Payara Community rebrands to Azul Payara after acquisition and ships critical security fixes

Payara Platform Community has been rebranded to Azul Payara Community following Azul's acquisition of Payara in December 2025. The rebrand includes updated logos and integration into the Azul product portfolio alongside Azul Zulu and Azul Prime. The post also covers the April and May 2026 community releases: May's release (7.2026.5) includes critical security fixes for a remote arbitrary file read vulnerability and restricted EL expression access, plus bug fixes and component upgrades; April's release (7.2026.4) focused on removing deprecated APIs and configuration properties, along with several bug fixes and community contributions. All users are urged to upgrade due to the critical security patches.

GlassFish 8.0.2 patches three critical CVEs including CVSS 9.8 in OpenMQ

<p>Eclipse GlassFish 8.0.2 shipped on May 5, 2026, with three critical security fixes as the headline change.</p>
<h2>Security fixes</h2>
<p>The most severe is CVE-2026-24457, a 9.8 CRITICAL in OpenMQ. The other two are undisclosed CVEs in the Admin Console, scoring 9.6 and 9.1 respectively. If you’re running an earlier 8.x release, upgrading is the obvious move.</p>
<h2>Other fixes and upgrades</h2>
<p>Beyond security, the release fixes <code>@EJB</code> annotation behavior for appclient and improves hostname resolution for localhost. Several components were updated:</p>
<ul>
<li>Grizzly HTTP framework 5.0.1</li>
<li>Mojarra, OpenMQ, ORB, HK2 (Eclipse Foundation components)</li>
<li>Jackson and Nimbus JOSE JWT (third-party libraries)</li>
</ul>
<p>A Maven build dependency issue was also resolved.</p>
<h2>What didn’t make it</h2>
<p>The JAXB Impl 4.0.7 upgrade was rolled back after TCK regressions were found. It’ll be revisited in 8.0.3.</p>
<h2>What’s next</h2>
<p>Work on 8.0.3 is already underway. It will include additional security fixes and Embedded GlassFish startup improvements targeting roughly 10% faster boot times.</p>
<p>The release maintains full Jakarta EE 11 TCK compliance. Commercial support is available through OmniFish.</p>


Eclipse GlassFish 8.0.2 was released on May 5, 2026, featuring three critical security fixes including CVE-2026-24457 (CVSS 9.8) in OpenMQ and two undisclosed Admin Console CVEs scoring 9.6 and 9.1. The release also updates several components including Grizzly HTTP 5.0.1, Mojarra, Jackson, and Nimbus JOSE JWT, fixes @EJB annotation behavior, and resolves a Maven build dependency issue. A JAXB Impl 4.0.7 upgrade was rolled back due to TCK regressions and will be revisited in 8.0.3. Full Jakarta EE 11 TCK compliance is maintained.

Thymeleaf 3.1.4 patches CVSS 9.1 server-side template injection CVE-2026-40478

CVE-2026-40478 is a server-side template injection vulnerability in Thymeleaf with a CVSS score of 9.1, caused by a sandbox bypass using a tab character instead of a space after the 'new' keyword. The exploit only works if user input is passed directly to Thymeleaf's expression engine — a misuse pattern that requires significant manual wiring and is not the default behavior in Spring Boot. The fix is to update to Thymeleaf 3.1.4 (or update Spring Boot to 3.5.14/4.0.6), and then audit code for dynamic template construction from user input. Even if your code is not vulnerable, patching is still recommended.

IntelliJ IDEA 2026.1.2 ships bug fixes for Gradle ipr files, live templates and IDE freezes

IntelliJ IDEA 2026.1.2 is a bug-fix release addressing several issues: opening projects via .ipr files generated by Gradle's idea task, Java ternary expression indentation, Alt+Enter unexpectedly opening context menus on Windows, broken live templates with groovyScript, code disappearing on drag-and-drop, external diff tool access from the Commit window, MCP Server path errors for projects with spaces, broken Workspaces compatibility, and multiple IDE freeze issues.

Kotlin Multiplatform gets new default project structure separating shared and platform modules

JetBrains is updating the default project structure for Kotlin Multiplatform (KMP) projects. The old single composeApp module — which mixed shared library code with platform-specific application entry points — is being replaced by a clearer separation: a shared module for multiplatform library code and individual platform modules (androidApp, desktopApp, webApp) for each runnable application. The change is driven by Android Gradle Plugin 9.0 requirements, inconsistencies in the old structure (especially around iOS), and a desire for consistent module responsibilities. Configurations with native UI get sharedLogic and sharedUI modules, while server-inclusive projects gain a server module and a core module for shared code. The new structure is already live in the KMP wizard in IntelliJ IDEA and Android Studio. Existing projects are not required to migrate, but AGP 9.0 changes are mandatory for Android targets.

Apache Flink 2.2.1 ships 44 bug and vulnerability fixes for the 2.2 series

Apache Flink 2.2.1 is the first bug fix release in the Flink 2.2 series, containing 44 bug fixes, vulnerability fixes, and minor improvements. Key fixes address Flink SQL issues (UNNEST with LEFT JOIN, MultiJoin incorrect results, MATCH_RECOGNIZE parsing, JSON_OBJECT compilation), PyFlink thread mode and virtual environment problems, data corruption with custom partitioners and unaligned checkpoints, sensitive data exposure in debug logs, SSL connection failures with newer JDK versions, and Flink WebUI breakage in Chrome 144+. Improvements include AdaptiveScheduler transition acceleration, splittable timers in Interval Join, and updated cipher suite defaults. All users on Flink 2.2 are strongly recommended to upgrade.

Compose Multiplatform 1.11.0 ships native iOS text input and concurrent rendering by default

Compose Multiplatform 1.11.0 has been released with three major improvements. iOS apps now support experimental native text input built on UIView, offering native gestures, selection handles, and system context menus. Concurrent rendering on iOS is now enabled by default. UI testing gets a v2 API upgrade with StandardTestDispatcher as the default, making coroutine-based tests more predictable and adding effectContext support. Web scrolling performance has also been substantially reworked, bringing it much closer to native platform behavior.

Payara Server 7 and Micro 7 ship as first Jakarta EE 11 certified enterprise runtime

Azul Payara Server 7 and Payara Micro 7 are now generally available as the first commercially supported Jakarta EE 11 runtime certified across all three profiles (Full, Web Profile, Core Profile). This is the first major release under the Azul brand following its December 2025 acquisition of Payara. Both products ship with MicroProfile 6.1 and require JDK 21 as the minimum. Notably, Oracle WebLogic 15.1.1 is still at Jakarta EE 9.1, IBM WebSphere is frozen at Java EE 7, and Red Hat JBoss EAP ships Jakarta EE 10 — making Payara 7 the most current major enterprise app server. A critical security fix (covering arbitrary file read via OpenMQ and EL expression vulnerabilities) has been backported across all supported branches from Payara 4 through 7. Existing Jakarta EE 10 applications can migrate without code changes since the jakarta.* namespace is stable between EE 10 and EE 11.

JDK 27 adds post-quantum hybrid key exchange for TLS 1.3

JDK 27 introduces hybrid key exchange schemes combining ML-KEM with traditional ECDHE algorithms for TLS 1.3, enabling Java applications to defend against harvest-now, decrypt-later attacks without rewriting business logic. Ana-Maria Mihalceanu explains post-quantum hybrid key exchange and demonstrates practical usage in a Java application.

JDK 27 removes four deprecated Java launcher options including -noverify

JDK 27 will remove four deprecated Java launcher options: `-noclassgc`, `-verifyremote`, `-noverify`, and `-Xverify:none`. These options were deprecated in Java 13 and Java 24 respectively. After removal, using any of these options will cause the Java launcher or HotSpot VM to fail with an unrecognized option error. The `-Xverify:remote` and `-Xnoclassgc` HotSpot VM options remain unaffected and will continue to work normally.