Update: Oct 21, 2026: Within hours of the release of that update, Oracle has released a critical security point-release update. The new downloads (if you obtain them from that point forward) now add a .0.2 suffix to all the numbers below, such as 21.0.13.0.2, 17.0.21.0.2 and so on. For more on the vuln that triggered that, which has a 9.1 cvss score (and is "remotely exploitable without authentication"), see the Oracle critical alert advisory notice on the matter.

Update: Oct 24, 2026: Just a couple of days later, Oracle has released yet another a point-release update--related very much to that previous one, this time removing the set of impacted root CA certificates related to eMudhra. The new downloads (if you obtain them from Oracle that date forward) now add a .0.3 suffix to all the numbers below, such as 21.0.13.0.3, 17.0.21.0.3 and so on. For more on that, which again has a 9.1 cvss score ("remotely exploitable without authentication"), see the Oracle critical alert advisory notice on the matter, and you can see this and the last one in a list of all such jvm security updates. And for more from Oracle on the eMudhra certs--including options to remediate manually instead of getting this .0.3 update, see this notice.

Now back to the rest of the post, which otherwise still stands.

TLDR: The new updates are 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, and 1.8.0_511 (aka 8u511) respectively. From a compatibility perspective, the update seems a pretty modest one, without seeming breaking changes (though my opinion is based solely on my read of the update release notes, on this first day).

More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains.

[....Continue Reading....]

But unlike recent updates, the update technotes for this one show a LOT of changes that you should be aware of before "just getting the update in place".

[....Continue Reading....]