Oracle disclosed CVE-2026-35290, a critical unauthenticated remote code execution flaw in Application Testing Suite 13.3.0.1 that allows full takeover via TCP. The CVSS 9.8 vulnerability was published July 21, 2026 and referenced in Oracle's July CPU advisory.
A remote unauthenticated attacker can fully compromise the affected software.
Users of the affected version should consult Oracle's advisory immediately.
Enterprise teams running Oracle Application Testing Suite 13.3.0.1 should treat this CVSS 9.8 remote takeover as an immediate patching priority given the network-accessible unauthenticated attack vector.
Tap a lens to see what this story means for you.
Reader-supported · The Brief
Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
ChainDrop, a self-propagating worm, has compromised more than 1,300 npm packages responsible for 2 billion combined monthly downloads, including Keyv, Cacheable and utilities tied to Deliveroo, Picsart, Qlik and others. The malware steals a broad array of developer and cloud credentials from infected systems and CI/CD environments, requiring any impacted machine to be treated as fully breached.
SpaceX reported Q2 revenue of $7.8 billion, up 92 percent year-over-year, with its former xAI division driving growth through cloud deals while posting a reported 2,013 percent surge in capital expenditure to $15.8 billion. The results offer the first public window into the economics of an AI-scale operation, highlighting both revenue gains and massive infrastructure costs.
Zyxel disclosed CVE-2026-6837, a command injection vulnerability in the export-cgi program of WAX650S firmware through version 7.10(ABRM.4)C0 that lets authenticated administrators execute OS commands. The flaw scores 7.2 on CVSS v3.1 and was published August 3, 2026.
