Azul has released its October Security-only, Stability-first updates for Azul Core, immediately deployable fixes that address all 53 vulnerabilities disclosed in the latest OpenJDK quarterly update – the most in a single release in more than a decade.

The number of vulnerabilities disclosed this quarter is seven times greater than the two-year average of 7.6 Common Vulnerabilities and Exposures (CVEs) per quarter, according to Azul, the enterprise Java vendor. Azul’s Security-only, Stability-first updates contain security fixes and nothing else – no new features, enhancements or unrelated changes that could introduce regressions – allowing enterprises to deploy them straight to production.

AI is compressing the time between disclosure and exploit

Azul pointed to recent cases where AI tools have sharply cut the time attackers need to find and weaponise flaws. CSO reported that researchers using an AI tool found a 13-year-old remote code execution flaw in Apache ActiveMQ in about 10 minutes; two weeks after disclosure, nearly 6,500 internet-facing instances were still unpatched. In a separate case documented by GreyNoise, an attacker used hundreds of AI agents to chain two zero-day flaws in PaperCut NG/MF, reaching at least 440 instances across 395 organisations in 48 countries, with full domain administrator control achieved in seven minutes.

Mean time to exploit has shrunk to minus seven days – meaning exploitation often begins before a patch is even available – while the median enterprise patch cycle still stands at 43 days, Azul said, citing its own analysis of the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue. The analysis found that 61 per cent of vulnerabilities published in 2025 that were later exploited were added to the catalogue within 30 days of public disclosure.

Why “security-only” updates matter

Azul is the only vendor offering both monthly and quarterly updates scoped purely to security fixes, built on a previous quarter’s full patch update that has already been tested extensively by Azul and the broader Java community. The company said that since 2020, more than 20 per cent of OpenJDK quarterly updates have included regressions that delayed their rollout, while none of Azul’s security-only updates over the same period have had deployment-preventing regressions.

“The record number of vulnerabilities in one OpenJDK update is a very real warning to all enterprises running their business-critical workloads on Java. AI has collapsed the time between disclosure and exploitation from weeks to days to hours, and attackers are chaining flaws that defenders used to rank as low priority,” said Scott Sellers, co-founder and CEO of Azul. “Enterprises shouldn’t have to choose between security and stability. Azul’s Security-only, Stability-first updates are able to be deployed immediately, so customers can close the exposure window before an attacker finds it first.”

Azul Core is a Java SE-compliant, Technology Compatibility Kit-certified build of OpenJDK that serves as a drop-in replacement for Oracle Java and other Java SE-compliant distributions, including older Java 6 and 7 deployments that Azul said are still common in enterprise production environments.