InfoSecBulletin Cybersecurity for mankind
Oracle has fixed over 1,400 security holes in its July 2026 Critical Patch Update (CPU). Most of these flaws were probably found by artificial intelligence. According to Oracle, the latest quarterly CPU includes 1,449 security patches, addressing 1,434 unique CVEs across 334 products.
Vulnerabilities have been fixed in products like Database Server, APEX, Autonomous Health Framework, Essbase, Global Lifecycle Management, GoldenGate, NoSQL Database, Spatial Studio, SQL Developer, TimesTen In-Memory Database, Application Testing Suite, Commerce, Communications, Construction and Engineering, and E-Business Suite.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Security updates are also ready for Enterprise Manager, Financial Services Apps, Food and Beverage Apps, Fusion Middleware, Analytics, HealthCare Apps, Hospitality Apps, Java SE, JD Edwards, MySQL, PeopleSoft, Retail Apps, Siebel CRM, Supply Chain, Systems, Utilities Apps, and Virtualization.
About 600 patches fix flaws that can be attacked from far away without needing a login. Many security issues have been given a high severity rating.
The highest numbers of vulnerabilities were patched in E-Business Suite (410), Fusion Middleware (355), Communications (168), and PeopleSoft (84).
Most of the new security problems were found inside the company, probably with help from AI. Only a small number of issues were discovered by outside researchers.
Oracle said earlier this year that it can use advanced AI systems like Anthropic’s Claude Mythos and OpenAI’s best models. They are using these systems to find and fix security issues faster and better.
The company said it is using this AI-based security work on its own software and services, Oracle Health, and the open-source parts it creates and depends on.
Organizations need to apply the latest updates quickly because hackers often take advantage of weaknesses in Oracle products. For example, there was a PeopleSoft zero-day attack and a new fix for an EBS weakness.
For security teams, this July CPU is a clear signal to:
Prioritize patching of internet‑facing Oracle assets and high‑privilege application tiers.
Integrate Oracle’s monthly CSPUs and quarterly CPUs into vulnerability management SLAs.
Track AI‑discovered CVEs and map them to MITRE ATT&CK techniques to understand likely attack paths.
Use compensating controls (WAF, network segmentation, virtual patching) where immediate patching is operationally difficult.
