Loading story…
Oracle issued a record quarterly security update with 1,449 patches across its product portfolio, while also shifting to monthly Critical Security Patch Updates for the most severe flaws. The company said the surge is tied largely to AI-assisted internal vulnerability discovery, and the release includes multiple high-risk issues such as CVE-2026-47056 and CVE-2026-60217, both rated CVSS 10.0 and described as remotely exploitable without authentication, alongside serious Oracle Database Server flaws including CVE-2026-61211 and CVE-2026-47040.
Government and industry warnings say organizations should expect a broader patch wave as AI accelerates both vulnerability discovery and attacker exploitation. Research on 1,646 open source CVEs linked to multiple patches found that remediation often spans several commits rather than a single fix, with 641 cases involving incomplete initial patches and 31.7% of multi-patch fixes taking more than a day to complete, leaving residual exposure. Security agencies are urging defenders to prioritize internet-facing and critical systems, isolate or replace unsupported technology, and verify whether follow-up or branch-specific patches are still pending instead of assuming the first published fix fully closes the risk.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
University of Texas at Dallas researchers analyzed 1,646 open source CVEs linked to more than one patch and found remediation often spans multiple commits, leaving exposure windows between initial and final fixes. The study also found existing vulnerability- and clone-detection tools often miss incomplete or multi-location fixes.
Oracle released a record-sized quarterly security update containing 1,449 patches across its product portfolio. The batch included critical issues such as CVE-2026-47056 and CVE-2026-60217, both rated CVSS 10.0.
Oracle changed its patching model by adding monthly Critical Security Patch Updates for the most critical flaws while keeping its cumulative quarterly updates. The article states this monthly program started in May 2026.
CERT.hr issued a security notice echoing the warning that AI is accelerating both vulnerability discovery and exploitation, and advised organizations to prepare for rapid large-scale patch deployment and improve cyber hygiene.
The UK National Cyber Security Centre published guidance warning that AI-accelerated vulnerability discovery could drive a surge in software patches and urging organizations to strengthen patch management and prioritize critical systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcethecybersecguru.com
Open sourcehelpnetsecurity.com
Open sourcetheregister.com
Open sourcecert.hr
Open sourcencsc.gov.uk
Open sourceopennet.me
Open sourceopennet.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 reported that AI-driven vulnerability discovery and faster attacker operationalization are outpacing traditional patch management, with high and critical vulnerability disclosures rising from 4,268 in Q2 2025 to 8,539 in Q2 2026. Newly exploited vulnerabilities also increased 8% to 40, and 25 of those were so-called **"Holy Grail"** flaws requiring neither credentials nor user interaction, underscoring how quickly attackers can capitalize on high-impact exposures. The report also linked the pressure to persistent nation-state activity from China, Russia, Iran, and North Korea, alongside continued ransomware operations by groups including **Qilin**, **The Gentlemen**, **DragonForce**, **Akira**, and **LockBit**. Health-ISAC said the problem is especially acute in healthcare, where patching delays are often built into clinical operations because updates may require vendor validation, hospital testing, scheduled downtime, change-control approval, and sometimes regulatory review. Systems such as MRI platforms can remain exposed while those processes play out, giving attackers time to exploit weaknesses that AI helps identify and weaponize faster. Both reports said organizations should move beyond monthly patch cycles and **CVSS**-only prioritization, and instead focus on reducing reachable, high-impact exposure during the window when patches cannot yet be deployed.
Aug 20, 2026
Oracle released a **Critical Security Patch Update** containing **943 patches** for **925 unique CVEs** across **23 product families**, making it one of the company’s largest recent security releases. The update includes **154 critical patches** covering **151 CVEs**, with Oracle Fusion Middleware and Oracle Hyperion each receiving **262 patches** and Oracle E-Business Suite receiving **120**. Oracle said its monthly CSPU program, introduced between quarterly Critical Patch Updates, is intended to accelerate fixes for high-severity flaws. The most severe issues affect major enterprise platforms including **Oracle Internet Directory**, **Hyperion Data Relationship Management**, **Hyperion Financial Management**, and **Oracle WebLogic Server**, with some vulnerabilities rated up to **CVSS 10.0**. Additional critical flaws were reported in **Oracle Identity Manager**, **Siebel CRM Cloud**, **Helidon**, **BI Publisher**, **WebCenter**, **Oracle Payments**, and **PeopleSoft PeopleTools**. Several of the vulnerabilities are described as **unauthenticated network-exploitable** and capable of leading to **remote code execution** or full host compromise, prompting urgent patching recommendations for exposed systems, particularly WebLogic Server and other internet-facing Oracle services.
Aug 25, 2026
Security researchers and industry commentators warned that AI is rapidly accelerating patch analysis and vulnerability discovery, making it easier to extract exploit-relevant details from public fixes before many organizations can remediate. Reporting on recent research highlighted how large language models and automated patch-diffing can identify patched executables, vulnerable functions, and likely root causes from vendor updates, while Linux-focused analysis said similar techniques can infer affected components and even help reproduce proof-of-concept conditions from public patches. Examples cited include Akamai’s **PatchDiff-AI** work on Windows updates and **K-Repro** research that reproduced dozens of `KernelCTF` vulnerabilities from patch data. The coverage said defenders are struggling with incomplete vulnerability intelligence and weak automation inputs, especially when advisories lack timely, machine-readable metadata. One example involved **CVE-2026-7473** in **Arista EOS**, which was reportedly exploited in the wild but did not appear in public CVE databases for about a month after Arista published its advisory; Arista also issued configuration-based mitigations rather than a software patch, limiting the usefulness of version-only scanners. The reports argued that organizations need stronger configuration monitoring, intrusion detection, threat hunting, and better vendor support for structured advisory formats such as **CSAF** to keep pace with AI-enabled attackers.
Aug 1, 2026