Java news and engineering summaries

This project revives Roedy Green's Mini PAD Submitter, a legacy Java tool for distributing software PAD files. By fixing HTTPS support, SNI handshakes, and redirect handling, the update restores functionality to modern web environments. It also replaces hardcoded site lists with an external text file, allowing users to update submission targets without recompiling the source code.

Ghidra is an NSA Research Directorate software reverse engineering framework for analyzing compiled code on Windows, macOS, and Linux. Its integrated tools provide disassembly, assembly, decompilation, graphing, scripting, broad processor and executable-format support, and interactive or automated operation. Ghidra addresses scaling and collaboration challenges in complex reverse-engineering work while offering an extensible platform where users can create Java or Python scripts and extensions for malware and vulnerability analysis.

Project Valhalla arrives in JDK 28 as a preview feature, introducing value classes to Java. This update allows for memory-efficient, flat layouts by removing object identity, bridging the performance gap between primitives and classes. While it marks a fundamental shifts in JVM memory management, full features like non-nullable types and specialized generics are planned for future releases.

Java class files begin with the magic number 0xCAFEBABE, chosen to identify valid files. Patrick Naughton explained that the team selected it before the name Java existed because it was fun, unique, and memorable; 0xDEADBABE was the rejected alternative. Its coffee association with Peet’s Coffee was coincidental.

Optimizing a Java order-processing application involved identifying eight common performance anti-patterns, such as inefficient string concatenation, autoboxing, and object reuse issues. By replacing these patterns with optimized alternatives, throughput increased by five times, heap usage dropped by 87%, and GC pauses decreased significantly, proving that small code-level optimizations yield massive benefits when scaled across production fleets.

A significant performance optimization has been implemented in OpenJDK, specifically affecting the ThreadMXBean.getCurrentThreadUserTime() method on Linux. Previously, this method relied on a costly procedure of opening and parsing /proc/self/task/stat files to retrieve user CPU time. This legacy approach suffered from high overhead due to multiple system calls, VFS dispatch, and buffer management. By replacing this mechanism with a direct call to clock_gettime() using a specialized Linux-specific clock ID bitmask, developers achieved a 30x to 400x performance improvement. The new implementation leverages a long-standing but obscure Linux ABI feature that encodes clock types directly into the clockid_t. This change underscores the value of revisiting legacy code and utilizing kernel-specific optimizations over generic POSIX implementations to eliminate significant performance bottlenecks in high-concurrency environments.

OpenJDK JDK 26 GA has been released, offering production-ready builds of the Java SE 26 platform under the GPLv2 license with Classpath Exception. The release supports multiple operating systems and architectures, including Linux, macOS, and Windows. Users are encouraged to provide feedback through the official bug-reporting channel.

Minecraft Java Edition Snapshot updates to SDL3 for improved window and input management. Key changes include new data components for furnace and brewing fuels, sign text, and villagers. The update also features major technical improvements for loot tables, predicates, and noise settings in world generation, alongside numerous bug fixes across game mechanics and UI.

JDK 27, the reference implementation of Java 27, is now Generally Available as build 35, following a clean second Release Candidate. It is production-ready and available through GPL-licensed OpenJDK builds from Oracle. Highlights include G1 as the default garbage collector, post-quantum TLS 1.3 key exchange, Compact Object Headers, JFR data redaction, and several preview or incubating features.

JavaBox is a proof-of-concept project that runs a full OpenJDK environment inside a browser via WebAssembly. By emulating an x86_64 Linux kernel using QEMU and a custom CompileServer daemon, it bypasses slow startup times to execute Java code entirely client-side, demonstrating high-level abstraction layers and the modern capabilities of browser-based emulation.

JetBrains has announced that starting with version 2026.1 EAP, all IntelliJ-based IDEs will transition to running natively on Wayland by default for supported Linux desktop environments. This shift aligns with Wayland becoming the primary display server across modern Linux distributions. While the user interface remains familiar, technical differences in Wayland mean the window manager now controls window positioning, affecting dialog placement and the visibility of the startup splash screen. JetBrains has improved stability, drag-and-drop, and input method support since the initial preview. For environments where Wayland is not supported, X11 remains functional via XWayland. This initiative is part of JetBrains' commitment to the OpenJDK project Wakefield, ensuring Java applications perform natively and efficiently on modern Linux architecture while maintaining an open-source development model.

Java 26 introduces several key enhancements, including GC-agnostic object caching and G1 GC performance improvements. It adds HTTP/3 support to the HTTP Client API and features continued previews of structured concurrency, lazy constants, the Vector API, and primitive types in patterns, while deprecating the Applet API and tightening final field mutation via deep reflection.

This pull request implements the initial preview of JEP 401: Value Objects, along with JEP 539: Strict Field Initialization, as part of the Project Valhalla effort. These changes introduce foundational improvements to the Java language, JVM, and standard library to support value-based types, requiring rigorous review across multiple sub-components.

This table lists various Java Virtual Machine (JVM) configuration flags and options, detailing their names, associated OpenJDK versions, deprecation status, types, operating system compatibility, CPU architectures, components, and primary functional descriptions. These flags are critical for tuning memory management, garbage collection, and Just-In-Time (JIT) compilation performance.

A contributor named Bingwu Zhang shared a frustrating experience regarding the Oracle Contributor Agreement (OCA) process for OpenJDK. Despite attempting to submit patches since January 2025, the contributor faced a year-long delay without approval or rejection from Oracle. Despite multiple follow-ups, the process remained stalled in a repetitive cycle of apologies without progress. Suspecting geopolitical or export control factors due to being based in Mainland China, the author eventually decided to cease their efforts to upstream the code. Consequently, the contributor released several technical patches related to llvm-config checks and thread stack size adjustments for the zero variant, inviting other developers to rewrite and submit them to bypass the stalled OCA. This case highlights significant bureaucratic hurdles within major open-source ecosystems managed by corporate entities.

Security researchers have identified a sophisticated campaign targeting Ivanti Endpoint Manager Mobile (EPMM) that utilizes dormant 'Sleeper Shells.' Unlike typical rapid-exploitation attacks, this operation involves deploying an in-memory Java class loader at /mifs/403.jsp and then going silent. The loader, identified as base.Info, does not execute commands immediately but acts as a staging mechanism for a secondary payload to be delivered via HTTP parameters. This behavior is highly characteristic of Initial Access Brokers (IABs) who establish a persistent foothold to sell or hand off to other cybercriminals later. The implant resides solely in memory, making it invisible to many traditional antivirus solutions. Defending against such threats requires immediate patching of CVE-2026-1281 and CVE-2026-1340, followed by a full server restart to flush the volatile memory. Organizations are urged to hunt for specific indicators of compromise, such as the k0f53cf964d387 parameter, to ensure their environments are not silently compromised.

Modern Java garbage collectors, like ZGC and G1, decouple pause times from CPU overhead, creating operational blind spots. OpenJDK 26 introduces the MemoryMXBean.getTotalGcCpuTime() API and -Xlog:cpu to quantify explicit GC costs. This allows engineers to measure infrastructure efficiency and make informed decisions regarding the trade-offs between memory allocation and CPU consumption.

This overview compares Java and Go, examining their origins, philosophies, and technical trade-offs. While Go focuses on minimalism, architectural efficiency for cloud-native systems, and ease of onboarding, Java offers a robust ecosystem for complex enterprise domains and long-running performance. Choosing between them depends on team seniority, project scale, and operational requirements.

While refactoring Minecraft mod build tooling, the author created jardiff, a semantic comparison tool that normalizes JSON, disassembles class files, recursively inspects archives, and applies Myers diff. Keeping its source in the editor enables immediate, domain-specific customization—such as ignoring class-version changes—without anticipating configuration flags or DSLs. Packaging it as a binary would freeze that flexibility.

Annote is an experimental and satirical project that transforms Java annotations into a fully functional, interpreted programming language. While annotations were originally designed for metadata, this project utilizes reflection to execute logic defined entirely within annotation parameters, including variables, loops, conditionals, and arithmetic. The framework uses a shunting-yard algorithm for expression parsing and a stack-based approach for block management. Despite its 'cursed' nature, Annote supports advanced features like recursion, state management through class-level fields, and custom exception handling via specific annotations. It serves as a humorous yet technical exploration of the limits of the Java Reflection API and the annotation system, intentionally disregarding traditional best practices in favor of metadata-driven execution.