Java News Roundup: JDK 28 Schedule, Oracle CPUs, eMudhra Certs, Apache POI, WildFly, Azul, BellSoft

This week's Java roundup for October 19th, 2026, features news highlighting: the proposed release schedule for JDK 28; the eMudhra Intermediate CA certificates breach; the October 2026 Critical Patch Update; Azul and BellSoft CPUs; GA releases of WildFly 42 and Apache POI 6.0; the beta release of Open Liberty 26.0.0.11; and maintenance releases of Micronaut and JobRunr.

OpenJDK

Oracle has released versions 27.0.1 25.0.5, 21.0.13, 17.0.21, 11.0.33 and 8u511 of the JDK as part of their quarterly Critical Patch Update Advisory for October 2026. Further details on this release may be found in the release notes for version 25.0.5, version 21.0.13, version 17.0.21, version 11.0.33 and version 8u511.

JDK 28

Build 21 of the JDK 28 early-access builds was made available this past week featuring updates from Build 20 that include fixes for various issues. More details on this release may be found in the release notes.

Mark Reinhold, chief architect, Java Platform Group at Oracle, formally proposed the release schedule for JDK 24 as follows:

• Rampdown Phase One (fork from main line): December 3, 2026
• Rampdown Phase Two: January 14, 2027
• Initial Release Candidate: February 4, 2027
• Final Release Candidate: February 16, 2027
• General Availability: March 9, 2027

The review period for this proposed schedule is expected to conclude on October 29, 2026.

For JDK 28, developers are encouraged to report bugs via the Java Bug Database.

eMudhra Intermediate CA Certificates

Mozilla has disclosed that eight private keys of the eMudhra intermediate Certificate Authority (CA) certificates have been compromised. Thai means that an attacker holding private keys of any compromised CA intermediate certificate could impersonate any website or service. Describing their response, Mozilla states:

The root programs and many downstream trust stores have taken action to protect their users. The certificates have been blocked in Firefox and Chrome since the 17th of October, on Microsoft platforms since the 20th and on Apple products since the 22nd.

The issue was responsibly disclosed to downstream trust stores on the 19th of October. Many have already released updates or are in the process of releasing updates.

Other vendors have also responded in the wake of this breach. This includes Oracle, who published this security alert and BellSoft (see below).

Further details on this breach may be found in this InfoQ news story.

Azul

Concurrent with Oracle's Critical Patch Update (CPU) for October 2026, Azul has released their October 2026 CPU patches for their JDK versions 27, 25, 21, 17, 11, 8, 7 and 6 of Azul Zulu, their downstream distribution of OpenJDK. This covers 53 CVEs and includes an "out-of-cycle" update to address the aforementioned compromised eMudhra intermediate CA certificates. Describing how this breach occurred just one day after the Oracle 2026 CPUs, Azul stated:

Java makes this worse than it sounds: it does not check certificate revocation by default. Until the certificates are blocked in the JDK itself, a Java application accepts a fraudulent certificate issued with those keys as valid. There was no patch on the day of disclosure, and no quarterly release is due until January.

Within a day it was not enough anymore: a zero-day showed up that no quarterly schedule could have planned for, and on October 21 Azul shipped an out-of-cycle update for it.

Since publishing the original blog post, a newer version of the updates may be found here.

BellSoft

BellSoft has also released CPU patches for versions 25.0.4.1.1, 21.0.12.1.1, 17.0.20.1.1, 11.0.32.1.1, 8u511 7u521 and 6u521 of Liberica JDK, their downstream distribution of OpenJDK, to address this list of CVEs. In addition, Patch Set Update (PSU) versions 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33 and 8u512, containing CPU and non-critical fixes, have also been released.

With an overall total of 1438 fixes and backports, BellSoft states they have participated in eliminating 144 issues in all releases.

WildFly

The release of WildFly 42 delivers bug fixes, dependency upgrades and new features such as: support for virtual threads in their implementation of the Jakarta Concurrency specification; and the ability to transform an instance of the Java Principal interface, obtained from a JSON Web Token, when using the Wildfly Elytron token-realm security component by configuring a principal transformer, such as a case-principal-transformer, before the Principal is passed to the application being secured. More details on this release may be found in the release notes.

Apache POI

The release of Apache POI 6.0.0, the Java API for Microsoft Documents, 6.0.0 ships with dependency upgrades and new features such as: a minimal JDK 17 version; an update to the useCachedValuesForFormulaCells() method, defined in the DataFormatter class, now uses cached values for formula cells by default; and removal of deprecated methods. Further details on this release may be found in the release notes.

Open Liberty

The beta release of Open Liberty 26.0.0.11 provides notable changes such as: support for workload identity and JWK rotation in the JWT Builder in the generated JWTs such that JWT consumers can identify the workload or application that generated it; and the ability to configure the timeout of the server quiesce stage, via the quiesceTimeout element, that was once fixed at 30 seconds; and a beta preview of a new Netty-based HTTP transport as an internal implementation swap of the underlying transport.

Micronaut

The release of Micronaut 5.2.3 delivers resolutions to 10 CVEs from within Micronaut Core 5.2.17 and Micronaut Security 5.4.1. There were also patch updates to modules: Micronaut Data, Micronaut Object Storage and Micronaut Serialization. More details on this release may be found in the release notes.

JobRunr

The release of JobRunr 9.0.2 ships with bug fixes and two new features: a refactor of the Quarkus JobRunrStarter bean such that it is replaceable; and the use of suppliers to retrieve values for SQL query parameters. Further details on this release may be found in the release notes.