Azul’s Security-only, Stability-first™ updates can be deployed immediately to counter the speed of agentic AI threats
INDIA- October 21, 2026 – Azul, the trusted leader in enterprise Java for today’s AI-first world, today released its October Security-only, Stability-first™ updates for Azul Core that are immediately deployable to address all 53 vulnerabilities disclosed in the latest OpenJDK quarterly update. Azul’s Security-only, Stability-first updates contain security fixes and nothing else: no new features, enhancements or unrelated changes that can cause problems. The number of vulnerabilities disclosed in this quarter’s OpenJDK release is the most in a single update in well over a decade and 7x greater than the two-year average of 7.6 Common Vulnerabilities and Exposures (CVEs) per quarter.
OpenJDK quarterly updates that include the fixes to these CVEs also include more than 150 code changes unrelated to security. Azul is the only vendor to offer both monthly and quarterly updates scoped to just security fixes. Enterprises can deploy Azul’s Security-only, Stability-first updates to production immediately and safely to remediate critical vulnerabilities. Other OpenJDK distributions bundle non-security bug fixes, enhancements and even features in their updates, often causing regressions. While such regressions may get fixed with follow-on updates, they can significantly delay the deployment of urgent security fixes.
AI Is Exposing Flaws and Enabling Exploits Faster than Ever
CSO recently reported that researchers using an AI tool found a 13-year-old remote code execution flaw in Apache ActiveMQ in about 10 minutes. Two weeks after disclosure, nearly 6,500 internet-facing instances were still unpatched. In a case documented by GreyNoise, a suspected attacker used hundreds of AI agents to chain two zero-day flaws in PaperCut NG/MF, going from an empty workspace to remote code execution in under four hours. The agents ultimately reached at least 440 instances across 395 organizations in 48 countries, with full domain administrator control in seven minutes.
Java has been running mission-critical systems for more than 30 years, making it one of the most battle-tested platforms in enterprise computing. But AI is now exposing flaws that survived years of testing and review. Researchers are using it to uncover vulnerabilities in decades-old code, while threat actors use agentic AI to find and exploit them at a speed and scale never seen before. Because the vast majority of enterprises rely on Java for production applications and infrastructure, the impact will be felt in every industry and region. And the risk is immediate, for three reasons:
The skill barrier is falling. AI lets less-skilled attackers do work that once required experts.
Attackers are outpacing defenders. Mean time to exploit (MTTE) has shrunk to -7 days, meaning exploitation often begins before a patch is available, while the median enterprise patch cycle is 43 days.
It is no longer safe to delay addressing low-severity CVEs. AI can chain even low-severity CVEs into effective and significant attacks, multiplying the number of exploitable paths.
Enterprises’ Patch Deployment Cycles Have Not Kept Pace With AI-Speed Attackers
In the past, it may have been acceptable to wait weeks or months for stable, regression-free security updates before addressing known vulnerabilities – that timeline no longer works. Attackers are moving faster. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) maintain a Known Exploited Vulnerabilities (KEV) catalog that lists flaws confirmed to be under active attack. According to Azul’s analysis of that catalog, 61% of vulnerabilities published in 2025 that were later exploited were added within 30 days of public disclosure. The true share is likely higher: the figure excludes the roughly one in four exploited vulnerabilities already listed on or before disclosure day, and CISA typically lists a flaw only after exploitation has begun. For most exploited vulnerabilities, the window between disclosure and attack is now measured in days, not weeks or months.
Security-Only, Stability-First Updates Ready for Immediate Deployment
Azul is the only vendor to offer Security-only, Stability-first quarterly, monthly and out-of-cycle OpenJDK updates, which contain only security fixes, with no new features or unrelated bug fixes. These are built on the previous quarter’s stabilized full patch update, which Azul and the broader Java community have already tested extensively. With changes limited to security fixes only, the potential surface for regression is dramatically reduced. Since 2020 , more than 20% of OpenJDK quarterly updates included regressions that prevented their timely rollouts. During that same time, no security-only updates from Azul have had deployment-preventing regressions, and Azul customers were able to deploy straight to production in rapid manner. In addition, Azul delivers monthly, Stability-first Critical Security Patch Updates (CSPUs) layered on the existing security-only quarterly update, a capability no other Java vendor or OpenJDK distribution offers.
Prior OpenJDK quarterly updates have included regressions as serious as breaking application access to all Google APIs, corrupting Tomcat HTTP content and breaking Hadoop deployments. Enterprises that relied on other OpenJDK distributions had to choose between customer impact and security. In contrast, Azul customers that deployed the Azul Core security-only update did not have to choose and were able to deploy immediately, safely and securely.
Azul Core is a Java SE-compliant build of OpenJDK that is certified with the Technology Compatibility Kit (TCK). Azul Core is a drop-in replacement for Oracle Java and other Java SE-compliant distributions. Azul Core subscribers get monthly and quarterly security-only updates, quarterly full updates and out-of-cycle fixes as needed for every LTS release (8, 11, 17, 21, 25)
Many enterprises also still run Java 6 and 7, an exposure in the age of AI-driven attacks. Azul is the only vendor that provides backported security fixes for these versions, extending the same monthly security cadence to organizations still running older Java in production.
Azul Partners Can Help Customers Close the Exposure Window
Azul’s resellers and security services delivery partners are able to help their customers manage and remediate the quickly growing number of threats by taking the October update to security-conscious customers now. Resale and services for the Security-only, Stability-first updates are included in current Azul Core channel pricing.
Closing the Gap Between Disclosure and Deployment
“The record number of vulnerabilities in one OpenJDK update is a very real warning to all enterprises running their business-critical workloads on Java. AI has collapsed the time between disclosure and exploitation from weeks to days to hours, and attackers are chaining flaws that defenders used to rank as low priority,” said Scott Sellers, co-founder and CEO of Azul. “Enterprises shouldn’t have to choose between security and stability. Azul’s Security-only, Stability-first updates are able to be deployed immediately, so customers can close the exposure window before an attacker finds it first.”
Enterprises running Oracle Java, other OpenJDK builds or free Azul Zulu builds in production, or that want to shorten the time it takes to remediate the 53 vulnerabilities disclosed in today’s quarterly update, can get patched with Azul today.
