ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Organization

Oracle

3 mentions in 7 days · 6 in 30 days · 6 total · first seen · last

Search everything

Timeline

OpenAI Launches the Agents API in Public Beta, Putting the Codex Harness Behind One API Call

OpenAI released its Agents API in public beta, exposing the managed Codex harness with hosted or self-hosted sandboxes, MCP tools, and subagents.

The Agents API is a managed service built on the open-source Codex harness, handling context compaction, tool search, programmatic tool calling, and multi-agent orchestration. Agents run in OpenAI-hosted sandboxes, self-hosted environments, or partner sandboxes from Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop, and Vercel. Data residency is US-only and Zero Data Retention is unsupported. Examples use model gpt-6-astra; vendor-reported results include SafetyKit cutting case review cost 60% and Ciridae achieving 4x lower subagent latency.

MarkTechPostupdated · 4d agofirst · 5d agoAI tools & infra 4 sources1

GPT-6 Astra: The next generation in intelligence for work

OpenAI launched GPT-6 Astra, its most capable and aligned model, in ChatGPT Work, Codex, and the API, claiming frontier performance and cybersecurity gains.

GPT-6 Astra is now available in ChatGPT Work, Codex, and the API, with OpenAI claiming state-of-the-art performance in computer use, browsing, professional work, software engineering, cybersecurity, and science. Astra is billed as the first model to reach the Critical cybersecurity capability threshold under OpenAI's Preparedness Framework, with 89% fewer unintended outcomes than GPT-5.6 Sol and 74.7% fewer than Claude Fable 5.1 on OpenAI's internal computer-use safety benchmark. Pricing starts at $10 per million input tokens and $50 per million output tokens, with claims of occupying most of the cost-efficiency frontier on Terminal Bench 4.0 and the Artificial Analysis Intelligence Index. New enterprise admin controls and plugins from Oracle Analytics, Power BI, Navan, and Avalara launched alongside the model.

OpenAI Newsupdated · 3d agofirst · 6d agoModel release 8 sources1

ZDI-26-641: Oracle VirtualBox VirtioSCSI Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI disclosed CVE-2026-71114, an out-of-bounds read in Oracle VirtualBox VirtioSCSI letting privileged local guest attackers disclose sensitive information.

The Zero Day Initiative published advisory ZDI-26-641 for an out-of-bounds read vulnerability in Oracle VirtualBox's VirtioSCSI component, assigned CVE-2026-71114 with a CVSS score of 6.1. The flaw allows local attackers to disclose sensitive information on affected installations. Exploitation requires an attacker to first obtain the ability to execute high-privileged code on the target guest system.

ZDI Published Advisories · 6d agoVulnerability 6 sourcesCVE-2026-71114

Crusoe reportedly raises $3B at a $30B valuation

AI data center developer Crusoe raised $3 billion at a $30 billion valuation, plus a $13 billion five-year GPU contract with Jane Street.

Crusoe, which builds hyperscale data centers for customers including Meta, Microsoft, OpenAI, and Oracle, raised a $3 billion round at a $30 billion valuation, Bloomberg reported. The round was co-led by Atreides Management and Valor Equity Partners with participation from Mubadala Capital. It comes 10 months after a $1.38 billion raise at a $10 billion valuation and follows a $13 billion, five-year cloud contract supplying GPUs and AI infrastructure to trading firm Jane Street. The company has met with Goldman Sachs and Morgan Stanley about a potential near-term IPO.

TechCrunch · AI · 11d agoAI industry

Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2

CISA added actively exploited Oracle flaw CVE-2026-21962 to the KEV catalog; it allows remote unauthorized access to Oracle HTTP Server and WebLogic Proxy Plug-in.

Canada's Cyber Centre updated advisory AV26-042 on Oracle's January 2026 quarterly rollup, reporting that CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on August 24, 2026. The flaw affects the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in in Oracle Fusion Middleware and may allow a remote attacker to obtain unauthorized access. A public proof of concept has been available since January 21, 2026, and fixes shipped in Oracle's January 20, 2026 advisory covering multiple products.

Canadian Centre for Cyber Security · 22d agoExploit / PoC in the wildCVE-2026-21962

Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs

Oracle's August 2026 CSPU fixes 925 CVEs across 943 patches, including 154 critical fixes; Fusion Middleware gets 262 patches.

Oracle released its August 2026 Critical Security Patch Update on August 18, addressing 925 unique CVEs with 943 security updates. 154 issues (16.3%) carry a critical severity rating. Oracle Fusion Middleware received the most patches at 262, accounting for 27.8% of the total. Oracle introduced the monthly CSPU cycle in May 2026 as an interim release between quarterly Critical Patch Updates.

Tenable Blog · 27d agoAdvisory

Related CVEs

  • CVE-2026-2196210.042%
    Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in
    CVE-2026-21962 is an improper access control flaw (CWE-284) in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in (components: the plug-in for Apache HTTP Server and the plug-in for IIS), part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can trivially exploit it, and the scope-change designation means a successful attack can significantly impact additional products beyond the plug-in itself. The attacker gains unauthorized access to critical data (potentially all accessible data) as well as the ability to create, delete, or modify critical data, reflected in the maximum CVSS 10.0 score with high confidentiality and integrity impacts and no availability impact. Organizations running the affected versions - 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 for Oracle HTTP Server and the Apache plug-in, and 12.2.1.4.0 only for the IIS plug-in - especially those with internet-facing Apache/IIS/OHS front ends proxying WebLogic applications, are exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-24, and EPSS assigns a 42% probability of exploitation within 30 days, though no public proof-of-concept is known.
    · Oracle HTTP Server (Oracle Fusion Middleware) 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 · Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 KEVlarge
  • CVE-2026-711146.0<1%
    Out-of-Bounds Read Information Disclosure in Oracle VM VirtualBox VirtioSCSI
    CVE-2026-71114 is an information disclosure vulnerability in the Core component of Oracle VM VirtualBox; the ZDI advisory characterizes it as an out-of-bounds read in the VirtioSCSI component (Oracle classifies it under CWE-284, improper access control). It is triggered by an attacker who already has a high-privileged logon on the infrastructure where VirtualBox runs, requires no user interaction, and is rated easily exploitable. Successful attacks yield unauthorized access to critical data, potentially all data accessible to VirtualBox, and the scope change means the impact can extend to additional products beyond VirtualBox itself, though integrity and availability are unaffected. Any deployment running the affected 7.2.14 release of the 7.2 branch is exposed, including desktop hosts and test lab servers where users or automation hold privileged local accounts. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.2%.
    · Oracle VM VirtualBox (Core) 7.2.14 (the only supported version listed as affected)large

Appears with

organization OpenAI 3vendor Oracle 3product Codex 2vendor OpenAI 2organization Microsoft 2product Oracle Fusion Middleware 2organization Bloomberg 1organization Blaxel 1ai model gpt-6-astra 1organization Daytona 1organization DigitalOcean 1organization E2B 1organization Goldman Sachs 1organization Jane Street 1organization Cloudflare 1organization Avalara 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.