53 CVEs and Two Emergency Releases: Why Java Security Holds Up (#104)
44 min
A record 53 CVEs in one Java update, followed by two emergency releases within days. Yes, a lot of issues are being found, but Java is still strong: a whole community and the commercial distributors are behind every fix. In this episode, Simon Ritter, Deputy CTO at Azul, Java Champion and member of the OpenJDK Vulnerability Group, explains what happened over the past weeks and what it means for your applications. We cover how a vulnerability travels from a report to a patch, why AI is changing the number of fixes, and why you should be ready to update at any moment. If you want to understand how CVEs are handled behind the scenes and what the different types of security updates mean, this episode explains it. Topics include: What a CVE and a CVSS score really tell you, and why low scores can be chained into serious attacksHow vulnerabilities are kept secret and encrypted in the OpenJDK Vulnerability Group until a patch existsWhy the average of 7.6 CVEs per quarter jumped to 53, and the move toward monthly security updatesThe eMudhra certificate problem and the two out-of-cycle releases that followedThe backporting workload behind every supported Java version, from 27 down to 6CPU, PSU and CSPU explained, and what free versus paid OpenJDK builds mean for your patching Guest: Simon RitterDeputy CTO at Azul and Java ChampionSimon on LinkedIn Links: Full show notes with all linksFree Java, Real Risk: Why Unsupported OpenJDK Is Now a Security GambleAzul Zulu October 2026 Quarterly Update and Out-of-Cycle Release Timestamps:00:00 Introduction of topic and guest01:59 What is a CVE and how are they reported and handled?08:45 How the Java security release cycle is changing and each have more CVEs11:48 How AI impacts the discovery of CVEs14:09 What was the eMudhra problem causing two out-of-cycle security updates?21:49 The impact of creating an out-of-cycle update (and backports)26:05 How safe will OpenJDK builds be in the future? And dependencies?29:06 Free versus paid vers...
