Zaifliklar
Oracle 2026-yil oktyabr oyidagi CPU bilan 1200 dan ortiq zaiflikni tuzatdi
Deyarli 100 ta zaiflikka jiddiy (kritik) daraja berilgan va Fusion Middleware eng ko'p tuzatish olgan.
Muallif
Eduard Kovacs
| 2026-yil 22-oktyabr (ET bo'yicha 3:38)
Oracle 2026-yil oktyabr oyidagi Critical Patch Update (CPU) ni e'lon qildi. So'nggi yangilanishlar o'nlab mahsulotlar bo'yicha 1295 ta yangi tuzatishni o'z ichiga oladi.
Tenable tomonidan o'tkazilgan tahlilga ko'ra, yangi CPU 1209 ta noyob CVE ni qamrab oladi, shu jumladan 95 ta jiddiy (kritik) darajadagi zaiflik.
Tenable ma'lumotiga ko'ra, 439 ta CVE yuqori (high) daraja, 582 tasi esa o'rta (medium) daraja olgan.
Oracle Fusion Middleware eng ko'p tuzatish — 206 ta, shu jumladan 134 tasi autentifikatsiyasiz masofadan foydalanish mumkin bo'lgan zaifliklar.
Shuningdek, E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55) va Supply Chain (50) uchun ham ko'plab tuzatishlar chiqarildi.
Oracle Essbase, REST Data Services, Analytics, Systems, Database Server, Construction and Engineering, Enterprise Manager, GoldenGate, Trusted Answer Search, Utilities Applications, Secure Backup, Virtualization, Autonomous Health Framework, Financial Services Applications, Retail Applications, TimesTen In-Memory Database, Healthcare Applications, Hospitality Applications, Commerce, APEX, Application Testing Suite, Global Lifecycle Management, NoSQL Database va SQL Developer ham tuzatishlar oldi.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Oracle bu zaifliklardan birortasi ham yovuz maqsadda foydalanilayotgani haqida xabar bermagan, ammo dasturiy ta'minot giganti mijozlarga o'z mahsulotlariga qarshi hujum urinishlari haqida vaqti-vaqti bilan xabarlar olinishini eslatib o'tgan.
Chorshanba kuni, CPU e'lon qilinganidan bir kun o'tib, Oracle CVE-2026-91403 uchun alohida maslahat va xavfsizlik ogohlantirishini e'lon qildi — bu Java (va Oracle) ning eMudhra zaif kalit hodisasiga javobi.
Oracle 17-noyabr va 15-dekabrda Critical Security Patch Updates (CSPUs) ni chiqaradi. Bunday yangilanishlar har oyning uchinchi seshanba kuni chiqariladi. Keyingi CPU 2027-yil 19-yanvarga rejalashtirilgan.
Bog'liq: Google ShinyHunters'ning yangi Oracle PeopleSoft kampaniyasi haqida ogohlantirmoqda
Bog'liq: Oracle 2026-yil sentyabr oyidagi xavfsizlik yangilanishida 800 dan ortiq zaiflikni tuzatdi
Bog'liq: CISA foydalanilayotgan Oracle WebLogic zaifligi haqida ogohlantirmoqda
Yozgan: Eduard Kovacs
Eduard Kovacs (@EduardKovacs) SecurityWeek'da katta bosh muharrir. U jurnalistika sohasiga kirishdan oldin o'rta maktabda IT o'qituvchisi bo'lib ishlagan (2011-yil). Eduard sanoat informatikasi bo'yicha bakalavr va elektrotexnika sohasida kompyuter texnikasi bo'yicha magistr darajasiga ega.
Kundalik axborot byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendensiyalar va mutaxassis fikrlaridan xabardor bo'lish uchun SecurityWeek Email Byulleteniga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Eduard Kovacsdan ko'proq
- Atlassian Data Center va Server mahsulotlarida 75 ta zaiflikni tuzatdi
- Eronning Prince of Persia APT guruhi 2016-yildan beri birinchi marta AQShda C&C joylashtirdi
- Texnologiya va xavfsizlik kompaniyalari PHP2Shell zaifliklariga javob bermoqda
- Google Chrome'ni ClickFix hujumlari va ishonchsiz HTTP ulanishlariga qarshi mustahkamlamoqda
- OpenAI agentlari xavfsizlik jamoasi ogohlantirishlarini sustlashtirdi, mos kelmaslik monitorini olib tashladi
- Buzilgan dasturchi hisobi OVHcloud CLI'da stealer joylashtirish uchun ishlatildi
- Accenture, Dragos, SANS kichik AQSh kommunal xizmatlarini himoya qilish uchun 10 million dollarlik tashabbus boshladi
- Microsoft noto'g'ri AI agentlarini dinamik ruxsatlar va xavf baholash bilan nishonga olmoqda
So'nggi yangiliklar
- Sobiq Unit 8200 ofitserlari agentik SecOps startapi Mave uchun 34 million dollar yig'di
- Boshqa yangiliklarda: Tor chiqish releylari buzildi, banklar noto'g'ri AI agentlarini aniqladi, o'z-o'zini tiklaydigan macOS ransomware
- Mirai botnet operatorlari PHP2Shell hujumlariga qo'shildi, ASLR chetlab o'tish ekspluatlari paydo bo'ldi
- Xitoy APT guruhi ConnectWise hujumlarida AI pentest vositasi Artex'dan foydalanmoqda
- Hujumchilar to'rt oy ichida uchinchi Arista VCO nol kun zaifligini ekspluat qilmoqda
- Capcom ma'lumotlar buzilishidan 11 million kishi ta'sirlandi
- Quest Diagnostics ma'lumotlar buzilishi "ma'lum bemor yozuvlari"ni fosh qildi
- LiteLLM yangi ta'minot zanjiri hujumida buzildi
Trendda
Texnologiya va xavfsizlik kompaniyalari PHP2Shell zaifliklariga javob bermoqda
Xitoy APT guruhi ConnectWise hujumlarida AI pentest vositasi Artex'dan foydalanmoqda
Mirai botnet operatorlari PHP2Shell hujumlariga qo'shildi, ASLR chetlab o'tish ekspluatlari paydo bo'ldi
Boshqa yangiliklarda: Tor chiqish releylari buzildi, banklar noto'g'ri AI agentlarini aniqladi, o'z-o'zini tiklaydigan macOS ransomware
PHP2Shell tuzatishlari e'lon qilindi, birinchi ekspluatatsiya urinishlari sensorlarga yetib keldi
PHP2Shell: Ochiq muhim PHP zaifliklari uchun ommaviy ekspluatatsiya yaqinlashmoqda
Quest Diagnostics ma'lumotlar buzilishi "ma'lum bemor yozuvlari"ni fosh qildi
Signal zaifligi yovuz qo'ng'iroq qiluvchilarga qo'ng'iroqni to'xtatishni bloklashga imkon beradi
Kundalik axborot byulleteni
So'nggi tahdidlar, tendensiyalar va texnologiyalar, shuningdek, soha mutaxassislari tomonidan chuqur fikrlar haqida xabardor bo'lish uchun SecurityWeek Email Byulleteniga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Vebinar: Google Workspace'dagi AI kirish xavfi allaqachon mavjud
2026-yil 19-oktyabr
Google Workspace'ga ulangan AI vositalari millionlab nozik elektron pochta va fayllarga kirishi mumkin. Tashkilotingizning xavfini aniqlash va AI kirishini boshqarish uchun ramka o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 Summit
2026-yil 10 va 11-noyabr
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantirayotgan masalalarni ko'rib chiqish uchun birlashtiramiz.
Ro'yxatdan o'ting
Harakatdagi odamlar
Cequence Security Russ Schaferni CMO etib tayinladi.
Mona Harrington DHS'da Kiber integratsiya bo'yicha yordamchi direktor etib tayinlandi.
iCOUNTER Mark H. FitzPatrickni CFO etib tayinladi.
Harakatdagi ko'proq odamlar
Mutaxassis fikrlari
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklikdir
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashgani xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir ko'rsatadi. (Matias Madou)
Zamonaviy kiberhujumlarga qarshi kurashda kontekst qirol
Kontekstual himoya xavfsizlik jamoalariga signallarni bog'lash, keyingi qadamni oldindan ko'rish va tahdidlar kuchayishidan oldin ularni to'xtatishga yordam beradi. (Etay Maor)
AI hujum tezligini o'zgartirdi, xavfsizlik asoslarini emas
AI zaiflikni aniqlash va ekspluatatsiyani tezlashtirgan sari, "virtual tuzatish" deb ataladigan narsa hali ham chuqur himoya va kuchli ilova xavfsizligi asoslariga bog'liq. (Joshua Goldfarb)
Kelajakda katta rejalar tuzayotgan to'rtta kiber tahdid
- AI, ta'minot zanjiri ta'siri, kvant hisoblash va geosiyosiy ziddiyat xavfsizlik dasturlarini sinovdan o'tkazmoqda. Buzilishlarga tayyorgarlik kundalik operatsiyalarning bir qismiga aylanishi kerak. (Steve Durbin)
Oxiridan boshlang: Agentik tuzatishni qanday yoqish mumkin
Agentik tuzatish ishonch harakati emas. Biz tanish muammolarni tuzatish haqida gapiryapmiz, notanish xavf haqida hukm chiqarish emas. (Nadir Izrael)
Vulnerabilities
Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches.
By
Eduard Kovacs
| October 22, 2026 (3:38 AM ET)
*
Oracle has released its Critical Patch Update (CPU) for October 2026. The latest updates bring 1,295 new fixes across dozens of products.
According to an analysis conducted by Tenable, the new CPU addresses 1,209 unique CVEs, including 95 critical-severity flaws.
Tenable says 439 CVEs have been assigned a high severity rating and 582 are medium severity.
Oracle Fusion Middleware received the most fixes, 206, including 134 that can be exploited remotely without authentication.
A significant number of patches were also rolled out for E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55), and Supply Chain (50).
Oracle Essbase, REST Data Services, Analytics, Systems, Database Server, Construction and Engineering, Enterprise Manager, GoldenGate, Trusted Answer Search, Utilities Applications, Secure Backup, Virtualization, Autonomous Health Framework, Financial Services Applications, Retail Applications, TimesTen In-Memory Database, Healthcare Applications, Hospitality Applications, Commerce, APEX, Application Testing Suite, Global Lifecycle Management, NoSQL Database, and SQL Developer also received patches.
Advertisement. Scroll to continue reading.
Oracle has not flagged any of these vulnerabilities as exploited in the wild, but the software giant has reminded customers that it periodically receives reports of exploitation attempts targeting its products.
On Wednesday, one day after announcing the CPU, Oracle published a separate advisory and security alert for CVE-2026-91403, which is Java’s (and Oracle’s) response to the eMudhra weak-key incident.
Oracle will release Critical Security Patch Updates (CSPUs) on November 17 and December 15. These types of updates go out on the third Tuesday of every month. The next CPU is scheduled for January 19, 2027.
Related: Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign
Related: Oracle Patches 800+ Vulnerabilities in September 2026 Security Update
Related: CISA Warns of Exploited Oracle WebLogic Vulnerability
Written ByEduard Kovacs
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Eduard Kovacs
- Atlassian Patches 75 Flaws in Data Center and Server Products
- Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
- Tech and Security Companies Respond to PHP2Shell Vulnerabilities
- Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
- OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor
- Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
- Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities
- Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring
Latest News
- Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
- In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
- Attackers Exploit Third Arista VCO Zero-Day in Four Months
- 11 Million Impacted by Capcom Data Breach
- Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
- LiteLLM Compromised in Fresh Supply Chain Attack
Trending
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Cequence Security has appointed Russ Schafer as CMO.
Mona Harrington has been named Assistant Director for Cyber Integration at DHS.
iCOUNTER has appointed Mark H. FitzPatrick as CFO.
More People On The Move
Expert Insights
*
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)
Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.(Nadir Izrael)