Aggregator

In the first purported "near-autonomous" attack on a nation-state, a Chinese-language operator used a complex AI framework to target and compromise government agencies, likely in Taiwan.

Oracle addresses 925 CVEs in its August 2026 Critical Security Patch Update with 943 patches, including 154 critical updates.

Key Takeaways

1. The August 2026 Critical Security Patch Update (CSPU) contains fixes for 925 unique CVEs in 943 security updates
2. 154 issues (16.3% of all patches) were assigned a critical severity rating
3. Oracle Fusion Middleware received the highest number of patches at 262, accounting for 27.8% of all patches

Background

On August 18, Oracle released its Critical Security Patch Update (CSPU) for August 2026. Beginning in May 2026, Oracle introduced CSPUs as a monthly release cycle that sits between the larger quarterly Critical Patch Updates (CPUs), addressing a focused set of high-severity issues on a faster cadence. This CSPU contains fixes for 925 unique CVEs in 943 security updates across 23 Oracle product families, a nearly fourfold increase in patch volume compared to the June 2026 CSPU, which addressed 243 CVEs in 245 patches across 11 product families.

To put that in context against the quarterly CPUs: the April 2026 CPU contained 481 patches across 241 CVEs, and the July 2026 CPU, the largest CPU release of 2026, contained 1,449 patches across 1,235 CVEs. August's CSPU at 943 patches sits well above the April CPU and represents roughly 65% of July's quarterly volume, a striking figure for what is nominally a targeted between-cycle release. The expansion to 23 product families (up from 11 in June) further blurs the line between CSPU and CPU in terms of scope.

Out of the 943 security updates published, 16.3% of patches were assigned a critical severity. High severity patches accounted for the bulk of security patches at 59%, followed by medium severity patches at 21%.

This month's update includes 154 critical patches across 151 CVEs.

SeverityIssues PatchedCVEsCritical154151High556541Medium198198Low3535Total943925Analysis

This month's update saw the Oracle Fusion Middleware product family contain the highest number of patches at 262, accounting for 27.8% of the total patches, followed by Oracle Hyperion at 262 patches, which accounted for 27.8% of the total patches.

A full breakdown of the patches for this CSPU can be seen in the following table, which also includes a count of vulnerabilities that can be exploited over a network without authentication.

Oracle Product FamilyNumber of PatchesRemote Exploit without AuthOracle Fusion Middleware262182Oracle Hyperion262107Oracle E-Business Suite12027Oracle Commerce6647Oracle Siebel CRM5021Oracle Supply Chain4618Oracle Virtualization212Oracle Analytics163Oracle PeopleSoft157Oracle Communications139Oracle Enterprise Manager116Oracle MySQL95Oracle Financial Services Applications86Oracle Autonomous Health Framework72Oracle Application Testing Suite73Oracle Database Server64Oracle JD Edwards62Oracle Java SE54Oracle Retail Applications55Oracle Essbase43Oracle Food and Beverage Applications22Oracle Construction and Engineering11Oracle Hospitality Applications11Solution

Patches for all affected products are available in the August 2026 advisory.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they're released. This link uses a search filter so that all matching plugin coverage appears as it is released.

Get more information

• Oracle Critical Security Patch Update Advisory - August 2026
• Oracle August 2026 Critical Security Patch Update Risk Matrices
• Oracle Advisory to CVE Map

Join Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

传 OpenAI 透露第二季度营收规模；百度李彦宏：目标让文心回到第一梯队；哈浮发布 「飞行口袋云台相机」。

複数のマイクロソフト製品には、脆弱性があります。マイクロソフトによると、今回修正された一部の脆弱性を悪用する攻撃を確認しているとのことです。この問題は、Microsoft Updateなどを用いて、更新プログラムを適用することで解決します。詳細は、開発者が提供する情報を参照してください。

本期周报简介： 1、国产大模型阿图因在CyberGym安全测试中超越Mythos，金融行业能否落地应用？ 2、跨网数据流动安全监控有哪些成熟的商业化方案？加密流量如何监测？

网络不直连，数据可交换；交换有策略，过程可审计。

2026年08月18日（現地時間）、米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。

第六届开源情报技术大会拟于2026年11月14日-15日在贵阳市贵州警察学院召开。

两起事件都因“重述革命历史/红色叙事”触线被全链条追责，但处理路径差异明显。

2026 年 7 月 26–27 日，疑似伊朗关联的黑客组织对美国供水/废水系统发动国家级协调攻击，迄今波及至少 12 个州、超过 100 个市镇，仅明尼苏达州就有 30+ 个社区供水系统遭定向攻击。 攻击者利用暴露在公网的 Rockwell MicroLogix PLC、出厂默认口令及已知认证绕过漏洞 CVE-2021-22681，远程锁死设备、篡改配置、禁用安全逻辑并回传虚假读数，使运营方"失去查看与控制能力"。 事件未窃取数据、未索要赎金、未污染水质。FBI 尚未正式认定幕后黑手，但 CyberAv3ngers 与 APT Iran 已在 Telegram 自称负责（未经美方证实）。 安全启示： 这次攻击靠的并非高精尖武器，而是默认口令、暴露的 OT 端口和 5 年未补的旧漏洞——其核心是不间断的基础设施安全欠账被一次性追讨。 它警示所有依赖控制系统运转的机构：OT/ICS 一旦联网即是攻击面，应关闭暴露在公网的控制端口、清除默认口令并为 OT 资产建立补丁与已知漏洞（KEV）优先清单。 国家级黑客的意图正从"窃取"转向"让系统失信"，把防御当成与供水一样不可中断的公共服务来建设，才是正解。

ChatGPT Ads is expanding to 31 European markets. Learn how advertisers can reach people as they explore, compare options, and make decisions.

Рассказываем о базовых шагах, которые помогут распознать слежку.

A lack of technical details could make it hard for organizations running self-managed GitLab versions to detect potential exploitation of CVE-2026-19478.

OpenAI has temporarily slowed the development and scaling of its frontier AI models after determining that its existing monitoring, alignment, and security measures needed to be strengthened as models become increasingly capable of conducting cybersecurity tasks. The company said it deliberately reduced the pace of scaling while it worked to ensure that its safeguards could …

The post OpenAI slows model development over concerns about cyber capabilities appeared first on CyberInsider.

Researchers discovered a "meta-hacking" technique that can manipulate the AI service into revealing its own security weaknesses.

The superseding indictment adds defendants and allegations against the Iranian firm accused of a massive cybertheft campaign against foreign universities and others.

The post Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute appeared first on CyberScoop.

Submit #878241 / VDB-391951

Submit #878227 / VDB-391950

Submit #878218 / VDB-391949

Rich Mogull, chief analyst with the Cloud Security Alliance, joins the Dark Reading News Desk with what defenders need to take away from AI agents escaping their environments to launch attacks.