Foojay Podcast #104: 53 CVEs and Two Emergency Releases: Why Java Security Holds Up
The October OpenJDK update fixed a record 53 CVEs, followed a few days later by two out-of-cycle releases. For Foojay Podcast #104, I talked with Simon Ritter, Deputy CTO at Azul and member of the OpenJDK Vulnerability Group, about what happened and what it means for people running Java.
What we talked about
- What a CVE is and how vulnerabilities are handled in secret until a patch exists
- Why the number of fixes jumped from 7.6 per quarter on average to 53, and how AI changes the discovery of CVEs
- The eMudhra certificate problem behind the two out-of-cycle releases, and the backporting work for every supported Java version
- Free versus paid OpenJDK builds, and what CPU, PSU and CSPU mean
- The conclusion: check your Java version and be ready to update at any moment
Guest
- Simon Ritter - Deputy CTO at Azul and Java Champion
Links
- Free Java, Real Risk: Why Unsupported OpenJDK Is Now a Security Gamble
- Azul Zulu October 2026 Quarterly Update and Out-of-Cycle Release
See Foojay Podcast #104 for more info, shownotes, links, etc.