Up to 90 days can pass between two quarterly Java security updates. Azul considers that window too long given the current threat landscape, and therefore introduced monthly Critical Security Patch Updates (CSPUs) in early August 2026.
Pure security packages instead of quarterly bundles
The new cadence applies to Azul Core and Azul Prime. The packages are meant to contain only security-relevant fixes. With this, Azul wants to reduce the time it takes to fix critical vulnerabilities without jeopardizing the stability of production Java environments through extensive code changes. Azul plans to release CSPUs on the third Tuesday of each month, with an update appearing whenever a priority security fix is needed. That gives companies a more predictable process for reviewing, approving, and rolling out Java patches.
The monthly updates cover several Java versions: the supported LTS versions Java 8, 11, 17, 21, and 25, the current version Java 26, as well as Java 6 and 7 under Azul's supported versions. That means the offering also targets companies that still run older Java versions in production applications, where a longer patch interval can make securing business software harder.
Stability-first aims to limit regressions
For its existing quarterly Java releases, Azul distinguishes between Patch Set Updates (PSUs), which bundle all changes for a quarter, and Critical Patch Updates (CPUs), which build on an already stabilized codebase and focus on security fixes, an approach Azul calls stability-first. Azul is now applying that same principle to the monthly cycle: CSPUs are meant to specifically fix vulnerabilities documented as CVEs, with changes unrelated to security left out. That's meant to reduce the likelihood of a security update introducing new malfunctions into existing applications.
"Monthly, security-only updates are the new standard Azul is setting for protecting enterprise Java environments," says Scott Sellers, co-founder and CEO of Azul. The approach does have a clear limit, though: it doesn't give you a general update to the Java platform, only a package limited to critical security issues, the regular update models remain relevant for functional improvements and other fixes.
AI is accelerating the pace of vulnerabilities
Azul attributes the change to an accelerating security landscape. Artificial intelligence can speed up both the search for vulnerabilities and their exploitation, while at the same time the number of security flaws vendors and operators need to assess and fix keeps growing. For further protection, Azul plans to work with the OpenJDK community and the OpenJDK Vulnerability Group.