InfoSecBulletin Cybersecurity for mankind
Oracle has fixed over 1,400 security holes in its July 2026 Critical Patch Update (CPU). Most of these flaws were probably found by artificial intelligence. According to Oracle, the latest quarterly CPU includes 1,449 security patches, addressing 1,434 unique CVEs across 334 products.
Vulnerabilities have been fixed in products like Database Server, APEX, Autonomous Health Framework, Essbase, Global Lifecycle Management, GoldenGate, NoSQL Database, Spatial Studio, SQL Developer, TimesTen In-Memory Database, Application Testing Suite, Commerce, Communications, Construction and Engineering, and E-Business Suite.
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
CrowdStrike’s ‘FalconFlank’ zero-day allows SYSTEM privileges
727,000 data exposes: French hospital fined €500,000
153 Million Driver’s License Surfaced on Dark Web: FBI Starts Investigation
Google Unveils Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Flaws
SonicWall SMA1000 SSRF Hits 10, Exploiting CVE-2026-83548Â
Security updates are also ready for Enterprise Manager, Financial Services Apps, Food and Beverage Apps, Fusion Middleware, Analytics, HealthCare Apps, Hospitality Apps, Java SE, JD Edwards, MySQL, PeopleSoft, Retail Apps, Siebel CRM, Supply Chain, Systems, Utilities Apps, and Virtualization.
About 600 patches fix flaws that can be attacked from far away without needing a login. Many security issues have been given a high severity rating.
The highest numbers of vulnerabilities were patched in E-Business Suite (410), Fusion Middleware (355), Communications (168), and PeopleSoft (84).
Most of the new security problems were found inside the company, probably with help from AI. Only a small number of issues were discovered by outside researchers.
Oracle said earlier this year that it can use advanced AI systems like Anthropic’s Claude Mythos and OpenAI’s best models. They are using these systems to find and fix security issues faster and better.
The company said it is using this AI-based security work on its own software and services, Oracle Health, and the open-source parts it creates and depends on.
Organizations need to apply the latest updates quickly because hackers often take advantage of weaknesses in Oracle products. For example, there was a PeopleSoft zero-day attack and a new fix for an EBS weakness.
For security teams, this July CPU is a clear signal to:
Prioritize patching of internet‑facing Oracle assets and high‑privilege application tiers.
Integrate Oracle’s monthly CSPUs and quarterly CPUs into vulnerability management SLAs.
Track AI‑discovered CVEs and map them to MITRE ATT&CK techniques to understand likely attack paths.
Use compensating controls (WAF, network segmentation, virtual patching) where immediate patching is operationally difficult.
