InfoSecBulletin Cybersecurity for mankind
Oracle’s July 2025 Critical Patch Update includes 309 new security patches, with 127 addressing remotely exploitable vulnerabilities. SecurityWeek found about 200 unique CVEs in Oracle’s July 2025 CPU, with nine patches for critical flaws.
In October, Oracle Communications issued 84 security patches, the highest this month, similar to April. Out of these, 50 fix remotely exploitable defects without authentication. None are critical, but 51 are high severity.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Oracle has been fixing many bugs in MySQL, with 40 security patches including 3 for serious remote vulnerabilities. They’ve also addressed 36 in Fusion Middleware and 29 in Communications Applications.
Financial Services Applications: 18 security patches (13 remotely exploitable). Java SE: 11 patches (10 remotely exploitable). Retail Applications: 11 patches (8 remotely exploitable). E-Business Suite: 9 patches (3 remotely exploitable). Supply Chain: 8 patches (all remotely exploitable).
Oracle issued fewer patches this time. For PeopleSoft, there were 7 patches (3 for vulnerabilities exploitated by remote, unauthenticated attackers). Other products received the following: Virtualization (7 – 0), Siebel CRM (6 – 5), Utilities Applications (6 – 5), Database Server (6 – 0), GoldenGate (5 – 2), Analytics (5 – 2), Hyperion (4 – 1), HealthCare Applications (3 – 2), Insurance Applications (3 – 2), Construction and Engineering (2 – 0), and JD Edwards (2 – 0).
Application Express, Blockchain Platform, NoSQL Database, REST Data Services, Commerce, Enterprise Manager, and Hospitality Applications each received a patch.
Oracle’s advisory states that some products didn’t get security patches but did receive fixes for non-exploitable third-party CVEs. Other products received security updates for additional flaws and non-exploitable CVEs.
Customers must quickly apply the patches, as threat actors exploit unpatched Oracle vulnerabilities.
On Tuesday, Oracle released 20 new security patches in the July 2025 Solaris Third Party Bulletin, including 12 for vulnerabilities that can be exploited remotely without authentication.
