Highlights

• Oracle’s July 2026 CPU ships 1,455 new security patches, the largest Critical Patch Update Oracle has issued to date.
• The highest score this quarter is a perfect CVSS 10.0, affecting Oracle Access Manager, WebLogic Server and Oracle Coherence within Fusion Middleware.
• PeopleSoft is the emergency priority. CVE-2026-35278 and CVE-2026-35273 (both CVSS 9.8) are under active exploitation by the ShinyHunters extortion group, which claims to have compromised more than 300 PeopleSoft servers across 100+ organizations since late May 2026.
• Fusion Middleware receives 359 patches (224 remotely exploitable without authentication), the largest single-family total in this CPU. WebLogic, Identity Manager and WebCenter Capture each carry CVSS 9.9 unauthenticated RCE flaws.
• E-Business Suite receives 416 patches (63 remotely exploitable), reflecting sustained attacker interest after the 2025 Cl0p campaign and a separately exploited flaw patched last month.
• Java SE ships 20 patches (18 remotely exploitable) with a comparatively modest maximum CVSS of 7.8, mostly affecting availability rather than confidentiality or integrity.
• Action: patch internet-facing PeopleSoft, Fusion Middleware (WebLogic, Identity Manager, Access Manager) and E-Business Suite this week. Treat the Database Server 9.9 flaw as high priority even though it is not yet reported under active exploitation.

Commentary

The Oracle Critical Patch Update (CPU) for July 2026 contains 1,455 new security patches spanning more than two dozen product families, making it the largest quarterly release Oracle has published. The update is cumulative, meaning it folds in the May 28 and June 16, 2026 monthly Critical Security Patch Updates (CSPU) as well as the out-of-band Security Alert issued June 10, 2026 for the PeopleSoft PeopleTools vulnerability now tracked as CVE-2026-35273.

Summary

• The 42% Perception Gap: A major disconnect exists between executive leadership and security practitioners regarding SLA compliance, with 57% of C-suite executives believing SLAs are being met while only 15% of practitioners agree.
• The Visibility Crisis: Executives are often misled by “green” dashboards showing completed scans, while practitioners are actually overwhelmed by an unmanageable mountain of unresolvable and AI-generated vulnerabilities.
• Unifying the View: Waratek eliminates this disconnect by combining Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) to establish “one version of the truth” for both leadership and the SOC.
• Automated, Real-Time Remediation: By automating defense at the runtime level, security issues are mitigated at the speed of the attack rather than waiting on slow development sprint cycles.
• Verifiable Protection for GRC: The platform shifts organizations from “hopeful security” to verifiable compliance, relieving the burden on the SOC through virtual patching and ensuring high-level reporting matches actual security posture.

Introduction: Is There A Visibility Crisis in the Boardroom?

There is a massive disconnect currently unfolding in the modern enterprise. While C-suite executives sit in boardrooms reviewing dashboards that signal “all clear,” the practitioners in the trenches are battling a different reality. New data reveals a staggering 42% perception gap: 57% of executives believe their security Service Level Agreements (SLAs) are being met, while only 15% of the security practitioners doing the work agree.

Advisory scope: 257 CVE-product matrix entries across 66 products in 11 product families (251 unique CVEs; same CVE can appear in multiple matrices).

Top risk products (Critical CVEs)

Family-level highlights

Oracle Fusion Middleware is the dominant risk surface consisting of 69 Critical CVEs across 14 products, 49 of them remotely exploitable without authentication. The WebCenter stack alone (Content, Portal, Sites, Enterprise Capture, Imaging) accounts for 47 Critical vulnerabilities. Oracle Coherence stands out with 7 Critical CVEs all scoring 9.3–10.0 and all RNoAuth.

DUBLIN - 15 June, 2026 - Waratek, the leader in runtime application security, today announced the appointment of Apostolos Giannakidis as Chief Technology Officer. In his new role, Giannakidis will lead Waratek’s technology vision, product strategy, and security research as the company expands its runtime protection platform to address the surge in software vulnerabilities and exploits introduced by AI-generated code.

🎯 Who Should Read: AppSec Managers, DevOps Leads, and Senior Software Architects.

–URGENT ACTION RECOMMENDED–

For Waratek customers and prospects

Highlights

• Oracle has moved from quarterly to monthly & quarterly security patching. The first Critical Security Patch Update (CSPU) shipped on Thursday, May 28, 2026; subsequent CSPUs land on the third Tuesday of each month outside the quarterly CPU window.
• This first CSPU is targeted and compact: 35 new security patches across five product families – a deliberately smaller footprint than the 483-patch April CPU.
• Headline severity is a CVSS 10.0 in Oracle REST Data Services (ORDS) – the maximum possible score, unauthenticated, network-exploitable.
• Oracle E-Business Suite ships 12 patches with a max CVSS 9.9 – attacker focus on EBS remains high after October 2025’s Cl0p extortion campaign (CVE-2025-61882).
• Action: Waratek customers should contact customersuccess@waratek.com for RASP rule coverage; prospects can request a same-week protection assessment from sales@waratek.com.

What Changed: Oracle’s New Monthly Cadence

For more than two decades Oracle has shipped security fixes on a quarterly Critical Patch Update (CPU) rhythm. As of May 28, 2026, Oracle has introduced an additional, monthly Critical Security Patch Update (CSPU) stream that fills the gap between quarterly releases. The change is a direct response to a year in which Oracle products were targeted by ransomware operators (Cl0p / CVE-2025-61882) and Identity Manager flaws (CVE-2025-61757, CVE-2026-21992) reached CISA’s KEV catalog within days of disclosure.

Executive Highlights

• The “18-Month Wall”: AI speeds up delivery but doubles technical debt; Waratek breaks this cycle by validating code logic at the bytecode level.
• Zero-Noise Triage: Waratek IAST eliminates the “false positive” fatigue of traditional tools by only alerting on exploitable, reachable code paths.
• Virtual Patching: Waratek RASP provides instant immunity against AI “hallucinations” and zero-days, protecting applications without requiring immediate code changes.
• Strategic Alignment: By automating routine security checks, leaders can adjust staffing and assignments from manual remediation to active threat modeling.

The “Age of AI” has transformed the developer’s workspace. With the click of a button, LLMs can churn out thousands of lines of code, promising a future of unprecedented velocity. But for DevOps and AppSec leaders, this velocity comes with a hidden tax: the “18-month wall.” Recent industry data from 2026 shows that while AI-generated code speeds up initial delivery, it compounds technical debt at twice the rate of human-written code.

Who Should Read: CISOs, DevSecOps Engineers, and Vulnerability Management Leads grappling with the acceleration of AI-driven threats.

Read Time: 4 minutes

Highlights:

• Agentic Iteration: How Mythos autonomously spins up sandboxes to refine exploits.
• The Collapsed Timeline: Explaining the formula Time to Exploit ≈ Time to Inference + Time to Execution Test.
• Virtual Patching: How Waratek RASP secures the JVM level without requiring code changes.
• The “Permit List” Strategy: Neutralizing zero-days in obscure libraries via runtime boundaries.

The Engineering Reality of “Machine-Speed” Exploitation

The pending release of Anthropic’s Claude Mythos represents a paradigm shift in automated vulnerability research (AVR). Unlike previous LLMs that hallucinated syntax or struggled with complex logic, Mythos utilizes Agentic Iteration. It doesn’t just scan code; it spins up sandboxed environments, attempts exploitation, observes the crash, and refines its payload until successful.

• Who Should Read: CISOs, AppSec Managers, Lead Developers, and DevOps Engineers tired of “vulnerability fatigue.”

Key Highlights

• The Probabilistic Pitfall: Why AI models trained on patterns rather than logic create “hallucinations” and false positives.
• Runtime vs. Static: The fundamental difference between guessing what code might do and observing what it actually does.
• The Power of 100%: How Waratek achieves a perfect score on the OWASP Benchmark by eliminating false positives.
• Full Context Visibility: Why stack traces and data flow maps are superior to simple line-number alerts.
• Blind Spot Protection: How to secure compiled binaries that AI scanners simply cannot read.

In the current gold rush of Artificial Intelligence, the mantra for many security vendors has become “AI-everything.” From automated code generation to AI-enabled security scanners, the promise is clear: faster development and smarter detection. But in the world of Application Security (AppSec), speed without accuracy is just a faster way to create a backlog. As security teams integrate AI-driven Static Analysis (SAST) into their pipelines, they are running into a familiar, albeit amplified, problem: The Hallucination Effect.

The second in a two-part series.

–URGENT ACTION REQUIRED–

Highlights

• Oracle’s April 2026 CPU ships 483 new security patches – one of the largest CPUs on record.
• No CVSS 10.0 this quarter, but multiple CVSS 9.8 vulnerabilities are remotely exploitable without authentication.
• Fusion Middleware fixes CVE-2026-21992 (CVSS 9.8) – Oracle Identity Manager / Web Services Manager unauthenticated RCE, first shipped in the March out-of-band alert.
• MySQL (34), E-Business Suite (18), Financial Services and PeopleSoft (21) all receive new patches – attacker focus on EBS and Identity Manager remains elevated after Cl0p / KEV activity in late 2025.
• Java SE: 12 patches, 8 remotely exploitable, max CVSS 7.5 – availability impact primarily; Waratek RASP mitigates JVM-level attack classes without waiting for a full upgrade.
• Action: Apply the April CPU immediately on internet-facing Fusion Middleware and EBS; contact customersuccess@waratek.com to confirm which RASP rules already cover your stack.

Commentary

The Oracle Critical Patch Update (CPU) for April 2026 contains 483 new security patches addressing vulnerabilities in Oracle code and third-party components across more than two dozen product families. This is one of the largest Oracle CPUs on record and includes fixes already staged by Oracle’s out-of-band March 2026 security alert for CVE-2026-21992. Oracle strongly recommends immediate application of these patches due to continued reports of in-the-wild exploitation attempts against recent Oracle vulnerabilities.

First of a two-part series.

Who Should Read: CTOs, VPs of Engineering, CISOs, and AppSec Leads managing AI-integrated development lifecycles.

Highlights

• The AI Paradox: AI-assisted development accelerates velocity but introduces security flaws in nearly 45% of generated code.
• Vibe Coding vs. Security Gates: Traditional “scan-and-wait” security can’t keep up with the fluid, “speed of thought” nature of modern development.
• The Waratek IAST Solution: How Interactive Application Security Testing (IAST) provides line-of-code precision and zero false positives.
• Eliminating Debt: Using a patented Data Tainting Engine to validate AI output before it enters your staging environment.

The New Bottleneck: “Can I Trust This?”

While LLMs are exceptional at boilerplate and logic suggestions, they are notoriously “security-blind.” Recent research indicates that 45% of AI-generated code contains security flaws, ranging from insecure deserialization to classic injection vulnerabilities. When your team is moving at the speed of thought, traditional security gates don’t just feel slow-they feel obsolete.

Highlights:

• In an environment with AI-generated code, security testing is not optional
• Traditional xAST tools fall short
• SAST reports too many false positives
• DAST can’t tell you why or where your code is buggy
• IAST in the runtime highlights accuracy and gives devs the context needed to avoid sending vulnerable & exploitable code into production

If you ask a developer why they hate security testing, you’ll usually get two answers.

REDWOOD SHORES, Calif. - March 18, 2026 - Waratek, a leader in next-generation application security, today announced the official launch of Waratek IAST (Interactive Application Security Testing). The announcement was made during the JavaOne 2026 conference, where Waratek CEO Doug Ennis delivered a featured session on securing the software development lifecycle (SDLC) in the age of AI-generated code.

The launch addresses a critical and growing risk for enterprises relying on Large Language Models (LLMs) to accelerate Java development. While AI boosts productivity, new data from industry leaders reveals that this increased code volume comes with a significant security trade-off, specifically for the Java language.

We’re thrilled to share that Waratek has been included in the Ireland INC US 250 Index 2024, a special report curated by Business & Finance Magazine which showcases 250 leading Irish companies that are actively investing in the United States. This annual index highlights the contributions of Irish companies that are driving economic growth, creating jobs, and fostering innovation across the Atlantic.

The Ireland INC US 250 Index celebrates a remarkable year of growth in Irish foreign direct investment (FDI) in the US. As of 2023, Irish companies have invested a record $240 billion in the US economy. The impact of this investment is far-reaching, with nearly 100,000 US workers employed by the US affiliates of Irish-owned companies and a presence in over 2,200 locations across the country. Approximately 900 Irish companies export to the US, supporting vital industries across technology, healthcare, financial services, and more.