Loading story…
Oracle released Java 26 / JDK 26 as part of its six-month cadence, delivering 10 JDK Enhancement Proposals and a set of incremental changes across performance, networking, language behavior, and security. Security-relevant additions include a preview PEM encoding API in JEP 524 for handling keys, certificates, and certificate revocation lists, plus support for hybrid public key encryption, post-quantum-ready JAR signing, and stronger controls for cryptographic algorithms and legacy keystores. The release also adds HTTP/3 support to the standard HTTP Client API through JEP 517, enabling applications to communicate with HTTP/3 servers with minimal code changes.
Coverage of the release emphasizes that Java 26 is not an LTS release, but still introduces changes intended to keep the platform current for developers adopting newer builds. Additional updates include JEP 500, which warns when deep reflection is used to mutate final fields as part of Java’s “integrity by default” direction, along with performance work such as reduced synchronization in the G1 garbage collector and broader ahead-of-time object caching. The reporting consistently characterizes Java 26 as an incremental platform update with meaningful improvements in cryptography, transport security, and runtime performance, rather than a specific security incident or vulnerability disclosure.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Oracle said JDK 26 will receive updates until September 2026, when JDK 27 is expected under the project's six-month release cadence. This clarified the support window for the non-LTS release.
Java 26 added HTTP/3 support to the standard HTTP Client API, improved G1 garbage collector throughput, and expanded ahead-of-time object caching and startup optimizations to work with any garbage collector. The release also included features such as lazy constants and removed the obsolete Applet API.
The release introduced security-focused changes including a second preview of a PEM encoding API, hybrid public key encryption, post-quantum-ready JAR signing, and stronger controls for cryptographic algorithms and legacy keystores. It also added compiler warnings for deep reflection that mutates final fields, signaling future enforcement of final-field immutability.
Oracle released Java 26/JDK 26 as the 17th consecutive six-month feature release, introducing 10 JDK Enhancement Proposals across performance, security, networking, and language features. Oracle said the release is not a long-term support version.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle has released **Java 27** and OpenJDK 27, introducing JEP 527 hybrid key exchange for TLS 1.3 to protect encrypted traffic against “harvest now, decrypt later” attacks enabled by future quantum computing. The release also makes the Garbage-First (**G1**) collector the default across all deployment environments, replacing the Serial collector in constrained deployments, and enables compact object headers by default, reducing headers from 96 to 64 bits to improve memory efficiency and deployment density. Java 27 further advances the Vector API, structured concurrency, pattern matching, primitive-type support, and lazy constants through preview or incubator features. Oracle also issued an early-access JDK 28 build with initial Project Valhalla components, updated Helidon and JavaFX, and added the FIPS 140-3-certified Oracle Jipher 20 cryptographic module to its Java Verified Portfolio; it said these capabilities will progressively reach long-term-support releases.
Sep 16, 2026
Oracle released its January 2026 *Critical Patch Update (CPU)*, delivering **337 security updates addressing 158 unique CVEs** across roughly 30 product families; **27** of the updates were rated **critical**. Tenable’s analysis highlights broad exposure to remotely exploitable issues without authentication across multiple Oracle product lines, and notes **CVE-2026-21945**, a high-severity **SSRF** issue in Oracle Java, was discovered by Tenable Research. A standout issue in the CPU is **CVE-2026-21962** (CVSS **10.0**), an **easily exploitable, unauthenticated, network-reachable (HTTP)** vulnerability in Oracle Fusion Middleware components **Oracle HTTP Server** and the **WebLogic Server Proxy Plug-ins** (Apache and IIS). Successful exploitation can enable **unauthorized creation, deletion, or modification of critical data** and potentially broader downstream impact due to a **scope change** (`S:C`), meaning compromise may significantly affect additional products; affected versions include **12.2.1.4.0**, **14.1.1.0.0**, and **14.1.2.0.0** (with the IIS proxy plug-in affected in **12.2.1.4.0** only).
Jun 29, 2026
The OpenSSL Project released updated versions across multiple supported branches to fix a set of security flaws in the SSL/TLS toolkit, with **OpenSSL 3.6.2** carrying the broadest set of patches. The updates address issues including incorrect failure handling in RSA KEM `RSASVE` encapsulation, an out-of-bounds read in `AES-CFB-128` on x86-64 systems with `AVX-512` support, a potential use-after-free in DANE client code, several `NULL` pointer dereference bugs, and a heap buffer overflow in hexadecimal conversion. OpenSSL said the most severe issue in the release was rated **Moderate**. Additional releases — **3.5.6, 3.4.5, 3.3.7, 3.0.20, 1.1.1zg, and 1.0.2zp** — also shipped with security fixes and minor bug corrections, though older branches received smaller subsets of the patches. The 3.6.2 release also repaired two regressions introduced in 3.6.0 affecting `X509_V_FLAG_CRL_CHECK_ALL` behavior and stapled OCSP response handling that could trigger handshake failures. Administrators running **OpenSSL 3.6.x** on x86-64 systems with `AVX-512` enabled were specifically urged to prioritize the `AES-CFB-128` fix because of memory-read exposure.
Jun 29, 2026