Your Java apps may still be trusting compromised certificates
Hi John,
On October 20, Mozilla publicly disclosed that the private keys of eight intermediate certificate authority certificates issued by eMudhra were compromised. Browsers were protected within hours, but Java applications were not, because the JDK keeps its own list of trusted certificates. If you run Java in production, you may be exposed.
On October 20, Mozilla publicly disclosed that the private keys of eight intermediate certificate authority certificates issued by eMudhra were compromised. Browsers were protected within hours, but Java applications were not, because the JDK keeps its own list of trusted certificates. If you run Java in production, you may be exposed.
- Azul customers received two out-of-cycle updates on October 21 and October 23 to address two separate eMudhra CVEs. Both were provided less than 24 hours after disclosure and can be deployed immediately to block the compromised certificates.
- This is in addition to the October quarterly update that Azul customers received on October 20, which addressed an all-time high of 53 JDK vulnerabilities.
- All updates are available for Java 8, 11, 17, 21, 25 and 27, plus Java 6 & 7, extending the same security-only cadence to organizations still running older Java in production.
Maximize security, minimize risk: Azul’s Security-only, Stability-first™ quarterly, monthly and out-of-cycle OpenJDK updates contain only security fixes, so they are suitable for immediate deployment to production with minimal regression risk.
Don't leave Java exposed.
Azul, Zing, Zulu, Zulu Enterprise, Payara and ReadyNow! are either registered trademarks or trademarks of Azul Systems Inc., registered in the U.S. and elsewhere. All other trademarks belong to their respective owners.
© Azul 2026. All rights reserved.