 specifically for this issue, and pointed out the detail that matters most to Java developers: the JDK does not check certificate revocation by default. A JVM with the affected intermediates still trusted will accept a fraudulent certificate until its trust store is updated, regardless of whether the CA has been revoked upstream.
If your services make outbound TLS calls, confirm that every runtime (including those in container images that are not rebuilt often) has picked up the updated trust store or the vendor's out-of-cycle build. Applications that ship a custom cacerts file need to remove the affected intermediates themselves.
Read more — InfoQ
Quality Outreach Asks Library Maintainers to Test JDK 28 Value Classes
With JEP 401 (Value Objects, Preview) targeted to JDK 28, the OpenJDK Quality Outreach program sent a heads-up asking open source projects to test against JDK 28 in two configurations: with preview features disabled (behavior should be unchanged) and with preview features enabled. Projects that can do so are asked to run both in CI and report surprises to the valhalla-dev mailing list.
The reason for the second configuration is that around 30 JDK classes become value classes when preview is enabled, even for code compiled without preview or on an older JDK. That includes the primitive wrappers, Number, Record, Optional and its primitive variants, and most java.time types. For these, == compares field values rather than identity, synchronizing on an instance fails with a compile error or IdentityException, java.lang.ref APIs and WeakHashMap reject them, and reflective setAccessible on their fields throws.
The note also flags a source-level change: compiling with preview enabled applies early-construction rules, so record constructors that touch this before all fields are assigned (for example by calling an instance method) no longer compile. Library maintainers who lock on boxed values, key weak caches on Integer or LocalDate, or rely on identity of these types should start testing now, while there is still time to file issues before JDK 28 ships in March.
Read more — Inside Java
WildFly 42, Apache POI 6.0 and Micronaut 5.2.3 Round Out the Ecosystem Week
WildFly 42, released October 22, adds virtual-thread support to its Jakarta Concurrency implementation, so managed executors can run tasks on virtual threads. It also lets the Elytron token-realm apply a principal transformer (such as case-principal-transformer) to principals derived from JWTs, which simplifies mapping external identity-provider subjects to local users.
Apache POI 6.0.0 reached GA with a JDK 17 baseline. DataFormatter now uses cached values for formula cells by default, and deprecated methods have been removed, so projects upgrading from 5.x should check for compilation breaks and for spreadsheets whose formatted output depended on re-evaluating formulas.
On the framework side, Micronaut 5.2.3 resolves 10 CVEs through Micronaut Core 5.2.17 and Micronaut Security 5.4.1, and the Open Liberty 26.0.0.11 beta adds workload identity and JWK rotation to its JWT Builder plus a configurable server quiesce timeout. JobRunr 9.0.2 makes the Quarkus JobRunrStarter bean replaceable.
Read more — InfoQ
Links & Sources
You May Also Enjoy
