By The quarterly patch cycle was built for a threat environment that no longer exists. AI models can now identify and operationalize software vulnerabilities faster than enterprise teams can respond on a 90-day schedule. For organizations running Java at scale, that gap is a measurable security risk.
In this interview on TFiR, Simon Ritter, Deputy CTO at Azul, breaks down why Oracle is shifting Java toward a monthly security update cadence, what the August 2026 out-of-cycle release signals, and the real operational load this places on DevOps and IT teams.
Guest: Simon Ritter, Deputy CTO at Azul
Show: TFiR
Here is what every Java platform engineer and DevOps team lead needs to know.
Technical Deep Dive
Q: Why is the quarterly Java security update cycle no longer sufficient?
Simon Ritter, Deputy CTO at Azul, explains that AI models and large language models have fundamentally changed the speed at which vulnerabilities can be identified and exploited. The quarterly cadence, used across many software ecosystems including Java, was designed for a threat environment where exploit development was slow and resource-intensive. That assumption no longer holds. The availability of AI tools purpose-built for vulnerability research has compressed the time between disclosure and active exploitation to a point where a 90-day window leaves enterprises exposed.
“The use of AI models, LLMs and so on, has really changed the speed at which we can identify and then exploit vulnerabilities.” — Simon Ritter, Deputy CTO, Azul
Q: What role did Anthropic’s Mythos model play in shifting the Java patch cadence?
Ritter identifies Anthropic’s Mythos as the inflection point. Mythos was a frontier model trained specifically to identify security vulnerabilities and develop methods to exploit them. Anthropic’s own assessment of its capabilities was serious enough that they chose not to release the model publicly, citing concern that malicious actors could weaponize it directly. The existence of a model this capable, even one withheld from public release, demonstrated that AI-accelerated exploit development was no longer theoretical and forced a reassessment of acceptable patch intervals across the industry.
“Anthropic announced Mythos, which was a frontier model that had been trained and developed specifically to look at identifying security vulnerabilities and also finding ways of exploiting those vulnerabilities.” — Simon Ritter, Deputy CTO, Azul
Q: What is Oracle’s plan for moving Java to a monthly security patch cadence?
Oracle has publicly stated its intent to shift Java to a monthly security update schedule beginning in the next calendar year. The August 2026 release is an out-of-cycle patch designed to serve as a transition step, allowing teams to begin adapting their workflows before monthly releases become standard. The cadence in practice will not be continuous immediately: August will receive a patch, September will not, and October will deliver the regular quarterly update before the monthly rhythm begins in earnest.
“Oracle have said publicly that they want to shift to a monthly cadence starting from next calendar year. The idea of this August release is to help people get used to the idea of a more frequent cadence.” — Simon Ritter, Deputy CTO, Azul
Q: What is the operational impact of monthly Java patching on DevOps and IT teams?
Ritter is direct about the operational burden. DevOps teams previously structured their patch workflows around four fixed dates per year: January, April, July, and October. Monthly releases require those same teams to evaluate incoming security patches every 30 days, assess which patches apply to their environment, allocate resources for testing and rollout, and identify which machines require updates. The frequency multiplies planning and execution cycles by up to three times without any corresponding increase in team capacity. Ritter acknowledges that daily or weekly cycles would overload teams entirely and that a monthly cadence represents the practical balance point between security responsiveness and operational feasibility.
“Every month you’re going to potentially get a set of security patches and you’ve then got to decide which ones, or if you think this is worth rolling out and patching your systems.” — Simon Ritter, Deputy CTO, Azul
Resources & Documentation
- Azul JVM Security, Azul’s resource hub covering JVM security, vulnerability management, and Java runtime guidance for enterprise teams
***
👇 Click to Read Full Raw Transcript
Swapnil Bhartiya: Let’s talk about this quarterly update cycle. Why is the quarterly update cycle no longer sufficient? How is AI changing the threat landscape to make a 90 day window too risky for enterprise device states? I feel even weekly window is not enough for AI.
Simon Ritter: Yes, I mean, as you say, what we’ve seen in the last sort of six months or so is a real radical shift in terms of the way that AI is being applied to the field of IT security. And the real kind of, I guess, game changing moment was when Anthropic announced Mythos, which was a frontier model. And that was one which had been trained and developed specifically to look at the ideas of identifying security vulnerabilities and also finding ways of exploiting those vulnerabilities. And they were actually so successful that they decided not to make this model generally available because they were worried that people who had malicious intent might actually use it in that way. And so, so they didn’t want people breaking into systems and causing all sorts of problems. But essentially what’s happened is that the use of AI models, LLMs and so on, has really changed the speed at which we can identify and then exploit vulnerabilities. So we’ve had this idea of a quarterly update for many types of software. Java is one of them. There are lots of other pieces of software which use a quarterly update schedule. But with AI now having a big impact on the ability to develop those exploits, what the decision that’s been made is that we do need to move to a faster cadence. As you rightly said, in August we will see a monthly update come out. We’re not going to see a monthly update every month yet. We’ll see August will be one, then we’ll have a break in September, and then in October we’ll have the usual quarterly one. But Oracle, who sort of have control over the way that these things happen for Java, have said publicly that they want to shift to a monthly cadence starting from next calendar year. So really the idea of this August release is to help people get used to the idea of a more frequent cadence for this, because this does have a huge impact on it. Teams on DevOps teams in the past, they’ve thought, okay, we can do all this every three months because we have the schedule of January, April, July and October. Great, we can work towards is that now what they’re being told is every month you’re going to potentially get a set of security patches and you’ve then got to decide which ones, or if you think this is worth rolling out and patching your systems and then you’ve got to figure out the resources you need to do that, which machines need to be updated, and so on. So there’s a lot of work that needs to go into this. And I get what you’re saying about maybe a weekly cycle or a daily cycle, but I think that then pushes things too far and it overloads the DevOps teams and the IT teams. So there needs to be a sort of balance between a cadence of a quarterly and a daily cadence.
