Oracle issued several JDK versions, including 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, and 8u511, as part of its October 2026 Critical Patch Update Advisory.
Build 21 of the JDK 28 early-access builds was made available this week, incorporating fixes from Build 20. Mark Reinhold, chief architect for the Java Platform Group at Oracle, formally presented the release schedule for JDK 24, with the review period anticipated to conclude on October 29, 2026.
Mozilla reported that eight private keys belonging to eMudhra intermediate Certificate Authority (CA) certificates were compromised. Mozilla noted that "The root programs and many downstream trust stores have taken action to protect their users." Blocking actions began on October 17th in Firefox and Chrome, October 20th on Microsoft platforms, and October 22nd on Apple products.
In response to this security event, Azul released its October 2026 CPU patches for various Azul Zulu JDK versions. This update addressed 53 CVEs and included an "out-of-cycle" patch for the compromised eMudhra certificates. Azul noted that "Java makes this worse than it sounds: it does not check certificate revocation by default."
BellSoft also issued CPU patches for Liberica JDK versions, addressing a list of CVEs. Additionally, Patch Set Update (PSU) versions, such as 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, and 8u512, were released, containing CPU and non-critical fixes.
Platform enhancements include the general availability release of WildFly 42, which adds support for virtual threads in its Jakarta Concurrency specification implementation. Apache POI 6.0.0, the Java API for Microsoft Documents, was also released, featuring dependency upgrades and a minimal JDK 17 requirement.
Beta testing commenced for Open Liberty 26.0.0.11, introducing support for workload identity and JWK rotation within the JWT Builder. Furthermore, Micronaut 5.2.3 resolved 10 CVEs across Micronaut Core 5.2.17 and Micronaut Security 5.4.1.
These developments reflect the ongoing operational demands placed upon infrastructure components, where timely patching and platform evolution are critical for maintaining system integrity against evolving threats.
