InfoSecBulletin Cybersecurity for mankind
Oracle’s July 2025 Critical Patch Update includes 309 new security patches, with 127 addressing remotely exploitable vulnerabilities. SecurityWeek found about 200 unique CVEs in Oracle’s July 2025 CPU, with nine patches for critical flaws.
In October, Oracle Communications issued 84 security patches, the highest this month, similar to April. Out of these, 50 fix remotely exploitable defects without authentication. None are critical, but 51 are high severity.
UK to ban public sector from paying ransomware gangs
(CVE-2025-6704, CVE-2025-7624)
Urgent Sophos Firewall Update: Two Critical RCE Flaws Patched
Dell admits breach of test lab platform by World Leaks extortion group
Microsoft issues urgent patches for SharePoint RCE vulnerabilities
HPE alerts of hardcoded passwords in Aruba access points
Akira Ransomware Allegedly Compromise 12 Companies in 72 Hours
Singapore urgently engage military force to tackle ‘serious’ cyberattack
Hackers infect 10M Androids with BADBOX 2.0
Oracle Patched 200 Vulns With July 2025 CPU
Ivanti Zero-Days Exploited to Drop MDifyLoader
Oracle has been fixing many bugs in MySQL, with 40 security patches including 3 for serious remote vulnerabilities. They’ve also addressed 36 in Fusion Middleware and 29 in Communications Applications.
Financial Services Applications: 18 security patches (13 remotely exploitable). Java SE: 11 patches (10 remotely exploitable). Retail Applications: 11 patches (8 remotely exploitable). E-Business Suite: 9 patches (3 remotely exploitable). Supply Chain: 8 patches (all remotely exploitable).
Oracle issued fewer patches this time. For PeopleSoft, there were 7 patches (3 for vulnerabilities exploitated by remote, unauthenticated attackers). Other products received the following: Virtualization (7 – 0), Siebel CRM (6 – 5), Utilities Applications (6 – 5), Database Server (6 – 0), GoldenGate (5 – 2), Analytics (5 – 2), Hyperion (4 – 1), HealthCare Applications (3 – 2), Insurance Applications (3 – 2), Construction and Engineering (2 – 0), and JD Edwards (2 – 0).
Application Express, Blockchain Platform, NoSQL Database, REST Data Services, Commerce, Enterprise Manager, and Hospitality Applications each received a patch.
Oracle’s advisory states that some products didn’t get security patches but did receive fixes for non-exploitable third-party CVEs. Other products received security updates for additional flaws and non-exploitable CVEs.
Customers must quickly apply the patches, as threat actors exploit unpatched Oracle vulnerabilities.
On Tuesday, Oracle released 20 new security patches in the July 2025 Solaris Third Party Bulletin, including 12 for vulnerabilities that can be exploited remotely without authentication.
