Linux kernel TCP flaw CVE-2026-98432 allows remote root on MPTCP servers
Anthropic says an unreleased Claude model built a root exploit in about 53 minutes; no in-the-wild attacks are confirmed.
74
Vendor
Oracle
- Mentions · 7d15
- Mentions · 30d63
- All mentions129
- First seenAug 19, 2026
- Last mentioned17h ago
Timeline
129 articles · newest firstLinux TCP use-after-free scored 9.8; Ubuntu and RHEL unfixed
Anthropic says Claude built a remote root exploit via MPTCP, a link absent from the CVE and fix.
76
Exploitation attempts hit patched Oracle EBS flaw CVE-2026-101767
Unauthenticated SQL injection in EBS 12.2.3–12.2.15 can run commands as APPS; the fix shipped on October 20.
74
Fortinet offers FortiAIGate on Oracle Cloud for AI agent controls
The self-hosted gateway inspects prompts, MCP tool traffic, and responses, and can block or redact 35 data types.
28
Attackers probe patched Oracle EBS bug; PeopleSoft zero-day is three flaws
ShinyHunters used CVE-2026-35273 for theft and extortion; ZDI says Oracle bundled three PeopleSoft bugs under one CVE.
82
Attackers probe Oracle E-Business Suite SQL injection flaw CVE-2026-101767
Decoys recorded exploratory exploits on October 27 against the unauthenticated TCF servlet flaw, which chains SQL injection to command execution as the EBS application account.
85
Attackers scan for patched Oracle E-Business Suite flaw CVE-2026-101767
Defused saw exploratory SQL-injection exploits on decoys on October 27; Oracle has not marked the bug exploited.
74
Exploratory probes hit patched Oracle EBS RCE CVE-2026-101767
Defused saw unauthenticated SQL-injection attempts against EBS decoys on October 27; customer breaches are not confirmed.
72
Attackers probe newly patched critical Oracle EBS flaw
Defused honeypots logged exploratory exploits of CVE-2026-101767 on October 27; no other in-the-wild reports are cited.
74
Trend Micro: three Japan-focused attacks used AI to different degrees
Only one case was confirmed as agent-driven; entry often used exposed legacy systems and default or reused credentials.
72
AI-assisted intruders target Japanese firms and steal credentials
TrendAI reconstructed three infrastructures; the deepest access used exposed admin panels and stolen or default credentials.
68
ShinyHunters PeopleSoft zero-day is three flaws under CVE-2026-35273
Unauthenticated SSRF to the loopback-trusted admin hub yields code execution on PeopleTools 8.61 and 8.62.
82
ShinyHunters mass-exploits PeopleSoft SSRF-to-RCE bug CVE-2026-35273
A gateway request forgery can satisfy localhost trust checks and reach a file-write path to code execution.
84
OpenAI and Oracle to bring Oracle apps into ChatGPT
US customers can buy the OpenAI API, Codex, and ChatGPT Work through Oracle Marketplace.
55
Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
Oracle October update patches 1,295 flaws, six rated CVSS 10.0
Unauthenticated network bugs can take over E-Business Suite Workflow, SOA Suite, Access Manager, and JD Edwards Orchestrator.
72
Oracle Java flaw CVE-2026-91403 allows unauthenticated remote attacks
The CVSS 9.1 JSSE issue concerns trust in compromised eMudhra intermediate certificates, not confirmed code execution.
74
Oracle emergency Java update distrusts weak eMudhra CAs (CVE-2026-91403)
The CVSS 9.1 JSSE flaw can let an on-path attacker forge trusted hostnames; no attacks are confirmed.
76
Oracle October 2026 CPU patches 1,295 flaws across dozens of products
Tenable counts 1,209 unique CVEs, including 95 critical, and Oracle has not flagged them as exploited.
64
Oracle alerts on unauthenticated Java JSSE flaw CVE-2026-91403
The CVSS 9.1 issue affects named Java SE and GraalVM builds and can be reached through JSSE APIs without credentials.
74
Marvell, Microsoft and Oracle start OCP group for server HSMs
They want a FIPS 140-3 Level 3 module so cryptographic keys stay inside the server.
34
Oracle October 2026 CPU lists flaws across dozens of products
The October 20 notice names JD Edwards, MySQL, Java SE, WebLogic, PeopleSoft and many other lines, without CVE details.
48
Oracle October 2026 CPU fixes unauthenticated E-Business Suite takeover bug
CVE-2026-101809 scores CVSS 10.0 in Workflow Notification Mailer 12.2.3–12.2.15; three other issues rate 9.8, with no confirmed exploitation.
76
Oracle October 2026 CPU issues 1,295 patches, including CVSS 9.8 flaws
Six hundred ninety patches are remotely exploitable without authentication, spanning database, middleware, Java and applications.
72
Delphix ranks first in a 2026 data masking tool roundup
Editorial scores, not lab tests, place Informatica and K2view second and third, citing AI training data as a driver.
16
Imperva Tops 2026 Database Security Monitoring Rankings
Imperva ranks first overall with a score of 9.0 for its enforcement-capable DAM solution ahead of IBM Guardium and Aurva.
25
Oracle October 2026 CPU fixes 1209 CVEs in 1295 patches
112 updates are critical; Fusion Middleware has 206 patches, 134 remotely exploitable without authentication.
58
Oracle EBS flaw CVE-2026-101767 allows unauthenticated SQLi and RCE
Application Object Library 12.2.3 through 12.2.15 is fixed in Oracle's October 20, 2026 Critical Patch Update.
68
Linux bugs fixed per release over time: >2× rise since 2026-04
Linux 7.2 was the kernel's second-busiest release, while bugs fixed per release more than doubled since April 2026.
38
When Your Ransomware Negotiator Works for the Other Side
FBI arrested ransomware negotiator Edward Dubrovsky on extortion charges tied to ShinyHunters, which also stole FBI employee data.
82
Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month
Microsoft and partners seized CoGUI phishing-kit infrastructure tied to over 100 million malicious emails a month.
78
As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages
Microsoft dismantled YAM Store, a phishing marketplace tied to more than one billion malicious messages.
82
AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
Linux vhost flaw CVE-2026-74580 lets local users gain root and, in some setups, escape a guest to the host.
75
September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
ShinyHunters arrest number three: a Canadian ransomware negotiator
FBI arrested Canadian negotiator Edward Dubrovsky on extortion charges in its ShinyHunters crackdown, the third recent detention.
67
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
FBI arrested Canadian expert Edward Dubrovsky over alleged ShinyHunters extortion, including an FBI systems intrusion.
76
Net Closes Around ShinyHunters with Another FBI Arrest
FBI arrested Canadian executive Edward Dubrovsky, alleging he conspired with ShinyHunters after the FBIjobs.gov breach.
84
FBI Arrests Another Suspected ShinyHunters Hacker Linked to FBIJobs.gov Breach
The FBI arrested another suspected ShinyHunters member linked to the FBIJobs.gov breach of employee personal data.
73
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan
Roundup: hackers stole data on 8.8 million Danes, and Oracle confirmed a 20-million-patient health breach.
86
FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack
FBI arrested an unnamed Canadian in Pennsylvania as another ShinyHunters suspect in the jobs-portal breach.
75
Related CVEs
by mentions- CVE-2026-3527397%9.8Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
- CVE-2026-101767<1%9.8Missing authentication in Oracle E-Business Suite Application Object Library
- CVE-2026-2196273%10.0Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in
- CVE-2026-91403<1%9.1JSSE trust flaw in Oracle Java SE and GraalVM
- CVE-2021-22205100%10.0Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205)
- CVE-2019-11510100%10.0Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
- CVE-2020-14882100%9.8Remote Code Execution in Oracle WebLogic Server
- CVE-2016-308197%8.1Command injection RCE in Apache Struts Dynamic Method Invocation
- CVE-2015-5477100%7.5Remote denial of service in ISC BIND via TKEY queries
- CVE-2020-1488398%7.2High-Privilege Console Flaw in Oracle WebLogic Server Enables Full Takeover
Appears with
- ShinyHuntersthreat actor · 47
- FBIvictim · 33
- FBIorganization · 31
- PeopleSoftproduct · 23
- Oracleorganization · 22
- Microsoftvendor · 22
- Oracle PeopleSoftproduct · 20
- Oracle E-Business Suiteproduct · 18
- Googlevendor · 16
- AWS GovCloudproduct · 13
- Mandiantorganization · 11
- Accentureorganization · 10
- Zero Day Initiativeorganization · 10
- Amazonvendor · 10
- Oracle Fusion Middlewareproduct · 9
- CISAorganization · 9
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.