Java news and engineering summaries

Project Valhalla arrives in JDK 28 as a preview feature, introducing value classes to Java. This update allows for memory-efficient, flat layouts by removing object identity, bridging the performance gap between primitives and classes. While it marks a fundamental shifts in JVM memory management, full features like non-nullable types and specialized generics are planned for future releases.

Optimizing a Java order-processing application involved identifying eight common performance anti-patterns, such as inefficient string concatenation, autoboxing, and object reuse issues. By replacing these patterns with optimized alternatives, throughput increased by five times, heap usage dropped by 87%, and GC pauses decreased significantly, proving that small code-level optimizations yield massive benefits when scaled across production fleets.

A significant performance optimization has been implemented in OpenJDK, specifically affecting the ThreadMXBean.getCurrentThreadUserTime() method on Linux. Previously, this method relied on a costly procedure of opening and parsing /proc/self/task/stat files to retrieve user CPU time. This legacy approach suffered from high overhead due to multiple system calls, VFS dispatch, and buffer management. By replacing this mechanism with a direct call to clock_gettime() using a specialized Linux-specific clock ID bitmask, developers achieved a 30x to 400x performance improvement. The new implementation leverages a long-standing but obscure Linux ABI feature that encodes clock types directly into the clockid_t. This change underscores the value of revisiting legacy code and utilizing kernel-specific optimizations over generic POSIX implementations to eliminate significant performance bottlenecks in high-concurrency environments.

OpenJDK JDK 26 GA has been released, offering production-ready builds of the Java SE 26 platform under the GPLv2 license with Classpath Exception. The release supports multiple operating systems and architectures, including Linux, macOS, and Windows. Users are encouraged to provide feedback through the official bug-reporting channel.

JavaBox is a proof-of-concept project that runs a full OpenJDK environment inside a browser via WebAssembly. By emulating an x86_64 Linux kernel using QEMU and a custom CompileServer daemon, it bypasses slow startup times to execute Java code entirely client-side, demonstrating high-level abstraction layers and the modern capabilities of browser-based emulation.

JetBrains has announced that starting with version 2026.1 EAP, all IntelliJ-based IDEs will transition to running natively on Wayland by default for supported Linux desktop environments. This shift aligns with Wayland becoming the primary display server across modern Linux distributions. While the user interface remains familiar, technical differences in Wayland mean the window manager now controls window positioning, affecting dialog placement and the visibility of the startup splash screen. JetBrains has improved stability, drag-and-drop, and input method support since the initial preview. For environments where Wayland is not supported, X11 remains functional via XWayland. This initiative is part of JetBrains' commitment to the OpenJDK project Wakefield, ensuring Java applications perform natively and efficiently on modern Linux architecture while maintaining an open-source development model.

Java 26 introduces several key enhancements, including GC-agnostic object caching and G1 GC performance improvements. It adds HTTP/3 support to the HTTP Client API and features continued previews of structured concurrency, lazy constants, the Vector API, and primitive types in patterns, while deprecating the Applet API and tightening final field mutation via deep reflection.

This table lists various Java Virtual Machine (JVM) configuration flags and options, detailing their names, associated OpenJDK versions, deprecation status, types, operating system compatibility, CPU architectures, components, and primary functional descriptions. These flags are critical for tuning memory management, garbage collection, and Just-In-Time (JIT) compilation performance.

A contributor named Bingwu Zhang shared a frustrating experience regarding the Oracle Contributor Agreement (OCA) process for OpenJDK. Despite attempting to submit patches since January 2025, the contributor faced a year-long delay without approval or rejection from Oracle. Despite multiple follow-ups, the process remained stalled in a repetitive cycle of apologies without progress. Suspecting geopolitical or export control factors due to being based in Mainland China, the author eventually decided to cease their efforts to upstream the code. Consequently, the contributor released several technical patches related to llvm-config checks and thread stack size adjustments for the zero variant, inviting other developers to rewrite and submit them to bypass the stalled OCA. This case highlights significant bureaucratic hurdles within major open-source ecosystems managed by corporate entities.

Security researchers have identified a sophisticated campaign targeting Ivanti Endpoint Manager Mobile (EPMM) that utilizes dormant 'Sleeper Shells.' Unlike typical rapid-exploitation attacks, this operation involves deploying an in-memory Java class loader at /mifs/403.jsp and then going silent. The loader, identified as base.Info, does not execute commands immediately but acts as a staging mechanism for a secondary payload to be delivered via HTTP parameters. This behavior is highly characteristic of Initial Access Brokers (IABs) who establish a persistent foothold to sell or hand off to other cybercriminals later. The implant resides solely in memory, making it invisible to many traditional antivirus solutions. Defending against such threats requires immediate patching of CVE-2026-1281 and CVE-2026-1340, followed by a full server restart to flush the volatile memory. Organizations are urged to hunt for specific indicators of compromise, such as the k0f53cf964d387 parameter, to ensure their environments are not silently compromised.

Modern Java garbage collectors, like ZGC and G1, decouple pause times from CPU overhead, creating operational blind spots. OpenJDK 26 introduces the MemoryMXBean.getTotalGcCpuTime() API and -Xlog:cpu to quantify explicit GC costs. This allows engineers to measure infrastructure efficiency and make informed decisions regarding the trade-offs between memory allocation and CPU consumption.

This overview compares Java and Go, examining their origins, philosophies, and technical trade-offs. While Go focuses on minimalism, architectural efficiency for cloud-native systems, and ease of onboarding, Java offers a robust ecosystem for complex enterprise domains and long-running performance. Choosing between them depends on team seniority, project scale, and operational requirements.

Annote is an experimental and satirical project that transforms Java annotations into a fully functional, interpreted programming language. While annotations were originally designed for metadata, this project utilizes reflection to execute logic defined entirely within annotation parameters, including variables, loops, conditionals, and arithmetic. The framework uses a shunting-yard algorithm for expression parsing and a stack-based approach for block management. Despite its 'cursed' nature, Annote supports advanced features like recursion, state management through class-level fields, and custom exception handling via specific annotations. It serves as a humorous yet technical exploration of the limits of the Java Reflection API and the annotation system, intentionally disregarding traditional best practices in favor of metadata-driven execution.