When did the first monthly Java security patch come out?

The first CSPU was released in August 2026, after Oracle announced the new monthly patch program in July.

Do I still have the option of quarterly Java patches?

Yes. The quarterly CPU is still provided and includes all the security fixes from the monthly patches, so users can choose to wait for it based on severity.

Why did Oracle change the Java patch schedule?

Oracle said AI has sped up the discovery of vulnerabilities and also helps fix them more quickly, so it aligned the schedule with this new reality.

AI Coding AssistantsAI Regulation & PolicyPublickeySep 15, 2026Sep 16, 2026, 01:00 JST

Oracle moves Java patches to monthly CSPU cycle

Send on LINE

3 Key Points

What happened
Oracle said it is moving Java security patches from a quarterly cycle to a monthly one, and that the first patch shipped in August 2026.
Why it matters
Java users can now fix high-priority flaws without waiting three months, though they may have to decide on patches more often.
What to watch
Whether companies revise their Java version and patch plans, since monthly releases mean more frequent judgment calls on severity.

WHO IT HITSEnterprise IT teams running Java applications now face more frequent patch-application decisions, and may need to revisit their existing version-upgrade and patching plans.

Not sure about something? Ask the AI

Questions and answers are published on this page.

Summaries like this, every morning.

Get these free every morning

Context & Analysis

Java has long followed a predictable rhythm: new versions in March and September, and quarterly Critical Patch Updates in January, April, July, and October. Oracle introduced the monthly CSPU in July, saying AI has made vulnerability discovery faster and repair work quicker with AI assistance. The August 2026 release was the first monthly patch to actually ship.

The quarterly CPU still exists and includes every security fix from the monthly releases. That leaves users with a choice: apply the monthly patches right away, or wait for the quarterly bundle depending on how severe and relevant each fix is.

The practical burden shifts to the people who manage Java in production. Monthly releases could mean flaws get fixed earlier, but they also mean patching decisions land more often. Whether this reduces risk overall may hinge on how quickly enterprises can absorb the extra review work.

FAQ

When did the first monthly Java security patch come out?: The first CSPU was released in August 2026, after Oracle announced the new monthly patch program in July.
Do I still have the option of quarterly Java patches?: Yes. The quarterly CPU is still provided and includes all the security fixes from the monthly patches, so users can choose to wait for it based on severity.
Why did Oracle change the Java patch schedule?: Oracle said AI has sped up the discovery of vulnerabilities and also helps fix them more quickly, so it aligned the schedule with this new reality.

PublickeyRead Original Article

Send on LINE

AI news that matters for your work, delivered every morning.

Pick your industry and the AI tools you use, and get news related to your work every day.

Get it free

Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →

Ask AI

Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.