--- title: New Between-Quarters Security Updates for Java: What... description: Oracle is introducing Critical Security Patch Updates (CSPUs) for Java, delivering security fixes between the existing quarterly CPU releases. The first Java... canonical: https://daily.dev/posts/new-between-quarters-security-updates-for-java-what-cspus-mean-for-your-release-pipeline-aypbgr6ha twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New Between-Quarters Security Updates for Java: What CSPUs Mean for Your Release Pipeline | daily.dev og:description: Oracle is introducing Critical Security Patch Updates (CSPUs) for Java, delivering security fixes between the existing quarterly CPU releases. The first Java... og:url: https://daily.dev/posts/new-between-quarters-security-updates-for-java-what-cspus-mean-for-your-release-pipeline-aypbgr6ha og:image: https://api.daily.dev/og/posts/aypBGr6hA.png og:image:alt: New Between-Quarters Security Updates for Java: What CSPUs Mean for Your Release Pipeline og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Between-Quarters Security Updates for Java: What CSPUs Mean for Your Release Pipeline **[Foojay.io](https://daily.dev/sources/foojayio)** · 5 min read · 1 upvotes · 0 comments ## Summary Oracle is introducing Critical Security Patch Updates (CSPUs) for Java, delivering security fixes between the existing quarterly CPU releases. The first Java CSPU ships August 18, 2026 as JDK 26.0.2.1. CSPUs carry only security and stability fixes — no new features or API changes — and follow the same versioning convention as quarterly updates. The change is driven by AI accelerating vulnerability exploitation timelines, making the 90-day quarterly window too long. Teams need to update patch-monitoring to a monthly cadence, ensure their CI/CD pipelines can handle irregular security releases, and check how their JDK vendor plans to handle CSPUs. Azul has already confirmed support for monthly CSPU delivery. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Azul August 2026 Release: Java’s First Monthly CSPU](https://daily.dev/posts/azul-august-2026-release-java-s-first-monthly-cspu-mqtul4k9h) · Foojay.io · 1 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#oracle](https://daily.dev/tags/oracle) [View this post on daily.dev](https://daily.dev/posts/new-between-quarters-security-updates-for-java-what-cspus-mean-for-your-release-pipeline-aypbgr6ha) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New Between-Quarters Security Updates for Java: What CSPUs Mean for Your Release Pipeline","url":"https://daily.dev/posts/new-between-quarters-security-updates-for-java-what-cspus-mean-for-your-release-pipeline-aypbgr6ha","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-between-quarters-security-updates-for-java-what-cspus-mean-for-your-release-pipeline-aypbgr6ha"},"datePublished":"2026-07-27T07:36:43.940Z","dateModified":"2026-07-31T14:24:25.598Z","description":"Oracle is introducing Critical Security Patch Updates (CSPUs) for Java, delivering security fixes between the existing quarterly CPU releases. The first Java...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c30945cfd04f5f167177d3c0f5294fc2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c30945cfd04f5f167177d3c0f5294fc2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Foojay.io","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Foojay.io","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1820f6a6ae944760aa322b67ed85f848","url":"https://daily.dev/sources/foojayio"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-between-quarters-security-updates-for-java-what-cspus-mean-for-your-release-pipeline-aypbgr6ha","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"java,oracle","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Foojay.io","item":"https://daily.dev/sources/foojayio"},{"@type":"ListItem","position":3,"name":"New Between-Quarters Security Updates for Java: What CSPUs Mean for Your Release Pipeline"}]} ```