Java news roundup: Hardwood 1.0, Endive 1.0, Azul Payara, Quarkus, WildFly, LangChain4j, OSSI. * Michael Redlich Java Champion | Java Queue Lead Editor | Director at GSJUG Follow OmniFaces on. This week's Java roundup for June 22nd, 2026, features news highlighting: the GA releases of Hardwood 1.0 and Endive 1.0; the June 2026 edition of Azul Payara; point releases of Quarkus, LangChain4j; the first beta release of WildFly 41; and introducing Eliya JDK and the Open Source Sustainability Initiative (OSSI), the latter of which was founded by HeroDevs and Commonhaus Foundation. JDK 27. Build 28 of the JDK 27 early-access builds was made available this past week featuring updates from Build 27 that include fixes for various issues. Further details on this release may be found in the release notes. JDK 28. Build 4 of the JDK 28 early-access builds was also made available this past week featuring updates from Build 3 that include fixes for various issues. More details on this release may be found in the release notes. Azul Payara. The Azul Payara team has released the June 2026 edition of Azul Payara 7.1.0 that includes Community Edition 7.2026.6, Enterprise Edition 6.39.0 and Enterprise Edition 5.88.0. Along with bug fixes and component upgrades, all three editions deliver: a resolution to a Cross-Site Request Forgery (CSRF) and Server-Side Request Forgery (SSRF) issue in the Admin Console and REST management interface due to unnecessary passing the REST URL in a servlet request that can otherwise be obtained via session information; and support for overriding methods using the Spring Framework @Transactional annotation on Jakarta Data repository interfaces. Further details on these releases may be found in the release notes for Community Edition 7.2026.6, Enterprise Edition 6.39.0 and Enterprise Edition 5.88.0. Quarkus. The release of Quarkus 3.37.0 delivers bug fixes and notable changes such as: support for Hibernate ORM 7.4.0.Final, Hibernate Reactive 3.4.0.Final and Hibernate Search 8.4.0.Final; a new experimental extension, JLink, that generates a custom runtime image with jlink that includes only the necessary JDK modules in an application; and enabling reflection-free Jackson serializers by default. More details on this release may be found in the release notes. WildFly. The first beta release of WildFly 41 ships with bug fixes, dependency upgrades and new features such as: support for handling data in the WildFly Transactions Subsystem during a graceful shutdown; and the ability to enable authentication requests to be signed and optionally encrypted via the request and request_uri parameters within the WildFly Elytron Subsystem. Further details on this release may be found in the release notes. LangChain4j. The formal release (along with the twenty-seventh beta release) of LangChain4j 1.17.0 provides bug fixes, dependency upgrades and new features such as: a new DebatePlanner class to support the Debate agentic pattern; a new OracleChatMemoryStore class that adds an Oracle database for chat memory; and a new onUnmappedRawEvent streaming callback that allows for exposing raw streaming events that are not mapped by LangChain4j. More details on this release may be found in the release notes. Eliya JDK. Asymm Systems has introduced Eliya JDK, their downstream distribution of OpenJDK that tracks the quarterly OpenJDK 25 Critical Patch Updates (CPUs) and delivers builds for Linux x86_64 and Linux aarch64. This initial release, version 25.0.3, is based on the Oracle Critical Patch Update Advisory for April 2026. Further details on this release may be found in the release notes and this InfoQ news story. Hardwood. The release of Hardwood 1.0.0, a parser dedicated to the Apache Parquet file format, ships with notable changes such as: the close method, one for both the ColumnReader class and the RowReader interface, are now idempotent to resolve a performance regression; an instance of the AvroRowReader class now honors column projections such that the DECIMAL, UUID, UINT_32, and FIXED columns are correctly read; and the entry point for the Hardwood class now accepts an implementation of the HardwoodContext interface for control over decoder thread-pool sizing and the ability to share a context across readers. More details on this release may be found in the release notes and InfoQ will follow up with a more detailed news story. Endive. The release of Endive 1.0.0 delivers; WasmGC host integration with support for the externref value type as a Java Object such that host functions work naturally with GC types; and an optimization of tail call correctness by eliminating unnecessary stack frame allocation that benefits languages, such as CPython, that adopt tail calls in their interpreter loop. Edive, a new JVM-native WebAssembly (Wasm) runtime, has its roots from Chicory, created in September 2023 by Benjamin Eckel, chief technical officer at Dylibso, and Andrea Peruffo, principal software engineer at IBM. Open Source Sustainability Initiative. HeroDevs, the platform that identifies, remediates and prevents end-of-life open source risk, announced that they have joined the Commonhaus Foundation as the founding member of the Open Source Sustainability Initiative (OSSI) to "support sustainable open source ecosystems through improved lifecycle transparency and collaboration between maintainers, foundations, ecosystem partners, and the broader open source community." HeroDevs has already partnered with the Hibernate, Jackson, and Quarkus communities to support enterprises that need assistance in CVE remediation. HeroDevs also plans to partner with other projects under the auspices of the Commonhaus Foundation. Michael Redlich. Michael Redlich has been an active member within the Java community for the past 25 years. He founded the Garden State Java User Group (formerly the ACGNJ Java Users Group) in 2001 that remains in continuous operation. Since 2016, Mike has served as a Java community news editor for InfoQ where his contributions include monthly news items, technical writing and technical reviews. He has presented at venues such as Oracle Code One, Emerging Technologies for the Enterprise, Trenton Computer Festival (TCF), TCF IT Professional Conference, and numerous Java User Groups. Mike serves as a committer on the Jakarta NoSQL and Jakarta Data specifications and participates on the leadership council of the Jakarta EE Ambassadors. He was named a Java Champion in April 2023. With 33-1/2 years service, Mike recently retired from ExxonMobil Technology & Engineering in Clinton, New Jersey with experience in developing custom scientific laboratory and web applications. He also has experience as a Technical Support Engineer at Ai-Logix, Inc. (now AudioCodes) where he provided technical support and developed telephony applications for customers.

Azul ships JVM scanner to find unpatched Java before attackers do. Key takeaways. * Azul launches Mythos to discover and inventory JVMs across enterprise environments * 35+ billion JVMs run globally, many unpatched and invisible to security teams * AI-powered vulnerability scanning makes outdated Java runtimes easier targets Azul Systems is betting that most enterprises cannot answer a simple question: how many Java Virtual Machines are running in your environment right now? The company's new security product, Mythos, scans networks to find JVMs, catalog their versions, and flag those running without critical patches. The pitch is straightforward. If you cannot find your Java runtimes, neither can your security team. But attackers, increasingly armed with AI-assisted scanning tools, can. The timing matters. Log4Shell, the critical vulnerability disclosed in December 2021, affected 93% of enterprise cloud environments according to cloud security researchers. That crisis forced organizations to realize they had no inventory of where Java ran, which versions existed, or who owned them. Two years later, the visibility problem persists. Why JVM visibility remains a blind spot. Azul estimates 35 billion JVM instances run globally. That number sounds inflated until you consider how Java actually deploys. A single application server might spawn dozens of JVM processes. Containers multiply the count. Microservices architectures spin up instances dynamically. The JVM is everywhere, and everywhere invisible. Traditional asset management tools track servers and containers. They do not track what runs inside them. A security scanner might find an open port or a known CVE in a package manifest. It will not tell you that a JVM running your payments service is three minor versions behind and missing a critical deserialization fix. Scott Sellers, Azul's CEO, has been blunt about the gap: "Most organizations have no idea how many JVMs they're running, let alone which versions or patch levels. It's a massive blind spot." Mythos aims to close it by discovering JVMs across an environment, fingerprinting their exact versions, and correlating that data against known vulnerabilities. What Mythos actually does. The product works as an agent-based scanner. Deploy it across your infrastructure, and it inventories every JVM instance it finds. For each one, Mythos reports the vendor (Oracle, Azul, Amazon Corretto, Eclipse Adoptium, and others), the exact version string, and the patch level. It then maps those findings against Azul's vulnerability database. The output is a prioritized list. Which JVMs are critically vulnerable? Which are merely outdated? Which belong to production workloads versus development environments? That context matters for triage. Patching a staging server running Java 11.0.15 is different from patching the same version on a customer-facing application. Azul has an obvious commercial interest here. The company sells Zulu, its own JDK distribution, along with support contracts and the Azul Platform Prime runtime optimized for low-latency workloads. Mythos feeds that pipeline. Find the unpatched JVMs, then sell the customer a supported, automatically patched replacement. The AI angle is real, not hype. Azul's marketing leans into AI-powered threats, and the concern is legitimate. Large language models and AI agents can accelerate reconnaissance. Feed a model a list of IP addresses and ask it to identify which ones run vulnerable Java versions. Combine that with automated exploit generation, and the window between vulnerability disclosure and active exploitation shrinks. Recent demonstrations support this. Anthropic's Claude model found flaws in classified U.S. government systems during a red team exercise, completing in hours what human analysts might take days to discover. The same acceleration applies to mundane vulnerability scanning. Attackers do not need sophisticated AI to probe for outdated JVMs. But AI makes it faster, cheaper, and harder to outrun. Competitive landscape for Java security. Azul is not alone in this market. Snyk, Veracode, and Contrast Security all offer application security tools that cover Java. Container security vendors like Aqua Security and Sysdig scan images for vulnerable packages, including JDK components. Traditional vulnerability scanners from Tenable and Qualys can detect outdated Java installations. Mythos differentiates on specificity. General-purpose scanners treat the JVM as one component among thousands. Azul treats it as the primary runtime layer that deserves dedicated tooling. Whether that depth justifies a separate product depends on how heavily your stack relies on Java. For shops running 60% or more of their workloads on JVM platforms, which describes much of financial services, healthcare, and large enterprise IT, the focus may be worth it. What this means for engineering teams. The broader lesson is not about Azul specifically. It is about runtime visibility as a security requirement. Container registries track image versions. Package managers track dependencies. But the runtime itself, the JVM or Node.js or Python interpreter executing your code, often escapes inventory. Log4Shell taught that lesson painfully. Organizations spent weeks hunting for vulnerable Log4j instances because they did not know where Java ran. Two years later, how many have built systematic visibility into their runtime layer? For most, the answer is still not enough. Logicity's take. Azul's Mythos solves a real problem, but it is also a lead generation engine for Zulu subscriptions. Engineering leaders should evaluate it against their existing tooling. If you run Snyk or a container security platform, check whether those tools already report JVM versions with sufficient granularity. If not, dedicated JVM scanning fills a gap. Pricing is not public, but expect enterprise licensing tied to the number of hosts or JVMs scanned. For teams on Amazon Corretto or Eclipse Temurin looking to avoid vendor lock-in, consider that Mythos discovery works regardless of which JDK you deploy, so the vendor lock-in risk is lower than it might appear. Frequently asked questions. How many JVMs are running globally? Azul estimates more than 35 billion active JVM instances worldwide, counting individual processes across servers, containers, and cloud workloads. Why is JVM visibility a security problem? Traditional asset management tracks servers and containers but not the runtimes inside them. An outdated JVM with known vulnerabilities can run undetected for years. What does Azul Mythos do? Mythos scans enterprise environments to discover JVM instances, identify their exact versions and vendors, and flag those with known vulnerabilities or missing patches. How does AI increase the risk to unpatched JVMs? AI-powered tools can scan networks and identify vulnerable software faster than manual methods, shrinking the window between vulnerability disclosure and exploitation. Does Mythos only work with Azul's JDK? No. Mythos discovers and inventories JVMs from any vendor, including Oracle, Amazon Corretto, Eclipse Adoptium, and others. Need help implementing this? If your team needs guidance on JVM security, runtime visibility, or evaluating tools like Azul Mythos against your existing stack, reach out to Logicity's consulting partners for a security architecture review. Manaal Khan Tech & Innovation Writer Produced with AI assistance and reviewed by the Logicity editorial team. Learn more in its Editorial Policy.

EWE AG cuts Java licensing costs by 60% after migrating from Oracle to Azul Core. German energy leader standardizes Java environment across 100+ applications and tens of thousands of desktops, eliminating Oracle licensing burden SUNNYVALE, Calif.-(BUSINESS WIRE)-Azul, the trusted leader in enterprise Java for today's AI and cloud-first world, today announced that EWE AG, one of Germany's leading energy and infrastructure companies, has cut its Java licensing costs by 60% by migrating from Oracle Java to Azul Core - standardizing its fragmented Java environment across more than 100 applications and tens of thousands of desktop endpoints in the process. "Azul's support was fast, structured, highly competent and very uncomplicated. There was no problem that wasn't immediately addressed." Share EWE AG provides critical infrastructure and energy services to more than two million customers. Java is deeply embedded across its operational and end-user systems, many of which support essential daily processes and cannot be easily replaced. Ensuring stability and consistency across this environment is central to business continuity. Over time, however, EWE's Java landscape became increasingly fragmented, with multiple versions and distributions in use across the organization. Legacy systems, including some still dependent on Java 6, which Oracle stopped supporting in December 2018, added further complexity. This environment created additional overhead for packaging, deployment, support and governance, while new Java instances continued to be introduced through incoming applications, increasing the need for standardization. In addition, EWE, as an operator of critical energy infrastructure serving more than 2 million customers, is subject to the German BSI Act (BSIG) and its KRITIS framework, which requires operators of critical infrastructure to implement and demonstrate appropriate technical and organizational measures to ensure the security and availability of their IT systems. The situation was further impacted when Oracle changed its Java licensing model in January 2023. What had previously been a manageable cost structure quickly became a significant budget concern. "When Oracle Java changed the licensing metric, we realized it would become far more expensive for us," said Sacha Massarra, license manager at EWE AG. "That was the moment we decided to move to an alternative." Evaluating options in a highly fragmented environment As EWE assessed its options, it weighed the trade-offs between unsupported OpenJDK distributions and commercially supported platforms. While free OpenJDK variants were available, EWE determined they would introduce substantial internal operational burden, particularly around patch management, version control and support escalation across a highly distributed environment. Given the scale and criticality of its systems, the organization required a stable, enterprise-supported Java platform. "In a corporate environment, switching to a Java platform without support is not really an option," said Massarra. EWE selected Azul Core based on its enterprise support model, compatibility across legacy and modern Java environments, and ability to support older versions such as Java 6. The company also cited faster vendor responsiveness and a clearer path toward enterprise-wide standardization. Phased migration enables controlled rollout across the enterprise EWE implemented a phased migration approach, beginning with small rollout waves of approximately 50 to 200 devices. This allowed teams to validate application behavior early and identify issues before broader deployment. As confidence increased, larger migration waves followed until the rollout was completed across the organization in approximately eight to nine months. "If you reduce twenty different Java packages down to one, the internal support effort drops significantly," said Gerold Frilling, license manager at EWE AG. "Azul's support was fast, structured, highly competent and very uncomplicated. There was no problem that wasn't immediately addressed." Results: simplified operations, standardized environment, and reduced cost For EWE AG, the migration delivered both operational and financial outcomes, simplifying its Java estate while reducing cost and complexity across IT operations. Key results include: * Standardized Java environment across the enterprise, consolidating multiple distributions into a single supported standard across more than 100 applications and tens of thousands of endpoints, reducing complexity for IT operations, packaging, and support teams. * 60% reduction in Java licensing costs, compared with the projected multi-million-euro cost of remaining on Oracle Java, achieved under a five-year agreement. * Low-risk, phased migration across the organization, with even the most complex application migrations completed in approximately four hours. * Improved operational efficiency and support experience, with EWE citing Azul's responsiveness, technical competence and ease of collaboration throughout the migration process. * Reduced environmental and compute overhead, supporting EWE's broader sustainability objectives as an energy provider focused on efficiency and resource optimization. "Nobody needs Oracle Java anymore. If you need support, the clear answer is: switch to Azul," said Massarra. "EWE AG's transformation demonstrates the operational impact of Java fragmentation at enterprise scale," said James Johnston, vice president of EMEA at Azul. "By consolidating a highly distributed Java estate under a single supported platform, they significantly reduced complexity across critical systems while also lowering costs and improving operational control. This type of standardization is becoming increasingly important as enterprise Java environments grow more diverse and distributed." How much can enterprises save by migrating from Oracle Java to Azul Core? Savings vary based on environment size and complexity. In EWE AG's case, Java licensing costs were reduced by 96% after migrating from Oracle Java to Azul Core. The company standardized more than 100 applications across tens of thousands of endpoints, replacing a projected multi-million-euro Oracle cost structure with a predictable five-year agreement. Can large enterprises migrate from Oracle Java without disrupting operations? Yes. EWE AG completed its migration in approximately eight to nine months using a phased rollout approach. Initial waves of 50 to 200 devices enabled early validation before scaling across the enterprise. Even complex applications were migrated in approximately four hours. Why choose a commercially supported OpenJDK distribution over a free alternative? Free OpenJDK distributions typically lack enterprise support, structured patching and service-level guarantees. EWE AG evaluated these options but determined that managing updates and support internally across a fragmented environment - including legacy Java 6 systems - would create significant operational overhead. Azul Core provides enterprise-grade support and compatibility across both legacy and modern workloads. About Azul Azul is the trusted leader in enterprise Java for today's AI and cloud-first world. Its open source-based Java platform empowers organizations to optimize the entire Java lifecycle to accelerate performance, strengthen security, reduce licensing and cloud costs, and boost developer productivity. Azul powers mission-critical systems for 36% of the Fortune 100, 50% of the Forbes Top 10 World's Most Valuable Brands, and the world's top 10 financial trading companies. Learn more at azul.com and follow @azulsystems. More News From Azul SUNNYVALE, Calif.-( BUSINESS WIRE )-Azul, the trusted leader in enterprise Java for today's AI and cloud-first world, today launched a free JVM vulnerability risk assessment to address the blind spot that autonomous AI exploitation tools are increasingly able to find. With mean time to exploit (MTTE) collapsing from months to days or hours, the unmanaged Java estate has become an urgent enterprise security vulnerability. Azul's assessment gives DevOps and SecOps teams complete visibility into t... SUNNYVALE, Calif.-( BUSINESS WIRE )-Azul, the trusted leader in enterprise Java for today's AI and cloud-first world, today released The High-Performance Java Platform Benchmark Report, showing that Azul Prime on JDK 25 (26.02) runs 21.8% faster than OpenJDK 25.0.1 and 38.8% faster than the OpenJDK 11.0.30 baseline. Azul's Java Performance Engineering Lab tested code speed across OpenJDK distributions and Azul Prime versions. Every Azul Prime build, including older JDK 17 and 21 builds, outperf... SUNNYVALE, Calif.-( BUSINESS WIRE )-Azul, the trusted leader in enterprise Java for today's AI and cloud-first world, today announced the general availability of Azul Payara Server 7 and Azul Payara Micro 7 with Final TCK certification across all three Jakarta EE 11 profiles - i.e., Full Platform, Web Profile and Core Profile. This release marks the largest in Payara's history and a milestone in Azul's mission to deliver a unified enterprise Java platform - one vendor for the JDK, application s... Azul. Release Versions