Azul and Oracle Announce Monthly Security Updates for Java

• •Azul and Oracle will deliver monthly Critical Security Patch Updates for Java starting August 2026.
• •The shift to monthly updates is in response to the rapid discovery and exploitation of vulnerabilities by AI.
• •Organizations must adapt their patching processes to accommodate the increased frequency of updates.

Azul and Oracle are transitioning to a monthly cadence for Critical Security Patch Updates (CSPUs) for Java, starting in August 2026. This change is driven by the increasing speed at which AI identifies and exploits vulnerabilities, making the traditional quarterly updates insufficient. Azul will provide CSPUs for all supported Long-Term Support (LTS) versions, including Java 8, 11, 17, 21, 25, and the current release Java 26. Oracle also plans to implement a similar monthly update schedule, with the first CSPU set for August 18, 2026. Both companies emphasize a focus on security and stability, avoiding new features in these updates. This shift aims to mitigate the risks associated with waiting for quarterly updates, which can leave systems vulnerable for extended periods. Organizations using Java are advised to prepare for more frequent patching to maintain security compliance.