🟡 Medium | Source: AWS What’s New
Amazon has released quarterly security and critical updates for Amazon Corretto, its free OpenJDK distribution, covering versions 8 through 26. This release also shifts the default Docker images from Amazon Linux 2 to Amazon Linux 2023, and removes JavaFX binaries from Corretto 8. Organisations running Java workloads on AWS should apply these updates to address known security vulnerabilities in OpenJDK.
Security Architect’s Take: Prioritise updating all Corretto deployments to the latest patched versions, particularly in container environments — and validate that any Corretto 8 Docker images are rebuilt against Amazon Linux 2023 or explicitly pinned to the AL2 non-default variant if migration is not yet feasible. If your pipelines depend on JavaFX within Corretto 8, plan remediation now as binaries have been removed from this release.
Original advisory: Amazon Corretto July 2026 Quarterly Updates