Technical Account Manager

53 OpenJDK vulnerabilities disclosed today set an all-time high; Azul patches them all. Quick Summary Azul's Security-only, Stability-first(TM) updates can be deployed immediately to counter the speed of agentic AI threats INDIA- October 21, 2026 - Azul, the trusted leader in enterprise Java for today's AI-first world, today released its October Security-only, Stability-first(TM) updates for... Azul's Security-only, Stability-first(TM) updates can be deployed immediately to counter the speed of agentic AI threats INDIA- October 21, 2026 - Azul, the trusted leader in enterprise Java for today's AI-first world, today released its October Security-only, Stability-first(TM) updates for Azul Core that are immediately deployable to address all 53 vulnerabilities disclosed in the latest OpenJDK quarterly update. Azul's Security-only, Stability-first updates contain security fixes and nothing else: no new features, enhancements or unrelated changes that can cause problems. The number of vulnerabilities disclosed in this quarter's OpenJDK release is the most in a single update in well over a decade and 7x greater than the two-year average of 7.6 Common Vulnerabilities and Exposures (CVEs) per quarter. OpenJDK quarterly updates that include the fixes to these CVEs also include more than 150 code changes unrelated to security. Azul is the only vendor to offer both monthly and quarterly updates scoped to just security fixes. Enterprises can deploy Azul's Security-only, Stability-first updates to production immediately and safely to remediate critical vulnerabilities. Other OpenJDK distributions bundle non-security bug fixes, enhancements and even features in their updates, often causing regressions. While such regressions may get fixed with follow-on updates, they can significantly delay the deployment of urgent security fixes. AI Is Exposing Flaws and Enabling Exploits Faster than Ever CSO recently reported that researchers using an AI tool found a 13-year-old remote code execution flaw in Apache ActiveMQ in about 10 minutes. Two weeks after disclosure, nearly 6,500 internet-facing instances were still unpatched. In a case documented by GreyNoise, a suspected attacker used hundreds of AI agents to chain two zero-day flaws in PaperCut NG/MF, going from an empty workspace to remote code execution in under four hours. The agents ultimately reached at least 440 instances across 395 organizations in 48 countries, with full domain administrator control in seven minutes. Java has been running mission-critical systems for more than 30 years, making it one of the most battle-tested platforms in enterprise computing. But AI is now exposing flaws that survived years of testing and review. Researchers are using it to uncover vulnerabilities in decades-old code, while threat actors use agentic AI to find and exploit them at a speed and scale never seen before. Because the vast majority of enterprises rely on Java for production applications and infrastructure, the impact will be felt in every industry and region. And the risk is immediate, for three reasons: The skill barrier is falling. AI lets less-skilled attackers do work that once required experts. Attackers are outpacing defenders. Mean time to exploit (MTTE) has shrunk to -7 days, meaning exploitation often begins before a patch is available, while the median enterprise patch cycle is 43 days. It is no longer safe to delay addressing low-severity CVEs. AI can chain even low-severity CVEs into effective and significant attacks, multiplying the number of exploitable paths. Enterprises' Patch Deployment Cycles Have Not Kept Pace With AI-Speed Attackers In the past, it may have been acceptable to wait weeks or months for stable, regression-free security updates before addressing known vulnerabilities - that timeline no longer works. Attackers are moving faster. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) maintain a Known Exploited Vulnerabilities (KEV) catalog that lists flaws confirmed to be under active attack. According to Azul's analysis of that catalog, 61% of vulnerabilities published in 2025 that were later exploited were added within 30 days of public disclosure. The true share is likely higher: the figure excludes the roughly one in four exploited vulnerabilities already listed on or before disclosure day, and CISA typically lists a flaw only after exploitation has begun. For most exploited vulnerabilities, the window between disclosure and attack is now measured in days, not weeks or months. Security-Only, Stability-First Updates Ready for Immediate Deployment Azul is the only vendor to offer Security-only, Stability-first quarterly, monthly and out-of-cycle OpenJDK updates, which contain only security fixes, with no new features or unrelated bug fixes. These are built on the previous quarter's stabilized full patch update, which Azul and the broader Java community have already tested extensively. With changes limited to security fixes only, the potential surface for regression is dramatically reduced. Since 2020, more than 20% of OpenJDK quarterly updates included regressions that prevented their timely rollouts. During that same time, no security-only updates from Azul have had deployment-preventing regressions, and Azul customers were able to deploy straight to production in rapid manner. In addition, Azul delivers monthly, Stability-first Critical Security Patch Updates (CSPUs) layered on the existing security-only quarterly update, a capability no other Java vendor or OpenJDK distribution offers. Prior OpenJDK quarterly updates have included regressions as serious as breaking application access to all Google APIs, corrupting Tomcat HTTP content and breaking Hadoop deployments. Enterprises that relied on other OpenJDK distributions had to choose between customer impact and security. In contrast, Azul customers that deployed the Azul Core security-only update did not have to choose and were able to deploy immediately, safely and securely. Azul Core is a Java SE-compliant build of OpenJDK that is certified with the Technology Compatibility Kit (TCK). Azul Core is a drop-in replacement for Oracle Java and other Java SE-compliant distributions. Azul Core subscribers get monthly and quarterly security-only updates, quarterly full updates and out-of-cycle fixes as needed for every LTS release (8, 11, 17, 21, 25) Many enterprises also still run Java 6 and 7, an exposure in the age of AI-driven attacks. Azul is the only vendor that provides backported security fixes for these versions, extending the same monthly security cadence to organizations still running older Java in production. Azul Partners Can Help Customers Close the Exposure Window Azul's resellers and security services delivery partners are able to help their customers manage and remediate the quickly growing number of threats by taking the October update to security-conscious customers now. Resale and services for the Security-only, Stability-first updates are included in current Azul Core channel pricing. Closing the Gap Between Disclosure and Deployment "The record number of vulnerabilities in one OpenJDK update is a very real warning to all enterprises running their business-critical workloads on Java. AI has collapsed the time between disclosure and exploitation from weeks to days to hours, and attackers are chaining flaws that defenders used to rank as low priority," said Scott Sellers, co-founder and CEO of Azul. "Enterprises shouldn't have to choose between security and stability. Azul's Security-only, Stability-first updates are able to be deployed immediately, so customers can close the exposure window before an attacker finds it first." Enterprises running Oracle Java, other OpenJDK builds or free Azul Zulu builds in production, or that want to shorten the time it takes to remediate the 53 vulnerabilities disclosed in today's quarterly update, can get patched with Azul today. Itn. We Live in a T-Shaped World- Broad knowledge across ecosystems is essential, but it's the deep expertise of Subject Matter Experts (SMEs) that helps organizations leap forward. At IndiaTechnologyNews, we go beyond news, views, and analysis - we showcase SMEs, translating their insights for wider audiences. Write to: [email protected]

Azul appoints Matt Camassa as Chief Revenue Officer. SINGAPORE, October 8, 2026: Enterprise Java company Azul has appointed Matt Camassa as Chief Revenue Officer, putting him in charge of the company's global revenue organisation as it looks to expand adoption of its AI-first Java platform across enterprise customers. Camassa will oversee sales, solution engineering, partners, customer success and operations worldwide, with a mandate to accelerate enterprise growth and broaden Azul's routes to market across North America, EMEA, APAC and Latin America. The appointment comes as enterprises face increasing pressure to improve performance, security and cost efficiency across Java environments, particularly as AI workloads place additional demands on existing technology estates. Camassa brings more than 20 years of experience building and scaling global enterprise software sales organisations. He previously served as CRO at TeleSign, where he helped scale the business through a period of rapid growth before its acquisition by BICS in 2017. He later led worldwide sales at fraud-prevention company Sift, where Azul said he oversaw a multi-year growth phase with strong net revenue retention. Most recently, Camassa was an operating partner at Diversis Capital, having earlier served as an executive in residence at K1 Investment Management. In those roles, he worked on go-to-market strategy, advised portfolio companies and held several interim CRO positions. As CRO, Camassa will lead the teams responsible for commercialising Azul's portfolio, which includes Azul Prime, Azul Core, Azul Intelligence Cloud, Azul Payara Micro and Azul Payara Server. Camassa said enterprises are increasingly looking for platforms that can address pressing operational challenges as AI places greater pressure on underlying systems. "Azul is in a unique position, providing a complete platform that makes Java faster, more secure and less expensive to run," he said. Azul Co-Founder and CEO Scott Sellers said Camassa's experience in building global revenue organisations and selling mission-critical software to large enterprises made him well suited to the role. "Azul has grown from a Java runtime leader into a full AI-first Java platform, and Matt brings an exceptionally strong track record of success to our executive team," Sellers said. Camassa's appointment adds a senior commercial leader to Azul's executive team at a time when enterprise infrastructure vendors are repositioning around the operational demands created by AI adoption.