Oracle released its October 2026 Critical Patch Update on October 20, the final quarterly update of the year. It delivers 1,295 security patches for 1,209 unique CVEs across 33 product families (tenable.com). The patch count is higher than the CVE count because one CVE can appear in several product matrices (gbhackers.com). 112 patches (8…
On September 15, 2026, Oracle released its Critical Security Patch Update (CSPU) for September 2026, with 673 security updates covering 672 unique CVEs across 17 product families. Of these, 104 issues (15.5%) are rated critical, 503 high, 59 medium and 7 low. Oracle E-Business Suite received the most patches (159, 23.6%), followed by Orac…
Microsoft's October 2026 Patch Tuesday addresses 1,407 CVEs across 301 products and components, the largest release on record for the second consecutive month. 69 are rated critical, 1,337 important and 1 low. Two zero-days are fixed: CVE-2026-96951, a Windows Shell security feature bypass exploited in the wild, and CVE-2026-108398, a .NE…
Tenable's Cybersecurity Awareness Month blog summarizes government guidance on defending critical infrastructure against nation-state and AI-assisted attacks. Per a joint US government advisory (published in April, updated in July), Iran-affiliated APT groups have attacked US water, energy and government facilities since Operation Epic Fu…
Microsoft released updates fixing more than 1,400 vulnerabilities in Windows and other software, far above September's record of nearly 1,000 fixes. Only one flaw is a confirmed zero-day exploited in the wild: CVE-2026-96951, a security feature bypass in Windows Shell affecting Windows 10, Windows 11 and some Windows Server versions. At l…