Java News Roundup: JDK 28 Schedule, Oracle CPUs, eMudhra Certs, Apache POI, WildFly, Azul, BellSoft

The roundup covers both planned Java development and urgent security maintenance. Oracle published October 2026 JDK updates for versions 27, 25, 21, 17, 11, and 8. JDK 28 Build 21 also arrived as an early-access build. A proposed release schedule appears in the JDK 28 section, although the schedule text calls it a proposal for JDK 24.

The security story centers on Oracle’s October Critical Patch Update and the compromise of eight eMudhra intermediate CA private keys. Azul updated Zulu versions 27 through 6 and addressed 53 CVEs. BellSoft updated Liberica releases with CPU and PSU packages, including fixes and backports.

The release news extends beyond the JDK. WildFly 42 reached general availability, as did Apache POI 6.0. Open Liberty 26.0.0.11 entered beta, while Micronaut and JobRunr received maintenance releases. These updates show Java’s ecosystem moving on several tracks at once.

A Critical Patch Update, or CPU, is a planned security release. Oracle issues these updates quarterly, and its October 2026 CPU included new JDK versions across several supported Java lines. The goal is to deliver important vulnerability fixes on a predictable schedule.

A Patch Set Update, or PSU, includes the CPU fixes plus additional non-critical corrections. BellSoft’s PSU versions contained both CPU changes and non-critical fixes. For example, BellSoft published PSU versions for JDK 27, 25, 21, 17, 11, and 8. That makes a PSU broader than the matching CPU.

An out-of-cycle update breaks the normal timetable because waiting would create too much risk. Azul released one on October 21 after the eMudhra private-key compromise. The update blocked the affected certificates inside its JDKs before the next quarterly release, which was not due until January.

The three vendors report different measurements, so their totals cannot be combined into one clean vulnerability number. Oracle’s October 2026 Critical Patch Update produced releases for JDK 27, 25, 21, 17, 11, and 8, but the roundup does not state how many vulnerabilities Oracle addressed.

Azul says its October 2026 Zulu CPU patches cover 53 CVEs. Those patches also included an out-of-cycle change for the compromised eMudhra intermediate CA certificates. A CVE is a standardized identifier for a publicly documented security vulnerability, so Azul’s figure is a vulnerability count.

BellSoft reports a different scale. It lists 1,438 fixes and backports overall and says it participated in eliminating 144 issues across all releases. That figure is not presented as a CVE total. BellSoft also separated CPU releases from broader PSU releases, which included non-critical fixes.

Mozilla disclosed that eight private keys belonging to eMudhra intermediate Certificate Authority certificates had been compromised. Anyone holding one of those keys could potentially issue certificates that impersonated websites or services. That made the incident a trust problem, not merely a defect in one application.

Trust stores and browsers responded quickly. Mozilla says the certificates were blocked in Firefox and Chrome from October 17, on Microsoft platforms from October 20, and on Apple products from October 22. Oracle published a security alert, while Azul and BellSoft released updates for their Java distributions.

Java vendors needed to protect applications that rely on the JDK’s certificate trust data. Azul said no normal quarterly release was due until January, so it shipped an out-of-cycle update on October 21. BellSoft also released CPU patches addressing the CVE list and the certificate issue.

A Certificate Authority is trusted to vouch for the identity of websites and services. An intermediate CA operates beneath a root CA and can issue certificates within that trust chain. This structure lets trust be delegated without using the root CA’s private key for every certificate.

The private key is the secret needed to sign certificates. If an attacker steals an intermediate CA’s private key, the attacker can sign a fraudulent certificate for a target website or service. A client that trusts the intermediate CA may then treat the fraudulent certificate as authentic. The eMudhra incident involved eight compromised intermediate CA private keys.

That is why the breach could affect many unrelated websites or services. Mozilla said an attacker holding a compromised key could impersonate any website or service. Trust stores, browsers, and Java vendors therefore blocked or removed trust in the affected certificates and updated their products.

Certificate revocation checking asks whether a certificate that was once trusted has since been cancelled. The article notes that Java does not perform this check by default. Therefore, simply revoking an eMudhra certificate elsewhere may not stop every Java application from accepting it.

The practical danger is direct. If a fraudulent certificate was signed with a compromised eMudhra key, a Java application could accept it as valid unless another control intervened. Azul explained that the certificates needed to be blocked in the JDK itself. A JDK update can add that block to the trust decisions used by affected applications.

This made emergency vendor updates important. Browsers and operating-system trust stores acted on different dates, but Java distributions followed their own release processes. Azul shipped an out-of-cycle update on October 21, while BellSoft released CPU patches addressing the certificate compromise.

OpenJDK is the open-source Java development project and the foundation for many JDK distributions. Oracle publishes its own JDK builds, while Azul Zulu and BellSoft Liberica are described in the article as downstream distributions of OpenJDK. They share the broader Java platform but package and maintain their products separately.

The roundup shows this relationship in practice. Oracle released its October CPU builds first as versions such as 27.0.1, 25.0.5, and 21.0.13. Azul then published Zulu patches for versions 27 through 6, covering 53 CVEs. BellSoft published Liberica CPU and PSU versions, with additional fixes and backports.

Different schedules allow vendors to coordinate testing, support their chosen version lines, and add distribution-specific changes. They also permit urgent action outside the normal calendar. Azul released an out-of-cycle eMudhra fix, while BellSoft issued its own patches and Oracle published a security alert.