--- title: Foojay Podcast #104: 53 CVEs and Two Emergency Releases:... description: The October OpenJDK update fixed a record 53 CVEs, followed a few days later by two out-of-cycle releases. Simon Ritter, Deputy CTO at Azul and member of the... canonical: https://daily.dev/posts/foojay-podcast-104-53-cves-and-two-emergency-releases-why-java-security-holds-up-dfifl3nde twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Foojay Podcast #104: 53 CVEs and Two Emergency Releases: Why Java Security Holds Up | daily.dev og:description: The October OpenJDK update fixed a record 53 CVEs, followed a few days later by two out-of-cycle releases. Simon Ritter, Deputy CTO at Azul and member of the... og:url: https://daily.dev/posts/foojay-podcast-104-53-cves-and-two-emergency-releases-why-java-security-holds-up-dfifl3nde og:image: https://api.daily.dev/og/posts/DFIFL3NDE.png og:image:alt: Foojay Podcast #104: 53 CVEs and Two Emergency Releases: Why Java Security Holds Up og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Foojay Podcast #104: 53 CVEs and Two Emergency Releases: Why Java Security Holds Up **[WebTechie](https://daily.dev/sources/webtechie)** · 1 min read · 1 upvotes · 0 comments ## Summary The October OpenJDK update fixed a record 53 CVEs, followed a few days later by two out-of-cycle releases. Simon Ritter, Deputy CTO at Azul and member of the OpenJDK Vulnerability Group, discusses what happened on Foojay Podcast #104. The average had been 7.6 CVE fixes per quarter, and AI is changing how vulnerabilities get discovered. The out-of-cycle releases came from an eMudhra certificate problem that required backporting fixes across every supported Java version. The episode also covers free versus paid OpenJDK builds and what CPU, PSU and CSPU mean, concluding that you should check your Java version and be ready to update at any moment. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did OpenJDK release two out-of-cycle updates after the October 2026 quarterly patch? The out-of-cycle releases were triggered by an eMudhra certificate problem, which required backporting fixes across every supported Java version. This followed the October OpenJDK quarterly update, which fixed a record 53 CVEs, a sharp jump from the average of 7.6 CVE fixes per quarter. _Teams tracking Java patch cycles can follow emergency OpenJDK releases like this on daily.dev._ ### What do CPU, PSU and CSPU mean for Java updates? These terms describe the type of OpenJDK release: CPU (Critical Patch Update), PSU (Patch Set Update), and CSPU (Critical and Security Patch Update), distinguishing free security-only builds from paid builds with broader patch sets. Simon Ritter, Deputy CTO at Azul, explains the distinction between free and paid OpenJDK builds in relation to these release types. _Developers weighing free versus paid OpenJDK builds can keep up with release terminology like this on daily.dev._ ### Why did the number of Java CVE fixes jump so dramatically in one quarter? The number of fixes jumped from an average of 7.6 per quarter to 53 in the October 2026 OpenJDK update, partly because AI is changing how vulnerabilities get discovered, according to Simon Ritter, Deputy CTO at Azul and member of the OpenJDK Vulnerability Group. _Anyone patching Java on a schedule can track shifts like this CVE surge on daily.dev._ ## Similar posts on daily.dev - [Foojay Podcast \#104: 53 CVEs, Two Emergency Releases: Why Java Security Holds Up with Simon Ritter](https://daily.dev/posts/foojay-podcast-104-53-cves-two-emergency-releases-why-java-security-holds-up-with-simon-ritter-h1jjb9b4w) · Foojay.io · 1 upvotes · 0 comments - [Java News Roundup: JEPs for JDK 28, Azul Payara, Gatherers4j, Google ADK, Yupiik, Apache Camel CVEs](https://daily.dev/posts/java-news-roundup-jeps-for-jdk-28-azul-payara-gatherers4j-google-adk-yupiik-apache-camel-cves-szm3rw6x0) · InfoQ · 2 upvotes · 0 comments - [Foojay Podcast \#95: Is Your Java App Actually Secure, Or Does It Just Look That Way?](https://daily.dev/posts/foojay-podcast-95-is-your-java-app-actually-secure-or-does-it-just-look-that-way--b0bfzimhn) · Foojay.io · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java) [View this post on daily.dev](https://daily.dev/posts/foojay-podcast-104-53-cves-and-two-emergency-releases-why-java-security-holds-up-dfifl3nde) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Foojay Podcast #104: 53 CVEs and Two Emergency Releases: Why Java Security Holds Up","url":"https://daily.dev/posts/foojay-podcast-104-53-cves-and-two-emergency-releases-why-java-security-holds-up-dfifl3nde","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/foojay-podcast-104-53-cves-and-two-emergency-releases-why-java-security-holds-up-dfifl3nde"},"datePublished":"2026-11-02T08:36:24.780Z","dateModified":"2026-11-03T16:39:10.770Z","description":"The October OpenJDK update fixed a record 53 CVEs, followed a few days later by two out-of-cycle releases. Simon Ritter, Deputy CTO at Azul and member of the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a0fe650d460e4092b5df4874ed0e61d8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a0fe650d460e4092b5df4874ed0e61d8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"WebTechie","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"WebTechie","logo":"https://media.daily.dev/image/upload/s--Q98Q0_9X--/f_auto,q_auto/v1774960848/logos/webtechie?_a=BAMAMiWQ0","url":"https://daily.dev/sources/webtechie"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/foojay-podcast-104-53-cves-and-two-emergency-releases-why-java-security-holds-up-dfifl3nde","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,java","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"WebTechie","item":"https://daily.dev/sources/webtechie"},{"@type":"ListItem","position":3,"name":"Foojay Podcast #104: 53 CVEs and Two Emergency Releases: Why Java Security Holds Up"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/foojay-podcast-104-53-cves-and-two-emergency-releases-why-java-security-holds-up-dfifl3nde#faq","mainEntity":[{"@type":"Question","name":"Why did OpenJDK release two out-of-cycle updates after the October 2026 quarterly patch?","acceptedAnswer":{"@type":"Answer","text":"The out-of-cycle releases were triggered by an eMudhra certificate problem, which required backporting fixes across every supported Java version. This followed the October OpenJDK quarterly update, which fixed a record 53 CVEs, a sharp jump from the average of 7.6 CVE fixes per quarter. Teams tracking Java patch cycles can follow emergency OpenJDK releases like this on daily.dev."}},{"@type":"Question","name":"What do CPU, PSU and CSPU mean for Java updates?","acceptedAnswer":{"@type":"Answer","text":"These terms describe the type of OpenJDK release: CPU (Critical Patch Update), PSU (Patch Set Update), and CSPU (Critical and Security Patch Update), distinguishing free security-only builds from paid builds with broader patch sets. Simon Ritter, Deputy CTO at Azul, explains the distinction between free and paid OpenJDK builds in relation to these release types. Developers weighing free versus paid OpenJDK builds can keep up with release terminology like this on daily.dev."}},{"@type":"Question","name":"Why did the number of Java CVE fixes jump so dramatically in one quarter?","acceptedAnswer":{"@type":"Answer","text":"The number of fixes jumped from an average of 7.6 per quarter to 53 in the October 2026 OpenJDK update, partly because AI is changing how vulnerabilities get discovered, according to Simon Ritter, Deputy CTO at Azul and member of the OpenJDK Vulnerability Group. Anyone patching Java on a schedule can track shifts like this CVE surge on daily.dev."}}]} ```