Hacker News Reader

Until two months ago the LTS release of Java - Java 11 - was 2 years old.

Not sure what you are talking about.

Java 11 was released on 2018-09-25

Java 11.0.2 that contained the "fix" was released on 2019-01-15

Java 11.0.13 (latest) was released on 2021-10-19

Also Java 8u192 was released on 2018-10-16

I think you and parent(s) kept exchanging messages which conflated major and minor Java versions.

Java 11 as a major is not old, it’s probably the best GA version right now, 17 is at a very early adoption stage.

Openjdk 11.0.0 would be too old, though.

If it's an enterprise running a 3y old JVM, what makes you think they have a CSO, CIO, or security team?