LIVE · cybersecurity feed
Live wire
The long tail of Clop’s PTC hack is just beginning to emergeOracle Critical Patch Update, August 2026 Security Update ReviewMedusa ransomware gang has hit over 500 organizations, CISA warnsCritical RCE flaw in Windows IKE Extension now actively exploitedOracle August 2026 Critical Security Patch Update Addresses 925 CVEsOpenAI Overhauls Safety Protocols After Its AI Agents Went RogueCVE-2026-68820 · CVE-2026-68820 is in KEV. Here Is What CISA BOD 26-04 Actually Requires NowMore than 200 victims of Medusa ransomware identified over the last year, CISA saysAttackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and SecretsHunting MacSync Stealer infrastructure through behavioral pivots
vulnerabilitycritical

Oracle Critical Patch Update, August 2026 Security Update Review

Oracle released its August edition of Critical Patch Update. The update received patches for 943 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products. In this Oracle Critical Patch Update, Oracle Fusion Middleware and Oracle

zeroday.news ·

Oracle has released its August 2026 Critical Patch Update, addressing a total of 943 security vulnerabilities across its diverse product portfolio. The update includes patches for various product families, with some vulnerabilities impacting multiple products and incorporating fixes for third-party components.

Among the patched vulnerabilities, 53 are for non-Oracle CVEs, indicating issues within open-source components integrated into Oracle product distributions. Oracle Fusion Middleware and Oracle Hyperion received the highest number of patches in this cycle, each with 262 security updates.

For Oracle Fusion Middleware, 182 vulnerabilities are remotely exploitable without requiring user credentials, and 78 CVEs are rated as critical severity. Oracle Hyperion also saw 107 vulnerabilities that can be exploited over a network without authentication, with 27 CVEs deemed critical.

Oracle E-Business Suite received 120 security patches, 27 of which are remotely exploitable without user credentials. Notably, CVE-2026-60782 and CVE-2026-70926 in E-Business Suite are rated with a critical CVSS score of 9.8, and successful exploitation could lead to remote code execution.

Oracle Commerce was updated with 66 security patches, including 47 vulnerabilities that can be exploited over a network without user credentials, and 18 critical CVEs. Oracle Siebel CRM received 50 patches, with 21 vulnerabilities remotely exploitable without credentials and 10 critical CVEs.

The database product family received 17 updates. Oracle Database Server received six new security updates, with a maximum CVSS Base Score of 9.6. These updates do not apply to client-only deployments. Oracle Autonomous Health Framework received seven new security updates, with a maximum CVSS Base Score of 8.8. Oracle Essbase received four new security updates, with a maximum CVSS Base Score of 9.8.

Other product families covered in this Critical Patch Update include Oracle Application Testing Suite, Oracle Communications, Oracle Construction and Engineering, Oracle Enterprise Manager, Oracle Financial Services Applications, Oracle Food and Beverage Applications, Oracle Analytics, Oracle Hospitality Applications, Oracle Java SE, Oracle JD Edwards, Oracle MySQL, Oracle PeopleSoft, Oracle Retail Applications, Oracle Supply Chain, and Oracle Virtualization.

Security vendors have begun releasing coverage for these updates. For instance, Qualys has issued QIDs such as 87617 for Oracle WebLogic Server, 388372 for Oracle Managed Virtualization (VM) VirtualBox, 388371 for Oracle PeopleSoft Enterprise PeopleTools, 388370 for Oracle Java Standard Edition (SE), and 20609 for Oracle Database 19c. Additional QIDs are expected to be released as part of ongoing coverage.

vulnerabilitypatch
ShareXLinkedInWhatsAppFacebook

More News

view all →
vulnerabilitycritical

The long tail of Clop’s PTC hack is just beginning to emerge

The data theft extortion group likely compromised a critical vulnerability affecting PTC’s product lifecycle management software in June, a month before it sent threatening emails to victims. The post The long tail of Clop’s PTC hack is just beginning to emerge appeared first on CyberScoop.

cloud

Simple Scans for Cloud Metadata Service, (Wed, Aug 19th)

Cloud providers typically expose a REST API at 169.254.169.254 that allows code running on virtual machines to retrieve machine-specific data. Some of the data is more or less harmless, such as the region the machine is running in or its MAC and IP addresses. However, the service may also be used to retrieve credentials for IAM roles and service account tokens.

security

Password spraying attacks surge 155x as hackers exploit MFA gaps

Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign that generated more than 81 million login attempts in two weeks. The attacks exploited legacy authentication and gaps in MFA policies that left some login flows unprotected. [...]

security

Virtual Event Today: CodeSecCon – Secure Your Code and Applications

CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained. The post Virtual Event Today: CodeSecCon – Secure Your Code and Applications appeared first on SecurityWeek.

security

Comcast gives its Wi-Fi motion detector a security makeover

Rebranded feature promises household alerts without video, but mind the small print

breach

US charges Iranians for sprawling hacking campaign on government agencies, universities

The Justice Department accused 17 alleged hackers with ties to the Iranian government of breaching email accounts at U.S. government agencies and stealing intellectual property from dozens of universities.