Azul Patches All 53 OpenJDK Vulnerabilities With Security-Only Updates
Azul, a provider of enterprise Java solutions for AI-driven business environments, has released its October Security-only, Stability-first™ updates for Azul Core, addressing all 53 vulnerabilities disclosed in the latest quarterly OpenJDK security update. The company said its updates are immediately deployable to help enterprises remediate security risks without introducing unrelated software changes that could disrupt production applications.
The latest OpenJDK quarterly release disclosed 53 Common Vulnerabilities and Exposures (CVEs), marking the highest number of vulnerabilities reported in a single update in well over a decade. According to Azul, the total is approximately seven times the two-year quarterly average of 7.6 CVEs.
Azul’s Security-only, Stability-first updates contain security fixes exclusively, excluding new features, enhancements, and unrelated bug fixes. The approach is designed to help organizations deploy urgent security patches while reducing the possibility of software regressions that can delay production rollouts.
OpenJDK quarterly releases that incorporate the latest vulnerability fixes also contain more than 150 code changes unrelated to security, according to Azul. The company says it is the only vendor offering both monthly and quarterly OpenJDK updates limited to security fixes, alongside additional updates when urgent vulnerabilities require attention.
For enterprises operating mission-critical Java applications, separating security fixes from other software changes can help reduce deployment risks and shorten the time required to address newly disclosed vulnerabilities.
AI Accelerates Vulnerability Discovery and Exploitation
The growing use of artificial intelligence in cybersecurity is changing how quickly software vulnerabilities can be identified and exploited. Security researchers are using AI tools to discover weaknesses in established software, while attackers are increasingly applying AI agents to automate vulnerability exploitation.
Azul cited a report from CSO describing how researchers using an AI tool identified a 13-year-old remote code execution vulnerability in Apache ActiveMQ in approximately 10 minutes. Nearly 6,500 internet-facing instances reportedly remained unpatched two weeks after the vulnerability was disclosed.
The company also referenced research published by GreyNoise describing a suspected AI-orchestrated campaign targeting PaperCut NG/MF. According to the cited account, hundreds of AI agents chained two zero-day vulnerabilities, progressing from an empty workspace to remote code execution in less than four hours. The campaign reportedly reached at least 440 instances across 395 organizations in 48 countries, with full domain administrator control achieved in seven minutes.
These examples illustrate the potential for AI to reduce the time and expertise required to identify weaknesses and develop attacks.
Java has supported enterprise applications for more than three decades and remains a foundational technology for business-critical systems. However, vulnerabilities in long-established code can still create security risks as new tools make previously difficult weaknesses easier to discover.
Azul identifies three factors contributing to the changing threat environment.
First, AI is lowering the technical barriers to cyberattacks, allowing less-experienced attackers to perform tasks that previously required specialized expertise.
Second, attackers are exploiting vulnerabilities faster than many organizations can deploy patches. Azul cites a mean time to exploit figure of negative seven days, indicating that exploitation may begin before a patch becomes available. The company contrasts this with a median enterprise patching cycle of 43 days.
Third, security teams can no longer assume that vulnerabilities classified as low severity are unimportant. Attackers may combine multiple weaknesses to create effective attack paths with consequences greater than those associated with individual vulnerabilities.
Enterprise Patching Must Keep Pace With Emerging Threats
Traditional enterprise patching processes often involve extensive testing before software updates are deployed into production. Although this approach can help protect application stability, lengthy approval and testing cycles may leave known vulnerabilities exposed for extended periods.
Azul cited its analysis of the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog, which identifies security weaknesses confirmed to have been exploited in real-world attacks.
According to the company’s analysis, 61% of vulnerabilities published in 2025 that were subsequently exploited were added to the catalog within 30 days of public disclosure.
Azul noted that the actual proportion could be higher because approximately one-quarter of exploited vulnerabilities were already listed on or before their disclosure dates. Additionally, vulnerabilities generally enter the catalog after evidence of exploitation emerges.
These findings highlight the challenges organizations face when their patching processes operate on timelines measured in weeks while attackers can develop exploits within days or hours.
For businesses relying on Java-based applications, delays in deploying security updates can increase exposure to threats affecting customer systems, internal operations, and critical infrastructure.
Security-Only Updates Aim to Reduce Deployment Risks
Azul’s Security-only, Stability-first updates are designed to address the gap between vulnerability disclosure and remediation.
The company applies security fixes to a previously stabilized quarterly update that has undergone testing by Azul and the broader Java community. By limiting subsequent changes to security-related modifications, Azul aims to reduce the amount of new code that must be evaluated before deployment.
The company reports that more than 20% of OpenJDK quarterly updates since 2020 included regressions that prevented timely deployment. Azul says its security-only updates have not experienced deployment-preventing regressions during the same period.
According to the company, this approach has enabled customers to deploy security fixes directly into production without waiting for follow-up releases to resolve unrelated problems.
Previous OpenJDK quarterly updates have reportedly introduced regressions affecting access to Google APIs, Tomcat HTTP content, and Hadoop deployments. Such problems can force enterprises to choose between addressing security vulnerabilities immediately and maintaining application stability.
Azul’s model seeks to reduce this conflict by separating urgent security remediation from broader software changes.
In addition to quarterly security-only releases, Azul provides monthly Stability-first Critical Security Patch Updates (CSPUs) based on existing security-only updates. The company also offers out-of-cycle patches for urgent security incidents.
Azul states that this combination of monthly, quarterly, and out-of-cycle security-only updates distinguishes its offering from other Java distributions.
Azul Core Supports Multiple Java Versions
Azul Core is a Java SE-compliant distribution of OpenJDK certified through the Technology Compatibility Kit (TCK). The company positions it as a drop-in replacement for Oracle Java and other Java SE-compliant distributions.
Azul Core subscribers receive monthly and quarterly security-only updates, full quarterly updates, and out-of-cycle fixes when required. Supported long-term support releases include Java 8, 11, 17, 21, and 25.
The company also provides backported security fixes for Java 6 and Java 7, which remain in use in some enterprise environments despite their age.
Azul says it is the only vendor providing these backported security fixes for both older versions, helping organizations maintain legacy applications while continuing to address security vulnerabilities.
For enterprises operating unsupported Java runtimes, moving to a commercially supported distribution can help establish a consistent patching process and improve access to timely security updates.
Azul recommends that organizations inventory their production Java environments and consider standardizing on a supported, TCK-certified OpenJDK distribution. Because Azul Core is designed as a drop-in replacement, migration may be possible without application code changes, although compatibility and deployment requirements should be evaluated for each environment.
Channel Partners Can Support Enterprise Remediation
Azul’s resellers and security services delivery partners can help customers evaluate their Java environments and deploy the October security updates.
The company said channel partners can offer the Security-only, Stability-first updates to customers seeking to address the newly disclosed vulnerabilities. Resale and services for these updates are included in existing Azul Core channel pricing.
The approach is intended to help organizations reduce exposure to known vulnerabilities while limiting disruption to business-critical applications.
Azul Urges Enterprises to Accelerate Security Patching
Scott Sellers, co-founder and CEO of Azul, said the record number of vulnerabilities in the latest OpenJDK update highlights the need for enterprises to reconsider how they manage Java security.
Sellers emphasized that AI is shortening the time between vulnerability disclosure and exploitation, while attackers are combining weaknesses that security teams may previously have considered lower priority.
He said enterprises should not have to choose between security and software stability, adding that Azul’s security-only updates are designed for immediate deployment so customers can reduce their exposure before attackers exploit the vulnerabilities.
Organizations running Oracle Java, other OpenJDK distributions, or free Azul Zulu builds can explore Azul Core and its security updates through the company’s official website.
Source Link: https://www.businesswire.com/