Oracle shipped Java 27 on September 15, 2026, and the release is still working its way through enterprise upgrade queues as of October 15. The update packages nine JDK Enhancement Proposals (JEPs) into a single six-month release, touching memory layout, garbage collection defaults, transport security, and the diagnostic tooling developers rely on in production. None of it is flashy. All of it is the kind of change that shows up in a cloud bill three months later.
What makes Java 27 worth a second look isn’t a single headline feature. It’s that Oracle bundled a heap-size reduction, a garbage collector default change, and post-quantum transport security into one release while the rest of the developer-tools world pivots toward AI-written code. Those two stories, one about a 30-year-old language tightening its runtime and one about agents increasingly writing the code that runs on it, are colliding in the same release cycle.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Java 27: The Headline Numbers From Oracle’s September Release
Oracle’s official announcement frames Java 27 as the newest generally available version of the platform, arriving on its usual six-month cadence after Java 26. The company packaged nine JDK Enhancement Proposals into the final release, spanning final features, preview work, and incubator modules. Oracle’s own description, published alongside the release, calls it a version “featuring thousands of performance, stability, security, and productivity improvements” that “provides a strong foundation for continued Java innovation,” according to Oracle’s official announcement.
Donald Smith, Oracle’s vice president of product management for Java, put it more plainly in the company’s release post: “JDK 27 is now available!” Smith opened Oracle’s announcement by stating that “Oracle is proud to announce the general availability of JDK 27 for developers, enterprises, and end-users,” a framing that matches Oracle’s standard rollout language for prior LTS and feature releases, per the Oracle Java team’s blog post.
Java 27 is not the bleeding edge for long. JDK 28 is already circulating in early-access builds, which is normal for Oracle’s six-month train, but it means teams evaluating “the latest Java” this week need to be precise about which build they mean. For production workloads, Java 27 is the current generally available release; JDK 28 remains a preview for teams tracking what ships next spring.
Compact Object Headers: Cutting Heap From 96 Bits to 64 Bits
The most consequential change in Java 27 for anyone running a memory-constrained JVM is JEP 534, which turns on compact object headers by default. Every object on the Java heap carries a header that the JVM uses for locking, garbage collection bookkeeping, and type identification. Java 27 shrinks that header from 96 bits down to 64 bits across the board.
That sounds like a rounding error until it’s multiplied across a heap holding hundreds of millions of objects. Industry reporting on the change estimates heap usage drops by 10% to 20% once compact headers are active, with throughput gains in the 5% to 10% range on top of that, according to coverage tracked by JetBrains’ Java development team in its September 2026 Java Annotated Monthly roundup. For a team running a fleet of microservices on a fixed memory budget, a 10% to 20% heap reduction can mean running the same workload on fewer, smaller containers.
Compact object headers were not invented for Java 27. Oracle and the OpenJDK community have been testing the feature as an opt-in flag across several earlier releases. What changed in Java 27 is the default. Developers who need the old layout, for compatibility with native code or specific profiling tools, have to explicitly opt out:
# Java 27 default: compact object headers ON
java -jar app.jar
# Reverting to the pre-Java 27 96-bit header layout
java -XX:-UseCompactObjectHeaders -jar app.jarTeams running native interop libraries, custom JVMTI agents, or older profilers that assume the 96-bit layout should test against Java 27 in staging before flipping production traffic. The flag above is the rollback path if something breaks.
G1 Becomes the Default Garbage Collector for Every Configuration
Java 27 also finishes a transition Oracle has been signaling for several release cycles: G1 is now the default garbage collector across the board, including on smaller machines that previously defaulted to Serial GC. Serial GC was designed for single-core, memory-constrained environments, and for years it made sense as the default on tiny instances or containers with a single vCPU. Java 27 decides that G1’s concurrent, low-pause design is now the better default everywhere, even on small footprints.
For most teams this will be invisible. G1 has been Oracle’s flagship collector since Java 9, and most production JVMs already run it explicitly or inherit it as the default on larger instances. The practical impact lands hardest on teams running Java in genuinely small containers, think serverless functions or edge workloads, where Serial GC’s lower memory overhead was previously the point. Those teams should benchmark G1 against their old Serial GC baseline rather than assume the new default is a free upgrade.
Post-Quantum Cryptography Arrives in TLS 1.3
The security story in Java 27 centers on JEP 527, which adds post-quantum key exchange support to TLS 1.3. Oracle has been explicit that this is a strategic priority, not a checkbox feature. The company’s framing, repeated across its release materials, positions Java 27 as a release that “strengthens post-quantum cryptography and AI capabilities” at the platform level, per Oracle’s announcement.
Post-quantum key exchange matters because of the “harvest now, decrypt later” threat model: encrypted traffic captured today could theoretically be decrypted years from now once sufficiently powerful quantum computers exist. Financial institutions, healthcare systems, and government contractors with long data-retention requirements are the first adopters of post-quantum TLS, since their data needs to stay confidential for decades, not months. Java 27 giving them a supported, in-platform path to post-quantum key exchange removes one excuse for delay.
Java 27 pairs that with a smaller but genuinely useful fix: Java Flight Recorder now hides sensitive environment variables and system properties from its recordings by default. JFR has always been a favorite tool for production diagnostics because it’s low-overhead enough to run continuously, but that same continuous capture meant a stray DATABASE_PASSWORD environment variable could end up sitting in a recording file shared with a vendor or uploaded to a support ticket. Masking that data by default closes a quiet but real leak path.
Helidon 27 and JavaFX 27: The Framework Layer Catches Up
Oracle didn’t ship Java 27 in isolation. Helidon 27, the company’s cloud-native Java framework for microservices, landed alongside it, built on Java virtual threads and what Oracle describes as a fast web core for microservice workloads. Virtual threads, introduced as a finalized feature back in Java 21, let a single OS thread handle thousands of concurrent blocking operations without the memory overhead of one-thread-per-request designs. Helidon 27 leaning on virtual threads by default signals Oracle wants that model to be the obvious choice for new Java microservices, not an advanced opt-in.
JavaFX 27 shipped as the matching update for Java’s rich-client toolkit, aimed at teams still building interactive desktop applications in Java rather than migrating everything to a browser-based or Electron-style stack. JavaFX remains a smaller slice of the Java ecosystem than server-side and cloud-native workloads, but Oracle continuing to version it alongside the core platform keeps desktop Java development on a supported, current track instead of letting it stagnate on older JDKs.
Java 27 vs Java 25 vs JDK 28: What Actually Changed
Java’s six-month release train means most individual versions look incremental next to the last long-term-support release. Here’s how Java 27 stacks up against the current LTS line and the early-access build already circulating for the next version.
| Attribute | Java 25 (LTS) | Java 27 | JDK 28 (Early Access) |
|---|---|---|---|
| Release status | Long-term support | Current general availability | Early access / preview |
| Default GC on small instances | Serial GC | G1 (all configurations) | Tracking Java 27 default |
| Object header size | 96 bits (opt-in compact headers) | 64 bits by default (JEP 534) | Builds on Java 27 baseline |
| Post-quantum TLS key exchange | Not included | Added via JEP 527 | Inherits Java 27 support |
| JFR sensitive-data masking | Not included | Enabled for environment variables and system properties | Inherits Java 27 behavior |
| Companion frameworks | Earlier Helidon/JavaFX versions | Helidon 27, JavaFX 27 | Not yet finalized |
The pattern is familiar to anyone who has tracked Java’s release cadence since the switch to six-month cycles: LTS versions like Java 25 are where enterprises actually sit for years, while interim releases like Java 27 preview the features that eventually get folded into the next LTS. Teams on Java 25 don’t need to rush to Java 27 for feature parity, but the compact-headers and post-quantum work in Java 27 are strong candidates to carry forward into whichever release becomes the next LTS designation.
Why a “Boring” Java Release Still Moves Enterprise Budgets
Java remains the backbone of banking, insurance, and large-scale e-commerce systems, environments where a 10% to 20% heap reduction isn’t a nice-to-have, it’s a line item. A bank running thousands of JVM instances across a trading or settlement platform doesn’t need a new language feature to justify an upgrade; it needs a lower AWS or on-prem hosting bill. That’s the market logic behind Java 27 landing with memory and GC changes rather than syntax additions.
The post-quantum TLS support plays into a parallel compliance pressure. Financial regulators and government agencies in multiple jurisdictions have already started asking vendors about post-quantum readiness timelines, even though practical quantum decryption threats remain years away by most expert estimates. Java 27 giving enterprise Java shops an in-platform answer, rather than a third-party cryptography library bolt-on, changes the conversation in vendor security questionnaires from “we have no plan” to “we’re on JDK 27 or later.”
None of this is free. Any default change, compact headers, G1 everywhere, JFR masking, carries migration risk for teams with native interop, custom tooling, or automation that assumed the old defaults. The realistic enterprise pattern is a staged rollout: validate in staging against Java 27’s new defaults, measure the heap and throughput delta against the JetBrains-reported 10% to 20% range, then schedule production migration once the numbers hold up internally.
Java 27 and the Rest of the Server-Side Stack
Java doesn’t compete in a vacuum. Node.js, Go, and Rust each pull from a different part of the same backend-infrastructure budget, and each has its own release rhythm and risk profile relative to what Java 27 just shipped.
| Platform | Release model | Where it wins | Where Java 27 competes harder |
|---|---|---|---|
| Java 27 | Six-month cadence, LTS every few years | Enterprise legacy systems, regulated industries, large existing codebases | Memory efficiency and post-quantum TLS now close gaps with newer runtimes |
| Node.js | Roughly annual major versions | Fast-moving web backends, JavaScript-everywhere teams | Node’s single-threaded event loop still trails JVM virtual threads for heavy concurrent workloads |
| Go | Roughly twice-yearly minor releases | Lightweight microservices, infrastructure tooling, fast startup | Go’s simpler GC and smaller runtime still appeal to teams that find the JVM heavy, even post-compaction |
| Rust | Six-week release train, no formal LTS | Systems programming, performance-critical and memory-safety-sensitive code | Rust’s steeper learning curve keeps most enterprise CRUD and transaction systems on Java or Go |
The honest read is that Java 27’s changes narrow, rather than erase, the efficiency gap that newer runtimes have used as a selling point for years. A 10% to 20% heap cut doesn’t make the JVM as lean as a Go binary, but it does take some of the sting out of the “Java is memory-hungry” argument that teams evaluating a rewrite have relied on. For teams deep in the ongoing debate between memory-safe systems languages and established runtimes, Java 27 is a reminder that the incumbent keeps optimizing rather than standing still.
The AI Coding Backdrop: Where Java Fits as Agents Write More Code
Java 27 is shipping into a developer-tools landscape that looks very different from the one Java 25 landed in a year ago. AI coding agents are now a daily tool rather than a novelty for a large share of professional developers, and that shift changes what a “boring” runtime release actually means in practice.
Mathew Spolin, senior vice president of engineering at AppDirect, described how fast that shift is moving in a statement about AppDirect’s own development process: “By my estimate, within this year, pull requests won’t just be assisted by AI, they’ll be fully handled by AI, with humans focusing on planning and oversight,” Spolin said, in comments shared on LinkedIn.
That prediction matters for Java specifically because so much enterprise Java code is exactly the kind of repetitive, pattern-heavy work AI agents are best at: CRUD endpoints, data access layers, boilerplate configuration. If agents increasingly write the Java that runs on Java 27, the runtime’s own behavior, its default garbage collector, its memory layout, its security defaults, becomes more important, not less, because fewer humans are reading every line before it ships. A platform that’s leaner and more secure by default is a better foundation for a world where more code gets written faster and reviewed less line-by-line. Separate industry survey data has already found that developers now spend a majority of their week reviewing AI-written code rather than writing it from scratch, which makes runtime-level defaults like Java 27’s changes a bigger lever than any single IDE feature.
That same dynamic is playing out across the editor layer. Teams comparing AI-assisted coding environments like Cursor against traditional VS Code workflows are increasingly running those agents against large, existing Java codebases rather than greenfield projects, which raises the stakes on runtime defaults behaving predictably. Likewise, the push toward routing different coding tasks to different AI models, visible in VS Code’s recent multi-tier AI routing preview, reflects the same underlying trend Spolin describes: more of the code, less of the manual review. Market-share data on which AI coding tools are actually winning that work, tracked in a recent breakdown of Claude Code, Codex, and GitHub Copilot adoption, shows just how much of the Java ecosystem’s future code volume is already touched by one of these agents before a human ever opens a pull request.
Historical Context: Eight Years of the Six-Month Release Train
Java’s move to a predictable six-month release cadence dates back to Java 10 in 2018, replacing a model where major versions could take years to ship and often slipped their own deadlines. That change was controversial at the time among developers used to Java’s old, slower rhythm, but it’s the reason Java 27 exists as a numbered, dated release rather than an indefinitely delayed “Java 2.”
Oracle layers long-term support designations on top of that cadence roughly every few releases, which is why enterprises talk about being “on Java 17” or “on Java 21” rather than tracking every six-month release. Java 27 sits in the interim-release category: it’s where Oracle tests changes like compact object headers and the G1-everywhere default in production-grade code before they potentially become permanent fixtures of whatever version earns the next LTS label. That pattern, of interim releases functioning as a proving ground for features bound for the next LTS, has defined the last eight years of Java’s evolution and is exactly the lens through which Java 27 should be read.
What Enterprise Java Teams Should Do Before Migrating
For teams deciding whether to move onto Java 27 now or wait, the calculus mostly comes down to whether the new defaults help or hurt a specific workload. The compact object header and G1-everywhere changes are the two most likely to cause an unexpected production surprise, since both alter long-standing runtime assumptions rather than adding something purely opt-in.
- Run a staging benchmark comparing heap usage and throughput on Java 27 against your current version before scheduling a production migration.
- Audit any native interop code, custom JVMTI agents, or legacy profiling tools for compatibility with the new 64-bit compact object header layout.
- If running on small instances or edge containers that previously used Serial GC, benchmark G1’s memory footprint specifically on that hardware profile rather than assuming parity.
- Review any automated tooling that scrapes Java Flight Recorder output for environment variables or system properties, since those values are now masked by default.
- Start tracking post-quantum TLS readiness requirements from regulators or enterprise customers now, since Java 27’s JEP 527 support gives compliance teams a concrete platform answer.
What’s Next: Predictions for Java’s Next Few Releases
A few trends look likely to continue based on how Java 27 shipped and what’s already visible in JDK 28’s early-access builds.
- Compact object headers and the G1-everywhere default will likely graduate into whichever release becomes the next LTS, making the Java 27 changes a preview of the baseline most enterprises eventually inherit.
- Post-quantum cryptography support will expand beyond TLS 1.3 key exchange into other parts of the Java security stack as regulatory pressure around quantum-readiness timelines builds in finance and government sectors.
- Oracle will keep pairing core JDK releases with matching Helidon and JavaFX versions, reinforcing virtual threads as the default concurrency model for new Java microservices rather than an advanced-user feature.
- Expect more JFR-style “secure by default” changes in future releases, as AI-assisted and AI-generated code increases the volume of code shipped with less manual security review.
- JDK 28, currently in early access, will likely finalize incremental refinements to the compact-header and GC work rather than introducing another major default change, consistent with Java’s pattern of iterating before the next LTS lock-in.
Frequently Asked Questions
When was Java 27 released?
Oracle released Java 27 on September 15, 2026, following the platform’s standard six-month release cadence.
Is Java 27 a long-term support (LTS) release?
No. Java 27 is a current general-availability feature release, not one of Oracle’s designated LTS versions. Enterprises running LTS versions like Java 25 aren’t required to move to Java 27 immediately.
What is the biggest change in Java 27?
The two changes most likely to affect production systems are JEP 534, which enables compact object headers by default and shrinks object headers from 96 bits to 64 bits, and the switch to G1 as the default garbage collector on all configurations, including small instances that previously used Serial GC.
How much memory does Java 27 actually save?
Reporting on the compact object header change estimates heap usage drops by 10% to 20%, with throughput gains of 5% to 10%, though actual results vary by workload and object allocation patterns.
Does Java 27 support post-quantum cryptography?
Yes. JEP 527 adds post-quantum key exchange support to TLS 1.3 in Java 27, giving enterprise Java applications an in-platform path toward post-quantum readiness without relying on third-party cryptography libraries.
What is JDK 28 and is it available yet?
JDK 28 is the next version in Java’s six-month release train and is currently available only as an early-access build, meaning it’s intended for testing and feedback rather than production use.
Should I upgrade to Java 27 right away?
Teams should benchmark Java 27’s new defaults, particularly compact object headers and G1-everywhere, against their current workload in staging before migrating production systems, since both changes alter long-standing runtime assumptions.
What else shipped alongside Java 27?
Oracle released Helidon 27, a cloud-native Java framework built on virtual threads, and JavaFX 27, the matching update for Java’s rich-client desktop toolkit, both timed to the core Java 27 release.
