On September 17, 2026, AWS released Corretto 27, its free OpenJDK distribution, with hybrid post-quantum key exchange for TLS 1.3 and compact object headers turned on by default. Test these wins in non-critical environments, but keep your LTS workloads on Java 21 or 25 — this release is only supported through April 2027.

On August 5, 2026, Huntress researchers documented an attack where the khunt toolkit was compiled and executed inside an Oracle database via SQL injection on an Apache Tomcat endpoint. Attackers abused Oracle's embedded JVM to run OS commands with SYSTEM privileges, steal Windows hashes, and map the network. The message to DBAs is clear: your database is a full Java runtime — treat it like one.

CVE-2026-16723 (CVSS 9.0) enables unauthenticated RCE on Fastjson 1.x with no patch forthcoming — ever. Enable SafeMode immediately and plan your Fastjson 2.x migration. Here is the three-step response plan.