Security & Risk
88 analyses
Oracle published the largest Critical Patch Update in its history on Tuesday, with 1,449 patches and 1,235 unique CVEs. Among them is CVE-2026-35278 for PeopleSoft, used by ShinyHunters to compromise more than 100 organizations.
The Big Four firm admits to a breach between March 28 and April 12 in a third-party IT service management platform. Tax data and clients' financial information exposed. Notifications sent to four states; U.S. office offers 24 months of Experian monitoring.
Versions 7.0.2, 6.9.5, and 6.8.6, released on July 17, address the wp2shell chain: two chained CVEs that enable remote code execution without authentication on any standard installation. Public PoC available since the day of the patch.
The deal covers over 45 patents and source code, excluding revenue or clients. Falcon will now be offered natively on STACKIT, Schwarz’s platform aimed at serving the European public sector.
With a CVSS of 9.8 and mass active exploitation, CVE-2026-46817 in Oracle EBS has entered CISA's KEV catalog, giving federal agencies a 21-day deadline to apply the patch.
The July cycle marks the largest in the history of the program. CISA added three actively exploited SharePoint vulnerabilities on the same day. Triage has become the real bottleneck of the operation.
CVE-2008-4128 returns to the radar 18 years later: the administrative HTTP interface in legacy Cisco 871 routers continues to produce a large-scale exploitable CSRF chain.
Analysis by Group-IB published on July 12 details a new variant of a banking trojan. Malware activates Debugging via Accessibility and obtains shell access without a cable. Vietnam and Indonesia are the current targets.
Sysdig detected the first production scans of CVE-2026-20896 in Gitea Docker images. There are about 6,200 instances exposed to the internet, many containing CI/CD secrets within the repos.
CVE-2026-59873 allows CPU and disk exhaustion with a small tarball. The library sees 106 million weekly downloads on npm and supports a significant portion of the JavaScript build chain.
The attacker compromised jscrambler's npm account on July 11 and published five malicious versions of the tool used by 43,000 companies including Fortune 500, featuring a Rust info-stealer that captures browser credentials and Bitwarden vaults.
Progress Software cut cloud access to ShareFile's Storage Zone Controllers on July 11, impacting 86,000 customers following the disclosure of CVE-2026-2699 (CVSS 9.8) linked to CVE-2026-2701 (CVSS 9.1) which enables unauthenticated RCE.