Last november Roadmap Update covers different topics such as the fact that GlassFish remains open source, that there won't be a commercial version of GlassFish 4. But an other important topic addressed in that announcement is the fact that Oracle continues to commercially support GlassFish v3 for the years to come. In fact, the now old Sun Java System Applications Server 8, who predated GlassFish, is still commercially supported too!
So on the commercial support front, it is business as usual. Oracle has just released Oracle GlassFish Server Bundle Patches 220.127.116.11, Sun Java System Application Server 8.1.36 and 8.2.20. Customers with a valid support contract can get those different updates on My Oracle Support. This GlassFish 4 Business entry has all the details including the different Patch ID's, the addressed issues, etc.