InfoSecBulletin Cybersecurity for mankind
Oracle released 337 security patches for more than 30 products in its January 2026 Critical Patch Update (CPU), targeting approximately 230 unique CVEs. Several patches fix CVE-2025-66516 (CVSS score 10/10), a serious Apache Tika vulnerability that may allow XML External Entity (XXE) injection.
The vulnerability affects three Apache Tika modules and can be exploited by embedding specially designed XFA files in PDF documents.
LastPass says hackers stole customer data via Klue, supply chain breach
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
Oracle products patched for the issue include Commerce, Communications, Construction and Engineering, Fusion Middleware, and PeopleSoft.
Oracle Communications had the most security fixes, totaling 56. Among these, 34 address vulnerabilities that remote, unauthenticated attackers could exploit. Fusion Middleware has 51 new security patches, 47 of which fix vulnerabilities that can be accessed remotely without authentication.
Financial Services Applications received 38 new fixes, with 33 for unauthenticated remote issues, while MySQL had 20 patches, including 7 for flaws exploitable by remote, unauthenticated attackers.
In October 2023, Siebel CRM, Retail Applications, and Virtualization each got 14 security patches. However, the number of remotely exploitable issues without authentication varies: 11 for Siebel CRM, 10 for Retail Applications, and 1 for Virtualization.
12 patches were released for Hyperion, addressing 10 remote vulnerabilities. PeopleSoft also received 12 patches, with 10 for security. Java SE had 11 patches, all for security issues, while Supply Chain had 10 patches, with 8 for vulnerabilities.
Over two dozen Oracle products received fewer than 10 new security fixes. The following are their counts: Construction and Engineering (8 total – 7 new), Analytics (8 total – 6 new), E-Business Suite (8 total – 2 new), Commerce (7 total – 6 new), JD Edwards (7 total – 5 new), Database Server (7 total – 2 new), HealthCare Applications (6 total – 6 new), Utilities Applications (5 total – 4 new), GoldenGate (5 total – 3 new), and Health Sciences Applications (5 total – 3 new).
Several updated products received fixes for flaws and non-exploitable bugs. Oracle also patched non-exploitable third-party CVEs for some products.
On Tuesday, Oracle announced 14 new security patches for the Oracle Solaris Operating System, with 11 addressing remotely exploitable bugs that don’t require authentication.
