Update: Oct 21, 2026: Within hours of the release of that update, Oracle has released a critical security point-release update. The new downloads (if you obtain them from that point forward) now add a .0.2 suffix to all the numbers below, such as 21.0.13.0.2, 17.0.21.0.2 and so on. For more on the vuln that triggered that, which has a 9.1 cvss score (and is "remotely exploitable without authentication"), see the Oracle critical alert advisory notice on the matter.

Update: Oct 24, 2026: Just a couple of days later, Oracle has released yet another a point-release update--related very much to that previous one, this time removing the set of impacted root CA certificates related to eMudhra. The new downloads (if you obtain them from Oracle that date forward) now add a .0.3 suffix to all the numbers below, such as 21.0.13.0.3, 17.0.21.0.3 and so on. For more on that, which again has a 9.1 cvss score ("remotely exploitable without authentication"), see the Oracle critical alert advisory notice on the matter, and you can see this and the last one in a list of all such jvm security updates. And for more from Oracle on the eMudhra certs--including options to remediate manually instead of getting this .0.3 update, see this notice.

TLDR: The new updates are 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, and 1.8.0_511 (aka 8u511) respectively. From a compatibility perspective, the update seems a pretty modest one, without seeming breaking changes (though my opinion is based solely on my read of the update release notes, on this first day).

More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains.

[....Continue Reading....]

Update: The October 2026 CF update has fixed this bug. See my post on that update. The info below may still be of interest to some readers, and certainly for any who may not yet be applying that update or beyond.

[....Continue Reading....]

TLDR: The new updates are 26.0.2, 25.0.4, 21.0.12, 17.0.20, 11.0.32, and 1.8.0_501 (aka 8u501) respectively. From a compatibility perspective, the update seems a pretty modest one, without seeming breaking changes (though my opinion is based solely on my read of the update release notes, on this first day).

More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of some of the compatibility-oriented changes listed for the updates.)

FWIW, openjdk updates are usually released at the same time or soon after, so this info may help users of such alternative JDK implementations.

For some folks, the above is all they need to hear. For others, whether this your first time updating Java or your fiftieth, there are some things that you may or may not know, as I cover here.

[....Continue Reading....]

TLDR: The new updates are 26.0.1, 25.0.3, 21.0.11, 17.0.19, 11.0.31, and 1.8.0_491 (aka 8u491) respectively. From a compatibility perspective, the update seems a pretty modest one, without seeming breaking changes (though my opinion is based solely on my read of the update release notes, on this first day).

More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of the compatibility-oriented changes listed for the updates.)

Also, openjdk updates are usually released at the same time or soon after, so this info may help users of such alternative JDK implementations.

For some folks, the above is all they need to hear. For others, whether this your first time updating Java or your fiftieth, there are some things that you may or may not know, as I cover here.

[....Continue Reading....]

TLDR: The new updates are 1.8.0_481 (aka 8u481), 11.0.30, 17.0.18, 21.0.10, and 25.0.2, respectively. More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of the changes listed for the updates.)

Also, openjdk updates are usually released at the same time or soon after, so this info may help users of such alternative JDK implementations.

For some folks, the above is all they need to hear. For others, whether this your first time updating Java or your fiftieth, there are some things that you may or may not know, as I cover here.

[....Continue Reading....]

TLDR: The new updates are 1.8.0_471 (aka 8u471), 11.0.29, 17.0.17, 21.0.9, and 25.0.1, respectively. More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of the updates with respect to my primary audience, users of CFML engines.)

[....Continue Reading....]

TLDR: The new updates are 1.8.0_461 (aka 8u461), 11.0.28, 17.0.16, 21.0.8, and 24.0.2, respectively. More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of the updates with respect to my primary audience, users of CFML engines.)

[....Continue Reading....]

TLDR: The new updates are 1.8.0_451 (aka 8u451), 11.0.27, 17.0.15, 21.0.7, and 24.0.1, respectively. Crazy that there are now 5 current Java releases, I do realize. More below, including links to more on each of them including what changed, bug fixes, and the security fixes each version contains, which are offered in Oracle resources I list below.

[....Continue Reading....]

Now that CF2025 has come out, supporting Java 21--and as ColdFusion and Java versions continue to evolve--you may wonder which version(s) of Java you can use with your current (or a given) version of ColdFusion.

You can't just use "any" jvm version with CF: it depends on first on what version of CF you are using, and then may even depend on what CF update has been applied to that CF version. (You also can't use Java from any vendor: Adobe supports only use of Oracle Java, and they license it for our use, as I discuss later.) And to be clear, currently ONLY CF2025 supports Java 21. (And though Java 25 came out in Sep 2025 as the latest LTS or "long-term support" Java releases, note that NO CF version currently supports that--as of an updated check in May 2026.)

So in this post, I offer a table that clarifies things, listing the various recent CF versions (even those no longer supported) and what (LTS) Java versions they supported, including if some CF update of a version changes the Java version supported.

[....Continue Reading....]

TLDR: The new updates are 1.8.0_441 (aka 8u441), 11.0.26, 17.0.14, 21.0.6, and 23.0.2, respectively. Crazy that there are now 5 current Java releases, I realize. More below, including more on each of them including what changed as well as bug fixes and the security fixes each version contains (including their CVE scores regarding urgency of concerns), which are offered in Oracle resources I list below.

[....Continue Reading....]