"Security in Java" [AtA]

Given how prevalent Java is on web servers throughout the internet, security in Java is of critical importance. There's the security of the JDK itself, of course, which is overseen by the OpenJDK Security Group, which you should report JDK vulnerabilities to. But there are also the algorithms and features Java offers applications that are built on top of it and the cryptographic road map is an essential part of that development process. In recent years, post-quantum encryption has made big splashes but Java now also supports PEM texts and is considering the adoption of Argon2. In this "Ask the Architects" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Sean Mullan, Lead of the OpenJDK Security Group and Tech Lead of the Oracle Security Libraries Team. "Ask the Architects" is our podcast show, where we talk to experts in OpenJDK about their work on the Java language, API, and runtime. Show notes: OpenJDK Security Group: https://openjdk.org/groups/security/ Oracle JDK Cryptographic Roadmap: https://www.java.com/en/jre-jdk-cryptoroadmap.html Post-Quantum Hybrid Key Exchange for TLS 1.3: https://inside.java/2026/02/17/tls-post-quantum-hybrid-key-exchange/ JEP 542 - PEM Encodings of Cryptographic Objects: https://openjdk.org/jeps/542 JEP Draft for Argon2: https://openjdk.org/jeps/8377081

"AOT Caching - Netflix' Practice vs OpenJDK's Theory" [I/O]

Java projects that want to reduce their launch times need to look into Java's new ahead-of-time capabilities. A training run is used to populate a cache that, in production, allows the JVM to short-circuit many operations, like class loading and linking, profile gathering, and - probably soon - JIT compilation. To get the most out this feature, a good training run is essential. Netflix approach is pretty much the ideal one: use a canary deployment of a new version to collect training data and create the cache for the remaining deployments from that. But, from time scales to checkpointing, from managing to inspecting cache files, there are a number of details to consider. In this "Input/Output" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Martin Chalupa, Senior Performance Engineer at Netflix and John Rose, JVM Architect at Oracle and Lead of OpenJDK's Project Leyden. "Input/Output" is our new show, where we talk to people outside of OpenJDK to bring you their perspectives and insights into what's happening in the Java ecosystem. This special episode comes with an OpenJDK architect to boot. Show notes: JDK 27: https://jdk.java.net/27 Project Leyden: https://openjdk.org/projects/leyden/ Martin's talk at JavaOne 2026: https://www.youtube.com/watch?v=4kEh8hxAP4U

"Declassifying the Java 27 Release!" [IJN]

Java 27 is heading for release on September 15th. As with every release of the JDK there are a host of changes that will impact developers, from new features, to changes in behavior of existing features. In this episode of the Inside Java Newscast we will be "declassifying" all the developer impacting changes in Java 27. 

"Operator Overloading with Type Classes" [AtA]

OpenJDK's Project Valhalla is improving Java's support for custom numerical types. That goes beyond value types and also encompasses explorations into operator support. While Java is extremely unlikely to ever allow arbitrary operator definitions, it may well support limited operator overloading, so custom value types could be added or multiplied with plus or multiplication signs instead of annoying method calls. In this "Ask the Architects" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Joe Darcy, Valhalla committer in the Java Platform Group at Oracle. "Ask the Architects" is our podcast show, where we talk to experts in OpenJDK about their work on the Java language, API, and runtime.

"Keeping Up with the Java Release Train" [I/O]

"JSON API, Valhalla Progress, LTS ❤️ PQC" [IJN]

JEP 540 proposes to incubate a simple JSON API and is currently proposed to target JDK 28. The pull request for Project Valhalla's JEPs 401 and 539 were merged and value types are available as a preview feature in the latest JDK 28 early-access builds. Oracle plans to backport post-quantum cryptography to Oracle JDKs with LTS (25, 21, 17, 11, and 8) and move Java to monthly security updated (currently quarterly). JDK 28 EA builds: https://jdk.java.net/28/ Dan's mail re values: https://mail.openjdk.org/archives/list/core-libs-dev@openjdk.org/thread/Y72NRXM7KYBX43OKYBQMVKOZDWKG4MHS/ Angelos' mail re primitive patterns: https://mail.openjdk.org/archives/list/amber-spec-experts@openjdk.org/thread/WSXW4QMJ3EBIHIULEB25HUAMR5JB767H/ JEP 540: https://openjdk.org/jeps/540 JEP 496: https://openjdk.org/jeps/496 JEP 497: https://openjdk.org/jeps/497 JEP 572: https://openjdk.org/jeps/572 Blog post in PQC in LTS: https://blogs.oracle.com/java/post-quantum-cryptography-in-long-term-support-jdk-releases Accelerated Vulnerability Detection and Response: https://blogs.oracle.com/security/accelerating-vulnerability-detection-and-response-at-oracle More frequent Oracle JDK releases:  https://blogs.oracle.com/java/transitioning-java-to-more-frequent-security-updates More Frequent OpenJDK releases: https://mail.openjdk.org/archives/list/jdk-updates-dev@openjdk.org/thread/SVHDNJDY62MX6YBEA4FSMW4U72H77F6S/ JDK 27 RC pushed back: https://mail.openjdk.org/archives/list/jdk-dev@openjdk.org/thread/EYKJPUAZ4BX4DXD7H4C5ETWJFNQZBFO5/ OpenJDK Mail Search: https://openjdk.barlasgarden.com/ 

"Embracing Virtual Threads with Helidon" [I/O]

Helidon 4.4 was released in April 2026 and stands out from other web frameworks by embracing new Java features as early as possible, particularly virtual threads and ahead-of-time computation. It is also aiming to become an OpenJDK project in the coming months. In this "Input/Output" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Joe Di Pol, Lead Principal Platform Software Engineer at Oracle where he works on Helidon. "Input/Output" is our new show, where we talk to people outside of OpenJDK to bring you their perspectives and insights into what's happening in the Java ecosystem.

"JIT Compiler From the Ground Up" [AtA]

While Java programs are deployed as bytecode, performance-relevant code will be compiled, at run time, to machine code whose performance rivals that of any other platform. In the HotSpot JVM, this is the job of the just-in-time compilers C1 and C2 and between speculation and traps, inlining and constant folding, escape analysis and scalar replacement (and many more), they apply a number of heuristics, analyses, and transformations to achieve that. This requires expertise, careful research, thorough testing, and regular reevaluations of old assumptions. In this "Ask the Architects" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Roberto Lozano, compiler engineer at the Java Platform Group at Oracle. In our show "Ask the Architects", we talk to experts in OpenJDK about their work on the Java language, API, and runtime.

"AI Solutions with Spring AI 2.0 and Java" [I/O]

Spring AI 2.0 released in June 2026 and is one of several projects ensuring Java's continued strength in enterprise AI development. Here are some tips on deterministic agents, MCP servers and skills, prompt engineering, and where Java's richness for AI solutions stems from. In this "Input/Output" episode of the Inside Java Podcast, recorded during JavaOne 2026, Lize Raes talks to Dan Vega, Spring Developer Advocate at Broadcom, Java Champion, speaker, and author. "Input/Output" is our new show, where we talk to people outside of OpenJDK to bring you their perspectives and insights into what's happening in the Java ecosystem.

"JDK 27 + Valhalla, Now! + Hackathon" [IJN]

JDK 27 entered Ramp-Down-Phase 1 in early June, so we can go over its features. Valhalla's first JDK Enhancement Proposal (401) will likely be part of JDK 28. Show off your Java ideas in the "Modern Java in the Wild" hackathon. There are two interesting articles for those who want to dive deeper into AOT with agents or into using GPU tensor cores from Java. Links: JDK 27 JEP list: https://openjdk.org/projects/jdk/27/ Valhalla mail: https://mail.openjdk.org/archives/list/jdk-dev@openjdk.org/threadAIA3O3LHFZ6T7TIPH7KZT4WS4B6U72U5/ JEP 401 PR: https://github.com/openjdk/jdk/pull/31120 "Java in the Wild" hackathon: https://www.hackster.io/contests/modern-java-in-the-wild AOT vs agents: https://bugs.openjdk.org/browse/JDK-8387190 AOT and JVMTI agents: https://bugs.openjdk.org/browse/JDK-8387194 "Exploiting GPU Tensor Cores": https://openjdk.org/projects/babylon/articles/hat-tensors/hat-tensors  

"Scripting JS and Python with Project Detroit" with Mikael Vidstedt [AtA]

OpenJDK recently resurrected Project Detroit, an effort to ease Java's interoperability with Python and JavaScript. Interestingly, while both integrations will work through the _java.scripting_ API, there are still differences between them. On top of that, the JavaScript integration needs to explain how it related to the removal of Nashorn in JDK 16. In this "Ask the Architect" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Mikael Vidsted, lead of the Java Virtual Machine team at Oracle, about Project Detroit. Project Detroit: https://openjdk.org/projects/detroit/

"How JEPs Drive Java's Evolution" with Alex Buckley [AtA]

JDK Enhancement Proposals are OpenJDK's vehicle for documenting and communicating substantial changes of the Java language, its APIs, and the runtime but also the JDK project itself, for example when it comes to development processes. Their well-defined structure and the immense care that goes into writing them make them eminently readable and understanding them well is essential to understanding Java's development. In this "Ask the Architect" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Alex Buckley, the Guardian of the JEP process.

"Java *is* Memory Efficient" with Ron Pressler [AtA]

Java's use of memory, often chided for being excessive, is actually a strength as it trades more memory use for fewer CPU cycles. Java can only make this tradeoff due to its moving garbage collectors, something more memory efficient platforms often cannot. But what's the point in leaving available memory on the table if using it makes your program run faster? Efficient use of that resource wouldn't be to leave it untapped but to use it to speed up the program. In this "Ask the Architect" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Ron Pressler, Java Architect at Oracle.

"Java Gets Post-Quantum TLS" [IJN]

With JDK 27 introducing hybrid key exchange schemes that combine ML-KEM with traditional ECDHE algorithms, Java applications can gain TLS-layer protection against the harvest-now, decrypt-later threat without rewriting business logic. In this episode of the Inside Java Newscast, Ana explains post-quantum hybrid key exchange for TLS 1.3 and demonstrates how a Java application can take advantage of it. See https://inside.java/podcast  

"Make Java Safer with Flexible Constructor Bodies" [IJN]

Flexible constructor bodies were added to Java 25 with JEP 513. In this episode of the Inside Java Newscast Billy Korando will review the issues with how constructors used to work before Java 25, either forcing developers to write convoluted code, or in some cases undermining the safety and integrity of child classes. Billy will then cover how flexible constructor bodies address these issues and how Java developers can use them to write safer code and better designed applications. Make sure to check https://inside.java/podcast