Infra2026-09-16 · source-backed

Java 27 makes G1 the default GC everywhere and adds post-quantum TLS 1.3 key exchange.

Issue

2026-09-16

Confidence

source-backed

Sources

Redaction

redacted

Story

GA landed September 15 with nine JEPs. Two change behavior with no flag: JEP 523 (G1 default in all environments) and JEP 534 (compact object headers on by default). JEP 527 adds post-quantum hybrid key exchange to TLS 1.3, JEP 536 adds in-process data redaction to JFR. Structured Concurrency is in its seventh preview, the Vector API its twelfth incubator round.

Source trail

GA landed September 15 More from mail.openjdk.org

Entities

Java JEP JEPs JFR ORGGLMN75HFEWP7YL3ZLGHLYHVIBJDYT September Structured Concurrency TLS Vector API

Provenance

Canonical issue: Ramsay Research Agent — September 16, 2026
AI generated: no
Story unit: 2026-09-16-java-27-makes-g1-the-default-gc-everywhere-and-adds-post-quantum-tls-1-3-key-exchange
Labels: source-backed, canonical briefing excerpt

Fetching from the wire…

Java 27 makes G1 the default GC everywhere and adds post-quantum TLS 1.3 key exchange.

Story

Related stories

gap-trap's "Proven Red" gate runs every new test against the old code and fails when it passes.

ADK for Go 2.4.0 pins fetched A2A agent cards to their origin and finally puts auth on the REST API.

Google ADK dev UI has a perfect 10.0 unauthenticated RCE

Codex routes agent secrets through a proxy, not a shell

Klepton runs Android ARM64 VR APKs on Vision Pro by relinking `.so` files into `.dylib`s.

llama.cpp deletes precompiled headers entirely, two days after the heap corruption they caused.

Source trail

Entities

Provenance

Java 27 makes G1 the default GC everywhere and adds post-quantum TLS 1.3 key exchange.

Story

Related stories

gap-trap's "Proven Red" gate runs every new test against the old code and fails when it passes.

ADK for Go 2.4.0 pins fetched A2A agent cards to their origin and finally puts auth on the REST API.

Google ADK dev UI has a perfect 10.0 unauthenticated RCE

Codex routes agent secrets through a proxy, not a shell

Klepton runs Android ARM64 VR APKs on Vision Pro by relinking `.so` files into `.dylib`s.

llama.cpp deletes precompiled headers entirely, two days after the heap corruption they caused.

Source trail

Entities

Provenance

Story

Related stories

gap-trap's "Proven Red" gate runs every new test against the old code and fails when it passes.

ADK for Go 2.4.0 pins fetched A2A agent cards to their origin and finally puts auth on the REST API.

Google ADK dev UI has a perfect 10.0 unauthenticated RCE

Codex routes agent secrets through a proxy, not a shell

Klepton runs Android ARM64 VR APKs on Vision Pro by relinking `.so` files into `.dylib`s.

llama.cpp deletes precompiled headers entirely, two days after the heap corruption they caused.

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance

Story

Related stories

gap-trap's "Proven Red" gate runs every new test against the old code and fails when it passes.

ADK for Go 2.4.0 pins fetched A2A agent cards to their origin and finally puts auth on the REST API.

Google ADK dev UI has a perfect 10.0 unauthenticated RCE

Codex routes agent secrets through a proxy, not a shell

Klepton runs Android ARM64 VR APKs on Vision Pro by relinking `.so` files into `.dylib`s.

llama.cpp deletes precompiled headers entirely, two days after the heap corruption they caused.

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance