Java's October 2026 Update: JDK 28, Security Alerts, & Framework Gains

Navigating the Java Ecosystem's Latest Moves

This Java News Roundup for October 19th, 2026, offers a valuable snapshot of the Java ecosystem's recent developments. The most critical takeaway is the formal proposal of the JDK 28 release schedule, indicating a steady progression of the Java platform. This forward-looking schedule allows developers to anticipate future features and plan accordingly. Coupled with the proactive release of Oracle's October 2026 Critical Patch Update (CPU) and subsequent patches from Azul and BellSoft, the news emphasizes the industry's commitment to maintaining platform stability and security. The timely response to the eMudhra Intermediate CA certificates breach, with immediate blocking by major browsers and platforms, underscores the importance of robust security practices and rapid incident response in the software development lifecycle. This event highlights a recurring challenge in certificate management and the potential for cascading security implications across interconnected systems.

Beyond security, the roundup showcases significant advancements in key Java-related projects. WildFly 42's inclusion of virtual thread support for Jakarta Concurrency and improved security configurations, along with Apache POI 6.0.0's adoption of JDK 17 as a minimum requirement and default caching for formula cells, are noteworthy. These updates demonstrate a continued effort to modernize and enhance performance within foundational Java technologies. Open Liberty's beta release with workload identity and configurable quiesce timeouts, and maintenance releases for Micronaut and JobRunr, further illustrate the vibrant and evolving nature of the Java development landscape. For organizations heavily invested in the Java ecosystem, these updates are not merely incremental; they represent opportunities to leverage new capabilities, improve application performance, and strengthen security postures. The proactive nature of these releases, especially the out-of-cycle update from Azul to address the CA certificate issue, is a testament to the agility of the Java community in responding to emergent threats.

Key Points

• Proposed release schedule for JDK 28 is formally announced, with General Availability targeted for March 9, 2027.
• Oracle released October 2026 Critical Patch Updates for multiple JDK versions.
• A significant security breach involving compromised eMudhra Intermediate CA certificates has led to widespread blocking by browsers and platforms.
• Azul and BellSoft have released CPU patches, with Azul providing an out-of-cycle update to address the eMudhra breach.
• WildFly 42 is released with support for virtual threads in Jakarta Concurrency and enhanced security configurations.
• Apache POI 6.0.0 requires JDK 17 and introduces default caching for formula cells.
• Open Liberty 26.0.0.11 beta includes workload identity, JWK rotation, and a Netty-based HTTP transport preview.
• Maintenance releases for Micronaut and JobRunr address CVEs and introduce new features.

---

📖 Source: Java News Roundup: JDK 28 Schedule, Oracle CPUs, eMudhra Certs, Apache POI, WildFly, Azul, BellSoft