Oracle addresses 1,449 security vulnerabilities in July update.Getty ImagesWhether you are in the AI fan or foe corner, there’s no denying the knockout punch being delivered by the technology as far as security vulnerability discovery and disclosure is concerned. Oracle is the latest to surprise us with a truly staggering number of security issues confirmed in just a single monthly update. “The July Critical Patch Update includes 1,449 security patches, addresses 1434 distinct CVEs,” Oracle has announced, “and spans 334 Oracle products.” This follows a record-breaking July Patch Tuesday rollout from Microsoft that addressed 570 security vulnerabilities, and Google also broke records with 429 Chrome browser vulnerabilities found and fixed in June.ForbesMicrosoft Releases New Windows 11 Security Update Fix For Dell UsersBy Davey WinderOracle Says Action Required: Install Critical Patch Update PromptlyThe second Tuesday of the month always gets my sysadmin sympathy glands working overtime, never more so since AI-powered resources have started shoveling newly disclosed vulnerabilities into the need-fixing-now pile like a steam train stoker on steroids throws coal into the firebox. But Microsoft’s Patch Tuesday isn’t the only game in vulnerability town. Oracle releases its security updates on the third Tuesday of each month, presumably to keep the admins on edge. And the July 2026 Critical Patch Update is a doozy, prompting Oracle’s Integrated Cyber Center to urge users to “move immediately to a monthly security patching cycle” starting right now. Mayuresh Dani, security research manager at Qualys Threat Research Unit, has said that “AI-automated fuzzing, LLM-assisted variant hunting, and static analysis at scale are discovering bugs faster than enterprises can remediate.” And there lies the real-world rub. It’s no longer a matter of patch, patch, patch, but rather time to get on top of patch prioritization once and for all. Dani recommended considering the use of the CISA Known Exploited Vulnerabilities catalog or a Likely Exploited Vulnerabilities model, rather than relying upon CVSS scores alone. “Graduate to a tiered patching SLA mechanism,” Dani told me, for example, “a KEV-listed CVE should be patched within 24-36 hours,” with the next tier being internet-facing high-privilege infrastructures. Severity scores alone are not going to cut it; you need to put everything into the context of risk to your enterprise alone. The official July Oracle Critical Patch Update Advisory details all 1449 new security patches across product families, and I advise you consult that. Oracle has warned, however, that it continues to receive periodic reports of attempts to exploit vulnerabilities that were addressed in previously released security patches, often because organizations failed to apply them in good time. Oracle said, therefore, that it “strongly recommends that customers remain on actively-supported versions and apply security patches without delay.”MORE FOR YOU