Oracle starts monthly Java patches with CSPU

Java has long followed a predictable rhythm: new versions in March and September, and quarterly Critical Patch Updates in January, April, July and October. Oracle is now layering a faster track on top of that. In July it announced CSPU, a new monthly security patch stream, and the first CSPU was released in August 2026.

Oracle frames the change around AI. In its account, vulnerabilities are now discovered at a faster pace than before, and AI assistance also lets the company prepare fixes quickly. CSPU exists to deliver fixes for important security problems on a monthly cadence.

The two tracks serve different purposes. CSPU handles high-priority issues sooner, while the quarterly CPU remains and bundles all CSPU security patches. Users can apply CSPU right away or wait for the quarterly CPU, judging by how severe and what the fixed vulnerabilities are.

The practical consequence sits with companies, which must now make patch-apply decisions more often, and may need to reconsider their Java version and patching plans. Whether the monthly rhythm actually reduces exposure is likely to hinge on how many organisations choose immediate CSPU patching over waiting for the quarterly bundle.