Project Valhalla's JEP 401 will bring value classes to JDK 28, removing object identity from Java types in a 197,000-line change twelve years in the making ...
CVE-2026-48907 in the Joomla JCE plugin lets unauthenticated attackers drop PHP web shells with a single crafted request.