Last Week in Tech - The Biggest Patch Tuesday Ever, a 10.0 With No Patch to Apply, and Oracle's $664 Billion Round Trip

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Last Week in Tech for Monday 14 September 2026, covering 7 to 13 September.

Microsoft's largest Patch Tuesday ever (8 Sep): around 970 CVEs — 974 per Microsoft's own release note, 964 per Tenable, 966 per BleepingComputer. Two were already being exploited, both Windows privilege escalation, both CVSS v3.1 7.8: CVE-2026-85880 (ALPC heap buffer overflow) and CVE-2026-81963 (Windows Update Stack link-following), per Tenable the first Update Stack flaw ever caught being exploited. Both are local escalation, not initial access. ZDI's Dustin Childs rates Exchange CVE-2026-55007 (8.1, malicious Visio attachment) the month's most important patch, and calls Windows DNS Server CVE-2026-69730 (9.8) the spiritual successor to SigRed. September's Windows Server updates break Remote Desktop Services — test first.

Magento and Adobe Commerce "StyleSmuggler": CVE-2026-75650, CVSS v3.1 10.0, unauthenticated RCE. Exploited from 4 Sep, disclosed by Sansec 5 Sep, patched 7 Sep (APSB26-146), added to CISA KEV 8 Sep. A Magento-written log file is poisoned with PHP, then executed when Magento renders the standard Payment Transaction Failed Reminder email — nobody needs to open it. Sansec's first victim ran 2.4.6-p15 with July and August updates applied, the current patch level for that line; Disrex Group confirmed two more, one on 2.4.8 running Sansec's own protection product. Patching does not remove an installed backdoor — any store online between 4 Sep and patching needs a compromise assessment, a session flush, and rotation of the encryption key, admin passwords and all env.php credentials.

Ten CVEs into CISA KEV in three days, almost all edge devices. 9 Sep: Cisco Secure Firewall Management Center auth bypass to root, CVE-2026-20079 (10.0), with Cisco confirming exploitation from August; Citrix NetScaler auth bypass CVE-2026-19490 (9.3); Fortinet heap overflow CVE-2025-25249 (7.3), linked by SOCRadar to a PivotC2 campaign that infected 178 devices. 10 Sep: MikroTik RouterOS CVE-2026-67277 and CVE-2026-86060 — CERT Polska warned of full administrative takeover via internet-exposed SSH without authentication, calling it MikroTrick. Zero-day status unverified.

Oracle Q1 FY2027 (10 Sep): revenue US$19.3bn (+30%), cloud US$11.6bn (+62%), infrastructure US$7.4bn (+121%), backlog US$664bn against roughly US$640bn expected, with 300,000+ GPUs delivered. On 11 Sep shares rose as much as 7.8% intraday, then reversed to close around 2% down. S&P estimates roughly half the backlog is tied to OpenAI, calculated against the prior US$638bn figure; Moody's has flagged counterparty risk.

Apple (9 Sep): the iPhone Duo foldable starts at US$1,999, on sale 23 October. iPhone 18 Pro from US$1,199 and Pro Max from US$1,299 ship in 65+ countries from 18 September. All run the A20 Pro, Apple's first 2nm chip. There is no standard iPhone 18 this cycle — the affordable models move to spring 2027, pushing mid-tier fleet refreshes out two quarters.

The AI cost gap: DeepSeek's V4.1-Flash (10 Sep) has MIT-licensed open weights at US$0.15 per million input tokens and US$0.60 per million output off-peak, though its benchmarks are vendor-published and not independently reproduced. The Information reported on 6 September that Anthropic has signed compute agreements worth up to US$517bn — an estimated maximum across many deals, not published by Anthropic.

Coming up: Wednesday, a Sydney edtech breach affecting over a million people. Friday, the developer-tools vendor that missed its own patch.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Microsoft Security Update Guide; Tenable; BleepingComputer; Sansec; Adobe APSB26-146; Disrex Group; CISA KEV catalogue; CERT Polska; Oracle investor relations; The Information.