Newcastle City Council (NCC) has swapped out Oracle Java for Azul Platform Core to address critical security vulnerabilities in its Java-based applications.

The switch has remediated more than 80% of its IT vulnerabilities overall. The council said it was able to swap out Java with no disruption to its services, and that there was no impact on performance.

The migration was brought on by changes Oracle made to Java licensing in 2019 that effectively ended free quarterly Java security updates. While Oracle OpenJDK releases are distributed freely under the open source GNU General Public License v2, the changes Oracle made has meant that organisations running the Java runtime environment (JDK) commercially require a licence.

Automatic updates are provided for at least 18 months. Last year, Gartner warned that changes to Java licensing has meant Oracle will actively target organisations, even those who do not run any Oracle products, on Java compliance. The analyst reported that in the 12-month period leading up to 31 December 2022, 52% of the Oracle software compliance and audit-related interactions focused on Oracle Java.

Newcastle City Council ran a security audit that raised concerns over the JDK, and it showed that the Java JDK accounted for more than 80% of the organisation’s IT security vulnerabilities.

The council assessed whether to migrate away from Java completely, but realised such a project would have been prohibitively expensive and could lead to unacceptable downtime. It also looked at moving to a free distribution of OpenJDK, but the council needed full support for its Java estate to ensure security and stability.

The council eventually selected the Azul Platform Core, which is an OpenJDK-based alternative to Oracle Java. According to Azul, this has provided Newcastle City Council with a one-for-one equivalent to a commercial support subscription from Oracle, including critical patch updates that enabled its IT team to deploy security fixes in production straight away.

Newcastle City Council has deployed the Azul Platform Core to over 1,000 employees with no impact on performance and no complaints from service users. The roll-out achieved the council’s business objective: a fully supported and secure Java application estate.

Azul also supports older versions of Java, which has meant Newcastle did not need to update to newer releases. “Through our strategic partnership with Azul, we significantly reduced our security risk level with our Java applications and Java-based infrastructure, which certainly helps me sleep better at night,” said Jenny Nelson, the council’s head of ICT and digital. “In addition, our Java estate is now consistent, standardised, easier to maintain and has brought a level of simplicity that’s a huge benefit to our organisation.”