Java: security advisories, deprecations and releases

GitHub expands malware advisories to eight ecosystems via OpenSSF

GitHub integrated OpenSSF malicious-packages data into its Advisory Database, extending malware detection from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.

Apache Struts Command Injection Vulnerability

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

CVE-2016-3081

Athena begins disclosing AI-discovered vulnerabilities

Athena starts publishing AI-discovered vulnerabilities along with patches, advisories, and remediated Java artifacts for defenders.

Spring Boot 3.5 End of Support - Migration Guide

Spring Boot 3.5 reaches end of support, requiring migration to version 4 for continued security updates and compatibility.

Amazon Corretto 27 reaches end of life on 2027-04-30

Amazon Corretto 27 reaches end of life on 2027-04-30, as listed by endoflife.date.

Red Hat build of OpenJDK 8 reaches end of life on 2026-11-30

Red Hat build of OpenJDK 8 reaches end of life on 2026-11-30, as listed by endoflife.date.

Amazon Corretto 26 has reached end of life

Amazon Corretto 26 reached end of life on 2026-10-31, as listed by endoflife.date.

BellSoft Liberica JDK 8 reaches end of life on 2026-11-30

BellSoft Liberica JDK 8 reaches end of life on 2026-11-30, as listed by endoflife.date.

Retirement: Support for Java 8, 11 and 17 will end on September 1, 2027

Azure App Service will stop supporting Java 8, 11 and 17 on September 1, 2027. Apps will continue running but security updates and support will cease.

Spring Boot 4.0 reaches end of life on 2026-12-31

Spring Boot 4.0 reaches end of life on 2026-12-31, as listed by endoflife.date.

Spring Security 7.0 reaches end of life on 2026-12-31

Spring Security 7.0 reaches end of life on 2026-12-31, as listed by endoflife.date.

SapMachine 27 reaches end of life on 2027-03-31

SapMachine 27 reaches end of life on 2027-03-31, as listed by endoflife.date.

Quarkus 3.33 reaches end of life on 2027-03-25

Quarkus 3.33 reaches end of life on 2027-03-25, as listed by endoflife.date.

Red Hat build of OpenJDK 8 reaches end of life on 2026-11-30

Red Hat build of OpenJDK 8 reaches end of life on 2026-11-30, as listed by endoflife.date.

Quarkus 3.39 has reached end of life

Quarkus 3.39 reached end of life on 2026-09-30, as listed by endoflife.date.

Oracle GraalVM 17 has reached end of life

Oracle GraalVM 17 reached end of life on 2026-09-30, as listed by endoflife.date.

Oracle JDK 17 has reached end of life

Oracle JDK 17 reached end of life on 2026-09-30, as listed by endoflife.date.

Oracle JDK 27 reaches end of life on 2027-03-31

Oracle JDK 27 reaches end of life on 2027-03-31, as listed by endoflife.date.

OpenJDK builds from Oracle 27 reaches end of life on 2027-03-23

OpenJDK builds from Oracle 27 reaches end of life on 2027-03-23, as listed by endoflife.date.

IBM Semeru Runtime 26 has reached end of life

IBM Semeru Runtime 26 reached end of life on 2026-09-30, as listed by endoflife.date.

IBM Semeru Runtime 27 reaches end of life on 2027-03-31

IBM Semeru Runtime 27 reaches end of life on 2027-03-31, as listed by endoflife.date.

Eclipse Temurin 27 reaches end of life on 2027-03-23

Eclipse Temurin 27 reaches end of life on 2027-03-23, as listed by endoflife.date.

Bellsoft Liberica JDK 27 reaches end of life on 2027-03-23

Bellsoft Liberica JDK 27 reaches end of life on 2027-03-23, as listed by endoflife.date.

Bellsoft Liberica JDK 8 reaches end of life on 2026-11-30

Bellsoft Liberica JDK 8 reaches end of life on 2026-11-30, as listed by endoflife.date.

Azul Zulu 26 has reached end of life

Azul Zulu 26 reached end of life on 2026-09-30, as listed by endoflife.date.

Azul Zulu 27 reaches end of life on 2027-03-31

Azul Zulu 27 reaches end of life on 2027-03-31, as listed by endoflife.date.

Amazon Corretto 26 reaches end of life on 2026-10-31

Amazon Corretto 26 reaches end of life on 2026-10-31, as listed by endoflife.date.

Spring Boot 4.2 Release Candidate Focuses on Performance

Spring Boot 4.2 RC introduces improved startup performance and enhanced upgrade checking capabilities for production deployments.

JDK 27 G1/Parallel/Serial GC changes

Overview of improvements and behavioral updates to the G1, Parallel and Serial garbage collectors in the newly released JDK 27.

Spring Security 7.2.0-RC1 and maintenance releases

Spring Security 7.2.0-RC1 and maintenance releases 7.0.8, 7.1.2 address security vulnerabilities and add features.

Amazon Corretto October 2026 Patch Updates

Patch releases for Corretto 27, 25, 21, 17, 11 and 8 are now available for download.

JEP 544: Ahead-of-Time Code Compilation targeted for JDK 28

JEP 544, which introduces ahead-of-time code compilation, is now targeted for inclusion in JDK 28.

Amazon Corretto October 2026 Quarterly Updates

Amazon released quarterly security and critical updates for six Corretto LTS OpenJDK versions, now available for download.

Spring Cloud 2025.1.4 (Northfields) Released

Spring Cloud 2025.1.4 is now available, based on Spring Boot 4.0.9 and also supporting 4.1.2, with numerous bug fixes across all modules.

Spring Cloud 2026.0.0-RC1 (Paddington) release candidate available

Spring Cloud 2026.0.0-RC1 is based on Spring Boot 4.2.0-RC1 and includes OAuth 2 support in Config, WebSocket support in Gateway MVC, HA for Kubernetes Configuration Watcher, and the move of Spring Cloud Bus into Stream.

Spring Boot 4.2.0-RC1 available now

Spring Boot 4.2.0-RC1 is released with 113 changes, a new Buildpacks builder, properties-migrator error handling, and faster jar startup.

Spring Boot 4.1.2 available now

Spring Boot 4.1.2 is released, containing 126 bug fixes, documentation updates, and dependency upgrades.

Spring Boot 4.0.9 available now

Spring Boot 4.0.9 released with 99 bug fixes, documentation improvements, and dependency upgrades.

JEP 543: Structured Concurrency targeted to JDK 28

The Structured Concurrency JEP 543 has been formally targeted for inclusion in the upcoming JDK 28 release.

JEP 546: Adaptive Heap Sizing for ZGC targeted to JDK 28

JEP 546 adds adaptive heap sizing to the Z Garbage Collector, allowing it to dynamically adjust heap size based on workload.

Everyday JSON in Java

A JEP proposes a built-in, incubating JSON API for Java aimed at small use cases that do not need external libraries.

Apache Maven 3.10 released

Apache Maven 3.10 was released on 2026-09-27.

Amazon Corretto September 2026 Patch Updates

Amazon released patch updates for Corretto 25, 21, 17, and 11 including tzdata 2026d.

Spring Cloud 2026.0.0-M1 (Paddington) Released

First milestone of Spring Cloud 2026.0.0 introduces distributed system improvements.

Spring Security 7.2.0-M2 Available

Security milestone release includes authentication and authorization improvements.

Spring Boot 4.2.0 M2 Released

Milestone release adds SSL bundle support for LDAP, OpenTelemetry semantic conventions, and common OTLP configuration options.

JEP 540: Simple JSON API (Incubator) targeted to JDK 28

JEP 540 introduces an incubator module that provides a simple, lightweight JSON API for the Java platform.

Select AI for Java

New Java SDK for Oracle Autonomous Database Select AI features including profiles, credentials, conversations, vector indexes, NL2SQL, RAG, and summarization.

Amazon Corretto 27 generally available with new OpenJDK features

Amazon Corretto 27 is a no-cost OpenJDK distribution supporting Linux, Windows, and macOS through April 2027. Includes G1 GC default, post-quantum TLS, compact headers, and JFR redaction.

Amazon Corretto 8 September 2026 Patch Updates

Amazon Corretto 8u504 patch released with tzdata 2026d updates for LTS OpenJDK distribution.

Quarkus 3.40 released

Quarkus 3.40 was released on 2026-09-30.

Eclipse Temurin 27 released

Eclipse Temurin 27 was released on 2026-09-22.

October 2026 Spring News Roundup

Michael Redlich compiles latest developments and announcements in the Spring ecosystem for October 2026.

Harness Engineering for Java and Spring Boot

Siva presents engineering practices and patterns for building robust Java and Spring Boot applications.

Episode 73 “Immutable Data Beyond Value Classes” [AtA]

Recent and upcoming Java features such as value classes, withers, and lazy constants simplify building and handling immutable data structures.

Java Secure Coding Guidelines

Overview of secure coding practices for Java with examples of insecure code and how to fix it, plus recent updates on input validation and serialization.

Quality Outreach Heads-up - JDK 28: Value Classes

Heads-up on the introduction of value classes and strict fields in JDK 28, shared with affected projects.

Using .env files with Spring Boot

SivaLabs video covering how to load and manage environment variables via .env files in Spring Boot.

Server-side request forgery protection in Spring Boot 4.1

Video tutorial on new SSRF protections available in Spring Boot 4.1.

Generate code for Spring workloads with skills

SivaLabs video showing how to use skills to produce tailored Spring code from prompts.

No-build MCP services with Spring and JBang

Craig Walls demonstrates how to create Spring-based MCP services without any build tooling using JBang.

Reflect, Transform, Accelerate: Bringing GPU Computing to Java

OpenJDK Project Babylon's code reflection API and HAT framework enable Java developers to run GPU-accelerated workloads like matrix multiplication for AI.

A Bootiful Podcast: Can Java be more performant than Rust? Andrew Lombardi has the numbers

Podcast episode discusses a Kotlin port of a real application and benchmarks comparing JVM and Rust performance with AI assistance.

How Does Java Fit Into the World of AI—and How Can It Become an Even Better Fit?

Explains why Java suits AI workloads and how upcoming language, library and runtime features can make it stronger.

Java - The Year of the Runtime!

Keynote argues that as AI reduces the importance of language syntax, JVM performance, observability, GC, and usability in newer JDKs become central to Java's future.

A Bootiful Podcast: legendary Java developer Kohsuke Kawaguchi

Spring podcast interviews Kohsuke Kawaguchi on Java history, Jenkins origins, Launchable, and AI's impact on developer tools.

This Week in Spring - October 6th, 2026

Weekly roundup of Spring community posts, podcasts, videos, and tools covering Spring AI, Spring Boot, and Spring Security.

Finding Gadgets Like it’s 2026

Atredis used Claude Code plus WALA to discover 17 Java deserialization gadget chains (6 novel) in WildFly, Payara and WebSphere within two days.

Upgrading to Spring Boot 4

Conference talk covering internal work and practical steps for Spring Boot 4 upgrades.