Project
GraalVM is a high-performance JDK and polyglot runtime from Oracle, with a JIT compiler and native-image tool for compiling Java to native binaries.
Netflix and JetBrains report that a headless IntelliJ code engine made Claude Code and Codex typically 20 to 30% more efficient, up to about 65%. Netflix wrote the daemon that keeps the index warm because JetBrains had not shipped one.
Reality
VUSec disclosed Branch Target Reuse, a Spectre-v2 attack on JIT engines whose Linux exploit leaks memory at 8 bytes a second. It bypassed every enabled mitigation, and the kernel's fix had already shipped in July.
Reality
Intel, AMD and Arm say their IBPB barrier can block Branch Target Reuse, a Spectre v2 variant hitting all three, if JIT software calls it. Each kernel, browser and runtime that rewrites JIT code now has to add that call itself.
Perspective Coverage
3 publishersReality
OpenJDK has moved JEP 544, Ahead-of-Time Code Compilation, to Proposed to Target for JDK 28, with review due to close September 28, 2026. Teams that pay for slow Java startup can pencil it into JDK 28 plans, though sizing the gain will take their own measurements.
Reality
Orkes Conductor evaluates workflow expressions on a GraalVM context with the sandbox disabled, and Fortinet blocked about 1,300 exploitation attempts against CVE-2026-58138 over two days in September.
Reality
A developer turned on GraalVM 25's Advanced Obfuscation to ship closed Quarkus service implementations inside an open Community edition. Oracle's documented carve-out, -H:Preserve, then broke the build by pulling unreachable types in.
Reality
An unauthenticated POST to the Conductor Workflow API registers a definition whose inline expression evaluates in a GraalVM context with host access enabled, and the default image runs that process as root. Empirical Security logged attempts in August.
Reality
Beta 1 arrives in September with breaking changes frozen, leaving about two months of testing before general availability, and Quarkus 3.40 LTS has community maintenance until September 2027 for teams that need longer.
Reality
The 2026.03.0 image will not boot without LOCALSTACK_AUTH_TOKEN, and the acknowledgement bypass expired on April 6. Teams pinning the archived Community build get no further security updates, and a free MIT-licensed emulator has moved into the gap.
Reality
JEP 542 is now Targeted for JDK 28, finalising the PEM API after three preview rounds. The final version drops the DEREncodable name, so preview-era code needs one mechanical edit before it compiles again.
Reality