Patchmageddon
Articles

Field notes on keeping Java estates patched and licensed

RSS
Practical, vendor-neutral writing for the platform, security and procurement teams who own enterprise Java.
Oracle Java Licensing

Oracle JDK 21's free update window has closed. Here's what that means.

Oracle JDK 21 updates released after September 2026 are no longer free for production use. Your options: pay, stop patching, or migrate to OpenJDK.
6 min read
Oracle Java Licensing

How Oracle's employee-based Java metric works, and why a few installs can price your whole company

Oracle's Java SE Universal Subscription is priced per employee, not per install. How the metric works, a worked example, and why your inventory drives the cost.
5 min read
OpenJDK Migration

Oracle JDK to OpenJDK: a practical migration checklist

A step-by-step checklist for moving from Oracle JDK to an OpenJDK build: choosing a distribution, what differs between vendors, verification and cleanup.
6 min read
JVM Discovery & Inventory

You can't patch what you can't find: building a real JVM inventory

Most enterprises can't say how many JVMs they run or where. Here's what a useful JVM inventory captures, how to collect it, and where it goes wrong.
6 min read
Risk & Governance

How to get your CAB to approve faster JVM patching

Faster JVM patching is mostly a governance problem. How to score criticality, set thresholds and build the evidence a Change Advisory Board can approve.
5 min read
Patch Management

Fast detection and rollback: a safer alternative to full regression testing

For low-criticality apps, quick detection and cheap rollback cut JVM patch risk more than a full regression run. Here's how to build that safety net.
5 min read
Patch Management

Six ways JVM changes break production, and how to see them coming

APM agents, TLS defaults, JIT warm-up, GC changes, removed APIs and container awareness: how each JVM failure mode shows up, and how to catch it before rollout.
6 min read
Vendor & Third-Party Apps

Patching the JVMs you didn't install: Java inside vendor products

Many commercial products ship their own Java runtime. Why scanners miss them, what vendors will support, and how to handle the ones you can't patch yourself.
5 min read