Oracle Releases October 2026 Critical Patch Update Fixing 1,295 Vulnerabilities Across Multiple Products
Oracle has released its quarterly Critical Patch Update (CPU) for October 2026, addressing a total of 1,295 security vulnerabilities across its product portfolio.
The update, published on October 20, 2026, covers multiple product families. After accounting for overlaps, it resolves 1,209 unique CVEs. The largest share of fixes targets Oracle Fusion Middleware (206 patches), followed by Oracle E-Business Suite (194), Oracle Communications (110), Oracle MySQL (98), and Oracle Java SE (55).
Analysis of CVSSv3 base scores shows that 587 vulnerabilities received a score of 7.0 or higher. Of these, 112 were rated 9.0 or above. Six vulnerabilities achieved the maximum score of 10.0.
One critical example is CVE-2026-101809 in the Oracle E-Business Suite Workflow Notification Mailer component. This flaw allows unauthenticated remote exploitation via HTTP and carries a CVSS base score of 10.0.
The October 2026 CPU continues Oracle’s regular schedule of coordinated security updates, enabling customers to apply fixes across enterprise middleware, business applications, databases, and development platforms in a single release cycle.
Related articles
Why Traditional Vulnerability Scanners Fail in Kubernetes and Cloud Environments
Traditional vulnerability management approaches break down when applied to containers and cloud infrastructure because containers are ephemeral, internal networks are invisible from the outside, and misconfigurations can be introduced at build time. The article highlights the 2018 Tesla Kubernetes incident where an exposed dashboard allowed cryptomining via stolen AWS credentials without any code vulnerabilities. Container security tools are required to scan images during build, enforce policies at deployment, and monitor runtime behavior, unlike classic scanners that only examine running workloads. Key configuration risks include privileged pods, missing NetworkPolicy objects, and overly broad RBAC roles such as cluster-admin. Supply chain protections like Sigstore image signing and SBOM generation are presented as essential for preventing compromised base images and hidden dependencies. Cloud environments add shared responsibility models, dynamic scaling challenges, and regulatory constraints that further limit the effectiveness of legacy VM tools. Specialized platforms such as CNAPP solutions are recommended alongside Russian domestic tools like PT Container Security and Kaspersky Container Security.
Google Releases Chrome 156 Fixing 353 Vulnerabilities Including Six Critical Issues
Google has released Chrome 156 for Windows, macOS, and Linux, addressing a total of 353 vulnerabilities tracked via CVE identifiers. Six of these flaws received the highest Critical severity rating, primarily involving memory corruption in components such as Skia, Accessibility, CSS, Paint, and WebRTC. One additional Critical issue is a Use-After-Free vulnerability in Accessibility reported by Anthropic researcher Xinyang Ge with assistance from Claude. Sixty-one High severity vulnerabilities were also fixed across V8, ANGLE, WebRTC and other modules, covering memory corruption, use-after-free conditions, and input validation problems. The update further resolves 197 Medium and 89 Low severity issues. Patches are being deployed gradually over the coming days and weeks to all supported platforms.
Multiple Critical Vulnerabilities Found in PHP, Fixes Scheduled for October 21
The PHP security team has confirmed two serious vulnerabilities in the PHP scripting language. Both issues received a CVSSv4.0 base score of 9.2, placing them in the Critical severity category. The team announced the upcoming security update on October 20, 2026, and plans to release the patched versions at 14:00 UTC on October 21, which corresponds to 23:00 Japan time. Specific technical details, affected components, and vulnerable versions remain undisclosed until the patches are published. The team urges administrators to prepare for immediate updates once the fixes become available. Earlier release is possible if vulnerability details leak or active exploitation is detected.
Mozilla Releases Firefox 158.0.1 Security Update Fixing High-Severity Vulnerabilities and Compromised Certificates
Mozilla Foundation has published Firefox 158.0.1 on October 20, 2026, delivering fixes for four CVEs rated at high overall severity. Two vulnerabilities received a High rating, including a boundary condition flaw in the SVG component tracked as CVE-2026-113399 and a certificate blocklist issue identified as CVE-2026-113470. The update also refreshes the OneCRL list to block an intermediate certificate from eMudhra that was compromised earlier in the month. Mozilla delivered the updated blocklist via RemoteSettings on October 17 and embedded the changes directly into the browser release. This approach ensures compromised certificates remain blocked even when RemoteSettings is disabled or network access is unavailable. One Moderate and one Low severity issue complete the set of addressed flaws.