Java roundup: JDK 28 schedule, eMudhra CA breach, WildFly 42 and Apache POI 6.0

Oracle proposed the JDK 28 release schedule, with rampdown phase one on December 3, 2026 and the final release candidate on February 16, 2027. Mozilla disclosed that eight private keys of eMudhra intermediate CA certificates were compromised, prompting out-of-cycle patches from Azul and BellSoft. WildFly 42, Apache POI 6.0 and Open Liberty 26.0.0.11 beta also shipped.

• JDK 28: fork on December 3, 2026, final RC on February 16, 2027
• Eight private keys of eMudhra intermediate CA certificates compromised
• Azul Zulu patched 53 CVEs and shipped an out-of-cycle fix on October 21
• Apache POI 6.0 requires JDK 17 minimum and drops deprecated methods