Oracle has released its first monthly security patch, the Critical Security Patch Update, on August 18, containing 943 patches. The next major update is scheduled for October 20, which is expected to be larger than usual. This follows a record-breaking July update that included 1,448 patches.
Spring has published 91 security advisories on August 20, including 1 critical, 17 high, 55 medium, and 18 low vulnerabilities. This is a significant increase compared to the 16 CVEs released in 2025, primarily driven by AI-based analysis. Sonatype reported that 148,608 components are affected.
Upcoming JDK 28 updates will introduce a simple JSON API as an incubator module (jdk.incubator.json) under JEP 540, and make generational mode for Shenandoah GC the default under JEP 535. Additionally, JEP 401 and JEP 539 introduce Value Objects, where the '==' operator now compares state rather than references.
Oracle has provided a roadmap for post-quantum cryptography. ML-KEM and ML-DSA will be integrated into JDK 25, with backports to JDK 21 and 17 in October 2026, and to JDK 11 and 8 in the second half of 2027. Hybrid key exchange for TLS 1.3 will be added to JDK 25 in October 2026, and to JDK 21 and 17 in the first half of 2027.
