Oracle made Java 27 available on September 15, 2026, adding hybrid post-quantum key exchange for TLS 1.3 alongside eight other featured JDK enhancements. The company also announced Helidon 27 and JavaFX 27 updates, added Oracle Jipher 20 to the Java Verified Portfolio, and highlighted JDK 28 early access as a preview of Project Valhalla.
The security centerpiece, JEP 527, is intended to help protect sensitive data and business-critical communications against “harvest now, decrypt later” threats while limiting disruption to applications. Oracle said Java 27 also includes the third preview of PEM encodings for cryptographic objects and JFR in-process data redaction, which is designed to reduce the exposure of sensitive information during production troubleshooting. Oracle described the release as a major post-quantum cryptography milestone and said it is working toward comparable capabilities in JDK releases for which it offers long-term support.
Other featured proposals address AI, data processing and application modernization. The 12th incubator version of the Vector API targets analytics, AI inference, scientific computing and media workloads without requiring specialized native code. The seventh preview of structured concurrency is intended to improve reliability, cancellation, error handling and observability in multithreaded programs, while further previews cover primitive types in patterns and lazy constants. Oracle said compact object headers, now enabled by default, can reduce JVM memory overhead, and Java 27 makes G1 the default garbage collector in all environments.
Oracle is also using JDK 28 early access to show the first major release phase of Project Valhalla. The project seeks to narrow the distinction between Java objects and primitives, beginning with value classes and objects, with the stated goal of denser and more efficient data representation. Separately, Project Leyden is advancing work on startup time, time to peak performance and memory use, including ahead-of-time compilation. Oracle’s future-product disclaimer says the development, release, timing and pricing of described functionality may change at the company’s sole discretion.
The wider ecosystem update includes Helidon 27, an open-source framework for lightweight microservices whose numbering and release cadence now align with OpenJDK. Its additions include modules for gRPC and messaging, connector-neutral messaging support for systems including Kafka and JMS, and a lightweight JDBC data-access approach. JavaFX 27 adds a metal rendering pipeline on macOS, richer text-editing controls and continued accessibility enhancements for Java client applications.
Oracle Jipher 20, now included in the Java Verified Portfolio, wraps a FIPS 140-3 validated OpenSSL cryptographic module for Java applications. Oracle said the release supports newer JDK versions, the ML-KEM and ML-DSA post-quantum algorithms, KDF and HKDF through standard Java APIs, and FFM-based OpenSSL integration from JDK 25 onward. Oracle Cloud Infrastructure is the first cloud provider to support Oracle JDK 27, according to the company.