Home on Waratek

Oracle Releases the July 2026 Critical Patch Update

Tue, 21 Jul 2026 09:00:00 +0000

Highlights

Oracle’s July 2026 CPU ships 1,455 new security patches, the largest Critical Patch Update Oracle has issued to date.

The highest score this quarter is a perfect CVSS 10.0, affecting Oracle Access Manager, WebLogic Server and Oracle Coherence within Fusion Middleware.

PeopleSoft is the emergency priority. CVE-2026-35278 and CVE-2026-35273 (both CVSS 9.8) are under active exploitation by the ShinyHunters extortion group, which claims to have compromised more than 300 PeopleSoft servers across 100+ organizations since late May 2026.

Fusion Middleware receives 359 patches (224 remotely exploitable without authentication), the largest single-family total in this CPU. WebLogic, Identity Manager and WebCenter Capture each carry CVSS 9.9 unauthenticated RCE flaws.

E-Business Suite receives 416 patches (63 remotely exploitable), reflecting sustained attacker interest after the 2025 Cl0p campaign and a separately exploited flaw patched last month.

Java SE ships 20 patches (18 remotely exploitable) with a comparatively modest maximum CVSS of 7.8, mostly affecting availability rather than confidentiality or integrity.

Action: patch internet-facing PeopleSoft, Fusion Middleware (WebLogic, Identity Manager, Access Manager) and E-Business Suite this week. Treat the Database Server 9.9 flaw as high priority even though it is not yet reported under active exploitation.

Commentary

The Oracle Critical Patch Update (CPU) for July 2026 contains 1,455 new security patches spanning more than two dozen product families, making it the largest quarterly release Oracle has published. The update is cumulative, meaning it folds in the May 28 and June 16, 2026 monthly Critical Security Patch Updates (CSPU) as well as the out-of-band Security Alert issued June 10, 2026 for the PeopleSoft PeopleTools vulnerability now tracked as CVE-2026-35273.

Can We Bridge the 42% Perception Gap? Aligning the C-Suite and the SOC

Thu, 25 Jun 2026 00:00:00 +0000

Who Should Read: Executive Leadership (CISO, CTO, CIO), GRC (Governance, Risk, and Compliance) Officers, and AppSec Directors.

Summary

The 42% Perception Gap: A major disconnect exists between executive leadership and security practitioners regarding SLA compliance, with 57% of C-suite executives believing SLAs are being met while only 15% of practitioners agree.
The Visibility Crisis: Executives are often misled by “green” dashboards showing completed scans, while practitioners are actually overwhelmed by an unmanageable mountain of unresolvable and AI-generated vulnerabilities.
Unifying the View: Waratek eliminates this disconnect by combining Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) to establish “one version of the truth” for both leadership and the SOC.
Automated, Real-Time Remediation: By automating defense at the runtime level, security issues are mitigated at the speed of the attack rather than waiting on slow development sprint cycles.
Verifiable Protection for GRC: The platform shifts organizations from “hopeful security” to verifiable compliance, relieving the burden on the SOC through virtual patching and ensuring high-level reporting matches actual security posture.

Introduction: Is There A Visibility Crisis in the Boardroom?

There is a massive disconnect currently unfolding in the modern enterprise. While C-suite executives sit in boardrooms reviewing dashboards that signal “all clear,” the practitioners in the trenches are battling a different reality. New data reveals a staggering 42% perception gap: 57% of executives believe their security Service Level Agreements (SLAs) are being met, while only 15% of the security practitioners doing the work agree.

Oracle Releases Significant June Security Update

Wed, 17 Jun 2026 11:30:29 +0000

Key findings - Oracle CSPU June 2026

Advisory scope: 257 CVE-product matrix entries across 66 products in 11 product families (251 unique CVEs; same CVE can appear in multiple matrices).

Severity	Count	No Auth Required
Critical (CVSS ≥ 9.0)	134	104
High (7.0–8.9)	104	-
Medium (4.0–6.9)	15	-
Low (< 4.0)	4	-

Top risk products (Critical CVEs)

Product	Family	Critical	High	Med	No Auth Req
Oracle WebCenter Content	Fusion Middleware	16	13	1	14
Oracle Enterprise Manager Base Platform	Enterprise Manager	13	6	-	9
JD Edwards EnterpriseOne Tools	JD Edwards	13	1	-	11
Oracle WebCenter Enterprise Capture	Fusion Middleware	10	-	-	2
Oracle WebCenter Portal	Fusion Middleware	10	-	-	3
Oracle WebCenter Sites	Fusion Middleware	8	3	-	8
Oracle Enterprise Command Center Framework	E-Business Suite	7	1	-	2
Oracle Coherence	Fusion Middleware	7	-	-	7
Oracle iSupport	E-Business Suite	3	-	-	-

Family-level highlights

Oracle Fusion Middleware is the dominant risk surface consisting of 69 Critical CVEs across 14 products, 49 of them remotely exploitable without authentication. The WebCenter stack alone (Content, Portal, Sites, Enterprise Capture, Imaging) accounts for 47 Critical vulnerabilities. Oracle Coherence stands out with 7 Critical CVEs all scoring 9.3–10.0 and all RNoAuth.

Waratek Appoints Apostolos Giannakidis as Chief Technology Officer

Mon, 15 Jun 2026 08:52:23 +0000

Veteran runtime security architect to lead Waratek’s technology strategy as enterprises confront a new wave of AI-generated code vulnerabilities and exploits

DUBLIN - 15 June, 2026 - Waratek, the leader in runtime application security, today announced the appointment of Apostolos Giannakidis as Chief Technology Officer. In his new role, Giannakidis will lead Waratek’s technology vision, product strategy, and security research as the company expands its runtime protection platform to address the surge in software vulnerabilities and exploits introduced by AI-generated code.

Remediation Crisis: Why 62% of AI Flaws Go Unfixed

Tue, 02 Jun 2026 18:38:42 +0000

The rapid adoption of Large Language Models (LLMs) has outpaced our ability to secure them. Currently, 62% of high-risk AI vulnerabilities go unfixed because traditional patching methods-like updating a library-don’t apply to the non-deterministic nature of neural networks. This blog explores why the “remediation gap” exists and how Runtime Application Self-Protection (RASP) secures AI assets without waiting for costly model re-training.

🎯 Who Should Read: AppSec Managers, DevOps Leads, and Senior Software Architects.

Oracle Launches Monthly Security Patching

Fri, 29 May 2026 09:57:46 +0000

Summary and analysis of the first Oracles first monthly Critical Security Patch Update (CSPU)

–URGENT ACTION RECOMMENDED–

For Waratek customers and prospects

Highlights

Oracle has moved from quarterly to monthly & quarterly security patching. The first Critical Security Patch Update (CSPU) shipped on Thursday, May 28, 2026; subsequent CSPUs land on the third Tuesday of each month outside the quarterly CPU window.
This first CSPU is targeted and compact: 35 new security patches across five product families – a deliberately smaller footprint than the 483-patch April CPU.
Headline severity is a CVSS 10.0 in Oracle REST Data Services (ORDS) – the maximum possible score, unauthenticated, network-exploitable.
Oracle E-Business Suite ships 12 patches with a max CVSS 9.9 – attacker focus on EBS remains high after October 2025’s Cl0p extortion campaign (CVE-2025-61882).
Action: Waratek customers should contact customersuccess@waratek.com for RASP rule coverage; prospects can request a same-week protection assessment from sales@waratek.com.

What Changed: Oracle’s New Monthly Cadence

For more than two decades Oracle has shipped security fixes on a quarterly Critical Patch Update (CPU) rhythm. As of May 28, 2026, Oracle has introduced an additional, monthly Critical Security Patch Update (CSPU) stream that fills the gap between quarterly releases. The change is a direct response to a year in which Oracle products were targeted by ransomware operators (Cl0p / CVE-2025-61882) and Identity Manager flaws (CVE-2025-61757, CVE-2026-21992) reached CISA’s KEV catalog within days of disclosure.

Waratek IAST + RASP is Insurance Against AI Risk

Tue, 26 May 2026 23:03:15 +0000

As AI-generated code floods the software lifecycle, AppSec leaders face a choice: slow down innovation or risk catastrophic security debt. Waratek’s IAST and RASP solutions provide a dual-layer insurance policy, automating the detection of real threats in development and shielding applications in production. This allows leadership to stop “firefighting” and align their most talented staff to high-value strategic initiatives.

Executive Highlights

The “18-Month Wall”: AI speeds up delivery but doubles technical debt; Waratek breaks this cycle by validating code logic at the bytecode level.
Zero-Noise Triage: Waratek IAST eliminates the “false positive” fatigue of traditional tools by only alerting on exploitable, reachable code paths.
Virtual Patching: Waratek RASP provides instant immunity against AI “hallucinations” and zero-days, protecting applications without requiring immediate code changes.
Strategic Alignment: By automating routine security checks, leaders can adjust staffing and assignments from manual remediation to active threat modeling.

The “Age of AI” has transformed the developer’s workspace. With the click of a button, LLMs can churn out thousands of lines of code, promising a future of unprecedented velocity. But for DevOps and AppSec leaders, this velocity comes with a hidden tax: the “18-month wall.” Recent industry data from 2026 shows that while AI-generated code speeds up initial delivery, it compounds technical debt at twice the rate of human-written code.

Mythos Doesn’t Need CVEs: Defending against AI Zero-Days

Wed, 20 May 2026 00:14:22 +0000

The arrival of Anthropic’s Claude Mythos marks the end of the “Human Era” of cybersecurity. This post explores how Mythos utilizes agentic iteration to collapse the exploit development timeline from weeks to minutes, rendering traditional patching cycles obsolete and necessitating a shift toward runtime virtual patching.

Who Should Read: CISOs, DevSecOps Engineers, and Vulnerability Management Leads grappling with the acceleration of AI-driven threats.

Read Time: 4 minutes

Highlights:

Agentic Iteration: How Mythos autonomously spins up sandboxes to refine exploits.
The Collapsed Timeline: Explaining the formula Time to Exploit ≈ Time to Inference + Time to Execution Test.
Virtual Patching: How Waratek RASP secures the JVM level without requiring code changes.
The “Permit List” Strategy: Neutralizing zero-days in obscure libraries via runtime boundaries.

The Engineering Reality of “Machine-Speed” Exploitation

The pending release of Anthropic’s Claude Mythos represents a paradigm shift in automated vulnerability research (AVR). Unlike previous LLMs that hallucinated syntax or struggled with complex logic, Mythos utilizes Agentic Iteration. It doesn’t just scan code; it spins up sandboxed environments, attempts exploitation, observes the crash, and refines its payload until successful.

Runtime Reality vs AI Hallucinations in AppSec

Tue, 12 May 2026 23:30:35 +0000

As organizations race to integrate AI into their security workflows, hallucination tendencies of AI-driven static analysis is leading to developer fatigue and bloated backlogs. There is a solution that replaces guesswork with 100% accurate, execution-based intelligence.

Who Should Read: CISOs, AppSec Managers, Lead Developers, and DevOps Engineers tired of “vulnerability fatigue.”

Key Highlights

The Probabilistic Pitfall: Why AI models trained on patterns rather than logic create “hallucinations” and false positives.
Runtime vs. Static: The fundamental difference between guessing what code might do and observing what it actually does.
The Power of 100%: How Waratek achieves a perfect score on the OWASP Benchmark by eliminating false positives.
Full Context Visibility: Why stack traces and data flow maps are superior to simple line-number alerts.
Blind Spot Protection: How to secure compiled binaries that AI scanners simply cannot read.

In the current gold rush of Artificial Intelligence, the mantra for many security vendors has become “AI-everything.” From automated code generation to AI-enabled security scanners, the promise is clear: faster development and smarter detection. But in the world of Application Security (AppSec), speed without accuracy is just a faster way to create a backlog. As security teams integrate AI-driven Static Analysis (SAST) into their pipelines, they are running into a familiar, albeit amplified, problem: The Hallucination Effect.

Is Your Security Blind to the Party Inside Your App?

Wed, 06 May 2026 08:49:04 +0000

Imagine you’re standing in the grand foyer of a luxury hotel, staring at a pair of closed mahogany doors. Behind those doors is a gala-a complex, moving, breathing event. As an AppSec leader or developer, your job is to make sure that gala stays safe. But here’s the problem: most of your security tools are standing in the hallway with you. They’re guessing what’s happening inside based on the guest list or the noise coming through the door.

Why Your Security Team Needs to Move at AI Speed

Wed, 29 Apr 2026 08:58:38 +0000

In the era of AI, new vulnerabilities and Zero-Days emerge faster than human teams can manually patch them. This is where the friction between “Dev” and “Sec” usually peaks. Security teams, tasked with risk mitigation, often demand immediate patches and service restarts. Development teams, measured by 100% uptime and feature velocity, see those restarts as a threat to their “flow” and business KPIs. Traditionally, one side has to lose.

The second in a two-part series.

Oracle Releases April 2026 Critical Patch Update

Wed, 22 Apr 2026 09:33:17 +0000

Oracle Communications, Fusion Middleware, MySQL, E-Business Suite and Financial Services lead 483 new security patches.

–URGENT ACTION REQUIRED–

Highlights

Oracle’s April 2026 CPU ships 483 new security patches – one of the largest CPUs on record.
No CVSS 10.0 this quarter, but multiple CVSS 9.8 vulnerabilities are remotely exploitable without authentication.
Fusion Middleware fixes CVE-2026-21992 (CVSS 9.8) – Oracle Identity Manager / Web Services Manager unauthenticated RCE, first shipped in the March out-of-band alert.
MySQL (34), E-Business Suite (18), Financial Services and PeopleSoft (21) all receive new patches – attacker focus on EBS and Identity Manager remains elevated after Cl0p / KEV activity in late 2025.
Java SE: 12 patches, 8 remotely exploitable, max CVSS 7.5 – availability impact primarily; Waratek RASP mitigates JVM-level attack classes without waiting for a full upgrade.
Action: Apply the April CPU immediately on internet-facing Fusion Middleware and EBS; contact customersuccess@waratek.com to confirm which RASP rules already cover your stack.

Commentary

The Oracle Critical Patch Update (CPU) for April 2026 contains 483 new security patches addressing vulnerabilities in Oracle code and third-party components across more than two dozen product families. This is one of the largest Oracle CPUs on record and includes fixes already staged by Oracle’s out-of-band March 2026 security alert for CVE-2026-21992. Oracle strongly recommends immediate application of these patches due to continued reports of in-the-wild exploitation attempts against recent Oracle vulnerabilities.

Moving at the Speed of Thought & No Security Debt

Wed, 15 Apr 2026 09:01:37 +0000

We have entered the era of the “vibe.” AI-assisted development has fundamentally shifted the developer experience. The bottleneck is no longer “How do I write this logic?” but rather “How do I know this code won’t blow up in production?”

First of a two-part series.

Who Should Read: CTOs, VPs of Engineering, CISOs, and AppSec Leads managing AI-integrated development lifecycles.

Highlights

The AI Paradox: AI-assisted development accelerates velocity but introduces security flaws in nearly 45% of generated code.
Vibe Coding vs. Security Gates: Traditional “scan-and-wait” security can’t keep up with the fluid, “speed of thought” nature of modern development.
The Waratek IAST Solution: How Interactive Application Security Testing (IAST) provides line-of-code precision and zero false positives.
Eliminating Debt: Using a patented Data Tainting Engine to validate AI output before it enters your staging environment.

The New Bottleneck: “Can I Trust This?”

While LLMs are exceptional at boilerplate and logic suggestions, they are notoriously “security-blind.” Recent research indicates that 45% of AI-generated code contains security flaws, ranging from insecure deserialization to classic injection vulnerabilities. When your team is moving at the speed of thought, traditional security gates don’t just feel slow-they feel obsolete.

Goldilocks Security: The “Just Right” AppSec Tool

Fri, 20 Mar 2026 17:34:46 +0000

Why SAST is too noisy, DAST is too shallow, and IAST is finally hitting the sweet spot for modern DevSecOps.

Highlights:

In an environment with AI-generated code, security testing is not optional
Traditional xAST tools fall short
SAST reports too many false positives
DAST can’t tell you why or where your code is buggy
IAST in the runtime highlights accuracy and gives devs the context needed to avoid sending vulnerable & exploitable code into production

If you ask a developer why they hate security testing, you’ll usually get two answers.

Waratek Redefines Secure Development with Launch of Waratek IAST at JavaOne 2026

Fri, 20 Mar 2026 10:36:50 +0000

FOR IMMEDIATE RELEASE

REDWOOD SHORES, Calif. - March 18, 2026 - Waratek, a leader in next-generation application security, today announced the official launch of Waratek IAST (Interactive Application Security Testing). The announcement was made during the JavaOne 2026 conference, where Waratek CEO Doug Ennis delivered a featured session on securing the software development lifecycle (SDLC) in the age of AI-generated code.

The launch addresses a critical and growing risk for enterprises relying on Large Language Models (LLMs) to accelerate Java development. While AI boosts productivity, new data from industry leaders reveals that this increased code volume comes with a significant security trade-off, specifically for the Java language.

Trust, but Verify: AI Code Supply Chain Security

Tue, 17 Mar 2026 16:08:01 +0000

In the race to modernize mission-critical Java applications, two forces are dominating the conversation: the explosive adoption of AI-generated code and the sprawling complexity of software supply chains.

For decision-makers and AppSec professionals, these advancements bring speed, but they also bring a dangerous illusion of security. AI code often passes the “eye test” while harboring deep logic flaws. Simultaneously, traditional Software Composition Analysis (SCA) tools are burying teams under mountains of alerts for libraries that aren’t even being used.

Waratek Selected for Ireland INC US 250 Index 2024

Wed, 13 Nov 2024 17:46:54 +0000

November 13th, 2024

We’re thrilled to share that Waratek has been included in the Ireland INC US 250 Index 2024, a special report curated by Business & Finance Magazine which showcases 250 leading Irish companies that are actively investing in the United States. This annual index highlights the contributions of Irish companies that are driving economic growth, creating jobs, and fostering innovation across the Atlantic.

The Ireland INC US 250 Index celebrates a remarkable year of growth in Irish foreign direct investment (FDI) in the US. As of 2023, Irish companies have invested a record $240 billion in the US economy. The impact of this investment is far-reaching, with nearly 100,000 US workers employed by the US affiliates of Irish-owned companies and a presence in over 2,200 locations across the country. Approximately 900 Irish companies export to the US, supporting vital industries across technology, healthcare, financial services, and more.

Mon, 01 Jan 0001 00:00:00 +0000

The Jakarta-based Multipart parser in Struts 2 mishandles errors during file uploads: a crafted Content-Type, Content-Disposition, or Content-Length header triggers an exception whose message is evaluated as an OGNL expression, letting an unauthenticated remote attacker execute arbitrary commands. This is the vulnerability behind the 2017 Equifax data breach.

Mon, 01 Jan 0001 00:00:00 +0000

When jackson-databind’s default typing is enabled, ObjectMapper.readValue can be pointed at attacker-supplied JSON that instantiates arbitrary gadget classes during deserialization. An unauthenticated attacker who controls input reaching readValue can chain these gadgets into remote code execution.

Mon, 01 Jan 0001 00:00:00 +0000

The Struts REST Plugin deserializes XML payloads using an XStreamHandler backed by XStream, without any type filtering. An attacker can submit a crafted XML payload to the REST endpoint to achieve remote code execution.

Mon, 01 Jan 0001 00:00:00 +0000

When alwaysSelectFullNamespace is enabled (directly, or via a plugin such as the Convention Plugin) and results, url tags, or actions omit a namespace while an ancestor package uses no or a wildcard namespace, Struts evaluates attacker-controlled input as an OGNL expression, leading to remote code execution.

Mon, 01 Jan 0001 00:00:00 +0000

Spring Security OAuth evaluates part of the authorization request as a Spring Expression Language (SpEL) expression when the resource owner is redirected to the approval endpoint. An attacker who crafts a malicious authorization request can smuggle a SpEL payload through that flow and have it evaluated by the server, achieving unauthenticated remote code execution against any application built on the vulnerable OAuth2 authorization server.

Mon, 01 Jan 0001 00:00:00 +0000

An unauthenticated attacker with network access to the T3 protocol can send a crafted serialized object to Oracle WebLogic Server, triggering unsafe deserialization that leads to full remote code execution and takeover of the server.

Mon, 01 Jan 0001 00:00:00 +0000

A crafted URL path lets an unauthenticated attacker bypass the access controls protecting WebLogic’s Administration Console, reaching internal console handlers that were never meant to be exposed. Combined with a follow-on request, this grants full unauthenticated remote code execution and has been mass-exploited in the wild.

Mon, 01 Jan 0001 00:00:00 +0000

When Tomcat is configured to use the PersistenceManager with a FileStore and a lax sessionAttributeValueClassNameFilter, an attacker who can place a crafted file at a known relative path can trigger remote code execution through deserialization of session data.

Mon, 01 Jan 0001 00:00:00 +0000

json-smart’s parser throws a NumberFormatException on certain malformed numeric input but callers never catch it. Because json-smart sits underneath Nimbus JOSE+JWT in many JWT validation stacks, an attacker can send a crafted token or payload that crashes the parsing application or leaks internal state through the uncaught exception.

Mon, 01 Jan 0001 00:00:00 +0000

When Log4j 1.2 is specifically configured to use JMSAppender, an attacker with write access to the logging configuration can set TopicBindingName and TopicConnectionFactoryBindingName to point at an attacker-controlled JNDI resource, resulting in remote code execution similar to Log4Shell.

Mon, 01 Jan 0001 00:00:00 +0000

Apache Log4j 2 evaluates attacker-controlled ${jndi:…} lookups inside logged strings. Any input that reaches a log statement can force the JVM to fetch and execute code from a remote LDAP or RMI server, giving an unauthenticated attacker full remote code execution.

Mon, 01 Jan 0001 00:00:00 +0000

Log4j configurations that use a JDBC Appender with a JNDI LDAP data source URI let an attacker who controls the target LDAP server return a malicious reference. When the appender resolves that data source, Log4j loads and executes attacker-supplied code, giving remote code execution even after the earlier Log4Shell fixes.

Mon, 01 Jan 0001 00:00:00 +0000

The 2.15.0 patch for Log4Shell (CVE-2021-44228) disabled the default JNDI lookup pattern but left non-default configurations exposed: when Pattern Layout uses a Context Lookup or a Thread Context Map pattern, attacker-controlled MDC input can still smuggle a JNDI lookup through and trigger remote code execution or information leakage.

Mon, 01 Jan 0001 00:00:00 +0000

Log4j2 did not guard against uncontrolled recursion from self-referential lookups. An attacker who controls Thread Context Map data can craft a string that triggers infinite recursion, crashing the application - a follow-on issue from the original Log4Shell disclosure.

Mon, 01 Jan 0001 00:00:00 +0000

A crafted HTTP request lets an unauthenticated attacker traverse outside the intended web root and read arbitrary files accessible to the WebLogic Server process. There is no authentication requirement and the flaw is easily exploitable over the network, giving attackers a low-effort path to config files, credentials, and other sensitive data on the server.

Mon, 01 Jan 0001 00:00:00 +0000

Spring Cloud Function’s routing functionality evaluates a user-supplied routing-expression as a Spring Expression Language (SpEL) string. An attacker can craft a malicious SpEL expression in a request header to achieve remote code execution and access local resources.

Mon, 01 Jan 0001 00:00:00 +0000

Spring MVC and WebFlux applications on JDK 9+ can be tricked, through HTTP request-parameter data binding, into reaching the class loader of a bean. An attacker can rewrite Tomcat logging properties to drop and execute a web shell, achieving remote code execution against a WAR-deployed app.

Mon, 01 Jan 0001 00:00:00 +0000

Apache Commons Text enables variable interpolation of the form ${prefix:name}. In affected versions the default lookups include “script”, “dns” and “url”, so untrusted input passed to the interpolator can execute arbitrary code through the JVM script engine or reach attacker-controlled servers.

Mon, 01 Jan 0001 00:00:00 +0000

Several Commons BCEL APIs that are meant to only tweak specific, narrow class characteristics have an out-of-bounds write defect that lets them be abused to produce arbitrary Java bytecode instead. An application that passes attacker-controllable data into these APIs gives the attacker far more control over the generated class than intended, letting a crafted class be loaded and executed for remote code execution.

Mon, 01 Jan 0001 00:00:00 +0000

Oracle Agile PLM’s Process Extension SDK component fails to properly enforce authorization on requests that reference file attachments, letting an unauthenticated attacker with network access retrieve arbitrary files and sensitive data from the server over HTTP. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog after confirming active attacks in the wild.

Mon, 01 Jan 0001 00:00:00 +0000

A flaw in the JSSE component of Oracle Java SE and GraalVM lets an unauthenticated attacker with network access, over multiple protocols, compromise the JVM through APIs exposed in that component. Oracle rates it difficult to exploit, but a successful attack grants full read and write access to all data the JVM can reach, making it a critical patch-cadence item for any internet-facing Java service.

Mon, 01 Jan 0001 00:00:00 +0000

A flaw in the Scripting component of Oracle Java SE and GraalVM Enterprise Edition lets an unauthenticated attacker with network access compromise the JVM, most commonly through a sandboxed Java Web Start application or applet that loads untrusted code from the internet. A successful attack lets the attacker create, delete, or modify data the JVM has access to, without needing any credentials.

About

Mon, 01 Jan 0001 00:00:00 +0000

We're the industry's only unified runtime platform designed to Shift Left with IAST and Shield Right with RASP. We eliminate the "Protection Gap" by embedding security directly into your application's execution environment in development and production.

Meet the Team

Doug Ennis
Executive Chair & CEO

As the Chief Executive Officer of Waratek, Doug leads a global team of experts to deliver innovative and effective solutions for securing mission-critical applications.

Padraic Gaffney
Chief Financial Officer

Padraic brings 20+ years' experience in finance, accounting, and strategic planning at start-ups and SMB's. Padraic is also responsible for legal and corporate secretarial.

Blog-Page

Mon, 01 Jan 0001 00:00:00 +0000

FAQs

Mon, 01 Jan 0001 00:00:00 +0000

FAQs

Waratek IAST

What makes Waratek IAST different from traditional DAST or SAST?

Unlike SAST (which looks at idle code) or DAST (which probes from the outside), Waratek IAST works from within the application. It uses runtime instrumentation to observe data flow and execution paths in real-time, providing the precision of code-level analysis with the functional context of a live attack.

How does Waratek IAST handle false positives?

Because Waratek operates inside the JVM, it only flags vulnerabilities that are actually reachable and executable in a running environment. This results in near-zero false positives, allowing your team to focus on legitimate risks rather than chasing "ghost" vulnerabilities.

IAST

Mon, 01 Jan 0001 00:00:00 +0000

Secure AI-Generated Code at the Speed of Development

Using AI to accelerate software delivery solves one problem - coding time - but it creates a new challenge: securing code that humans didn't write.

Waratek IAST provides the critical safety net for AI-driven development:

AI-generated code often introduces subtle vulnerabilities, insecure defaults, and complex logic flaws that traditional security tools struggle to detect and humans struggle to review.

Eliminate AI Hallucinations: Validate that AI-suggested libraries and coding patterns are secure within your specific runtime environment.
Zero-Gap Coverage: Waratek IAST monitors the actual behavior of the code, catching real vulnerabilities as they manifest during execution that other testing tools miss due to lack of runtime visibility.
Developer-First Feedback: Provide your team with instant, high-fidelity alerts with context-rich metadata. If the AI writes a vulnerability that is exploitable, Waratek finds it during the first test run, complete with the stack trace needed to remediate it.

Waratek IAST Outperforms the Rest

SAST (Static Analysis): Scans dead code, resulting in high false-positive rates and "vulnerability fatigue" for developers. It cannot see how code behaves in production.
DAST (Dynamic Analysis): Acts as a "black box" that crawls the outside of an app. It misses deep logic flaws and provides no code-level visibility for fixes.

Why is Waratek IAST a more accurate testing tool?

Waratek IAST outperforms traditional SAST and DAST by monitoring the application during actual execution. This "Interactive" approach eliminates the noise of false positives, allowing developers to focus on real risks.

IAST+RASP

Mon, 01 Jan 0001 00:00:00 +0000

The Perfect Security Combo:
IAST + RASP

By combining Shift Left and Shield Right strategies, Waratek creates a self-reinforcing security ecosystem.

What are the benefits of combining IAST and RASP?

Intelligence Sharing: Vulnerabilities found by IAST help inform RASP's protection rules.

Reduced Security Debt: Shield vulnerabilities in production while developers fix them in the next sprint.

Continuous Compliance: Real-time documentation for PCI DSS, HIPAA, and GDPR.

Strategic Advantage for CISOs

Legal

Mon, 01 Jan 0001 00:00:00 +0000

Legal

Terms of Use

Trademarks

The following are trademarks of Waratek Limited and may not be used without written permission:

Waratek®, Replicode®, CloudVM™, Waratek AppSecurity for Java™, Waratek Locker™, ElastiCat™, Waratek Patch™, Waratek Secure™, Waratek Upgrade™,Waratek Enterprise™, Waratek ARMR™,Name Space Layout Randomization (NSLR)™, Waratek Security Rules Editor™, Java Virtual Container™, Secure Java Container™, BYOS™, jSleep™, JMotion™, Jirsh™, JMirror™ and JHybernate™

Governance

Waratek Ltd is an Irish private limited company based in Dublin, Ireland.

RASP

Mon, 01 Jan 0001 00:00:00 +0000

Waratek RASP: Adaptive Shield Right Defense

Protect Your Production with Autonomous RASP.

Waratek RASP (Runtime Application Self-Protection) provides a "Shield Right" defense that observes how application code executes and blocks any attempt to alter its intended behavior.

How does RASP block AI-driven attacks?

Modern AI-driven and "Agentic" threats use polymorphic techniques to bypass traditional signatures. Waratek RASP is immune to these tactics because it monitors execution intent.

Behavioral Observation: RASP tracks how the code should run.

Request a Demo

Mon, 01 Jan 0001 00:00:00 +0000

Stop Vulnerabilities at the Source.
Block Attacks at Runtime.

See how Waratek's compiler-based security platform catches what other tools miss - during development and in production.

Define Once. Secure Constantly.

Home on Waratek

Oracle Releases the July 2026 Critical Patch Update

Commentary

Can We Bridge the 42% Perception Gap? Aligning the C-Suite and the SOC

Summary

Introduction: Is There A Visibility Crisis in the Boardroom?

Oracle Releases Significant June Security Update

Key findings - Oracle CSPU June 2026

Top risk products (Critical CVEs)

Family-level highlights

Waratek Appoints Apostolos Giannakidis as Chief Technology Officer

Remediation Crisis: Why 62% of AI Flaws Go Unfixed

Oracle Launches Monthly Security Patching

Highlights

What Changed: Oracle’s New Monthly Cadence

Waratek IAST + RASP is Insurance Against AI Risk

Executive Highlights

Mythos Doesn’t Need CVEs: Defending against AI Zero-Days

Highlights:

The Engineering Reality of “Machine-Speed” Exploitation

Runtime Reality vs AI Hallucinations in AppSec

Key Highlights

Is Your Security Blind to the Party Inside Your App?

Why Your Security Team Needs to Move at AI Speed

Oracle Releases April 2026 Critical Patch Update

Highlights

Commentary

Moving at the Speed of Thought & No Security Debt

Highlights

The New Bottleneck: “Can I Trust This?”

Goldilocks Security: The “Just Right” AppSec Tool

Highlights:

Waratek Redefines Secure Development with Launch of Waratek IAST at JavaOne 2026

Trust, but Verify: AI Code Supply Chain Security

Waratek Selected for Ireland INC US 250 Index 2024

About

We're the industry's only unified runtime platform designed to Shift Left with IAST and Shield Right with RASP. We eliminate the "Protection Gap" by embedding security directly into your application's execution environment in development and production.

Meet the Team

Doug EnnisExecutive Chair & CEO

Padraic GaffneyChief Financial Officer

Blog-Page

FAQs

FAQs

Waratek IAST

IAST

Secure AI-Generated Code at the Speed of Development

Waratek IAST provides the critical safety net for AI-driven development:

Waratek IAST Outperforms the Rest

Why is Waratek IAST a more accurate testing tool?

IAST+RASP

The Perfect Security Combo:IAST + RASP

What are the benefits of combining IAST and RASP?

Strategic Advantage for CISOs

Legal

Legal

Terms of Use

RASP

Waratek RASP: Adaptive Shield Right Defense

How does RASP block AI-driven attacks?

Request a Demo

Stop Vulnerabilities at the Source.Block Attacks at Runtime.

Doug Ennis
Executive Chair & CEO

Padraic Gaffney
Chief Financial Officer

The Perfect Security Combo:
IAST + RASP

Stop Vulnerabilities at the Source.
Block Attacks at Runtime.