Azul Patches 53 OpenJDK Vulnerabilities
SUNNYVALE, Calif. — Azul, the trusted leader in enterprise Java for today’s AI-first world, today released its October “Security-only, Stability-first” updates for Azul Core that are immediately deployable to address all 53 vulnerabilities disclosed in the latest OpenJDK quarterly update. The number of vulnerabilities disclosed in this quarter’s OpenJDK release is the most in a single update in well over a decade and 7x greater than the two-year average of 7.6 Common Vulnerabilities and Exposures (CVEs) per quarter.
OpenJDK quarterly updates that include the fixes to these CVEs also include more than 150 code changes unrelated to security. Azul offers both monthly and quarterly updates scoped to just security fixes. Enterprises can deploy Azul’s updates to production immediately and safely to remediate critical vulnerabilities. Other OpenJDK distributions bundle non-security bug fixes, enhancements and even features in their updates, often causing regressions. While such regressions may get fixed with follow-on updates, they can significantly delay the deployment of urgent security fixes.
AI Is Exposing Flaws and Enabling Exploits Faster than Ever
CSO recently reported that researchers using an AI tool found a 13-year-old remote code execution flaw in Apache ActiveMQ in about 10 minutes. Two weeks after disclosure, nearly 6,500 internet-facing instances were still unpatched. In a case documented by GreyNoise, a suspected attacker used hundreds of AI agents to chain two zero-day flaws in PaperCut NG/MF, going from an empty workspace to remote code execution in under four hours. The agents ultimately reached at least 440 instances across 395 organizations in 48 countries, with full domain administrator control in seven minutes.
Java has been running mission-critical systems for more than 30 years, making it one of the most battle-tested platforms in enterprise computing. But AI is now exposing flaws that survived years of testing and review. Researchers are using it to uncover vulnerabilities in decades-old code, while threat actors use agentic AI to find and exploit them at a speed and scale never seen before. Because the vast majority of enterprises rely on Java for production applications and infrastructure, the impact will be felt in every industry and region. And the risk is immediate, for three reasons:
-
The skill barrier is falling. AI lets less-skilled attackers do work that once required experts.
-
Attackers are outpacing defenders. Mean time to exploit (MTTE) has shrunk to -7 days, meaning exploitation often begins before a patch is available, while the median enterprise patch cycle is 43 days.
-
It is no longer safe to delay addressing low-severity CVEs. AI can chain even low-severity CVEs into effective and significant attacks, multiplying the number of exploitable paths.
Azul Core is a Java SE-compliant build of OpenJDK that is certified with the Technology Compatibility Kit (TCK). Azul Core is a drop-in replacement for Oracle Java and other Java SE-compliant distributions. Azul Core subscribers get monthly and quarterly security-only updates, quarterly full updates and out-of-cycle fixes as needed for every LTS release (8, 11, 17, 21, 25)
Many enterprises also still run Java 6 and 7, an exposure in the age of AI-driven attacks. Azul is the only vendor that provides backported security fixes for these versions, extending the same monthly security cadence to organizations still running older Java in production.
Closing the Gap Between Disclosure and Deployment
“The record number of vulnerabilities in one OpenJDK update is a very real warning to all enterprises running their business-critical workloads on Java. AI has collapsed the time between disclosure and exploitation from weeks to days to hours, and attackers are chaining flaws that defenders used to rank as low priority,” said Scott Sellers, co-founder and CEO of Azul. “Enterprises shouldn’t have to choose between security and stability. Azul’s Security-only, Stability-first updates are able to be deployed immediately, so customers can close the exposure window before an attacker finds it first.”
Enterprises running Oracle Java, other OpenJDK builds or free Azul Zulu builds in production, or that want to shorten the time it takes to remediate the 53 vulnerabilities disclosed in today’s quarterly update, can get patched with Azul today.
The post Azul Patches 53 OpenJDK Vulnerabilities appeared first on SD Times.
Tech Developers
No comments