Oracle released 337 security patches for more than 30 products in its January 2026 Critical Patch Update (CPU), targeting approximately 230 unique CVEs. Several patches fix CVE-2025-66516 (CVSS score 10/10), a serious Apache Tika vulnerability that may allow XML External Entity (XXE) injection. The vulnerability affects three Apache Tika modules …

A critical command injection flaw in Node Multimedia Routers (MMRs) may let meeting participants run arbitrary code on vulnerable systems. CVE-2026-22844 is a highly critical vulnerability with a CVSS score of 9.9, indicating an urgent need for immediate action. Zoom Command Injection Vulnerability: A command injection flaw is found in …

Recent research shows that AI systems can now handle complex exploit development tasks that used to need specialized human skills. The agents had to create exploits while facing realistic challenges like modern security measures, unknown heap conditions, and restrictions on hardcoded memory addresses. In six scenarios focused on tasks like spawning …