InfoSecBulletin Cybersecurity for mankind
Oracle released 337 security patches for more than 30 products in its January 2026 Critical Patch Update (CPU), targeting approximately 230 unique CVEs. Several patches fix CVE-2025-66516 (CVSS score 10/10), a serious Apache Tika vulnerability that may allow XML External Entity (XXE) injection.
The vulnerability affects three Apache Tika modules and can be exploited by embedding specially designed XFA files in PDF documents.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Oracle products patched for the issue include Commerce, Communications, Construction and Engineering, Fusion Middleware, and PeopleSoft.
Oracle Communications had the most security fixes, totaling 56. Among these, 34 address vulnerabilities that remote, unauthenticated attackers could exploit. Fusion Middleware has 51 new security patches, 47 of which fix vulnerabilities that can be accessed remotely without authentication.
Financial Services Applications received 38 new fixes, with 33 for unauthenticated remote issues, while MySQL had 20 patches, including 7 for flaws exploitable by remote, unauthenticated attackers.
In October 2023, Siebel CRM, Retail Applications, and Virtualization each got 14 security patches. However, the number of remotely exploitable issues without authentication varies: 11 for Siebel CRM, 10 for Retail Applications, and 1 for Virtualization.
12 patches were released for Hyperion, addressing 10 remote vulnerabilities. PeopleSoft also received 12 patches, with 10 for security. Java SE had 11 patches, all for security issues, while Supply Chain had 10 patches, with 8 for vulnerabilities.
Over two dozen Oracle products received fewer than 10 new security fixes. The following are their counts: Construction and Engineering (8 total – 7 new), Analytics (8 total – 6 new), E-Business Suite (8 total – 2 new), Commerce (7 total – 6 new), JD Edwards (7 total – 5 new), Database Server (7 total – 2 new), HealthCare Applications (6 total – 6 new), Utilities Applications (5 total – 4 new), GoldenGate (5 total – 3 new), and Health Sciences Applications (5 total – 3 new).
Several updated products received fixes for flaws and non-exploitable bugs. Oracle also patched non-exploitable third-party CVEs for some products.
On Tuesday, Oracle announced 14 new security patches for the Oracle Solaris Operating System, with 11 addressing remotely exploitable bugs that don’t require authentication.
