Tighten DB Hardening, Patch Timelines, and Excel Connector Migration Plans

What happened

Researchers described an Oracle database compromise where attackers used SQL injection against a public web app and then uploaded a Java post‑exploit toolkit directly into the database. The concrete operational detail: full patching would not have stopped the attack because the toolkit relied on in‑DB Java execution privileges, so disabling compile/Java and tightening DB privileges is decisive. Watch whether vendors change default DB feature settings or publish mitigation guidance for in‑DB code execution

Why the category manager should care

Treat this as an operational pattern that needs contractual and configuration controls, not just a patching checklist

Key facts

• Attack chain: SQL injection into a public web app followed by Java toolkit loaded into Oracle DB
• Full vendor patching would not have prevented the incident

What happened

CISA issued a three‑day patching deadline for a max‑severity Oracle HTTP Server/WebLogic proxy plug‑in (CVE‑2026‑21962), signaling regulatory willingness to force compressed change timelines. The operational constraint is immediate pressure on hosting and managed‑service change windows and the need for tested rollback and staging procedures to avoid outages. Watch supplier maintenance notices and whether vendors require emergency maintenance charges tied to the directive

Why the category manager should care

Prepare suppliers and contracts for compressed patch timelines and require rollback/testing capability to limit outage risk

Key facts

• CISA issued a three‑day patching deadline for CVE‑2026‑21962
• Flaw affects Oracle HTTP Server and WebLogic Server Proxy Plug‑in at max severity

What happened

Microsoft warned that the Exchange connector used by Excel Power Query will be retired and that existing workbooks won't automatically transition to the new connectors. The concrete operational detail: affected workbooks need manual reconnection and users will require Microsoft 365 or Office 2024 to use the new connectors, creating distributed migration and license work. Watch Microsoft’s follow‑up guidance on Contacts and Tasks scenarios to finalize migration scope

Why the category manager should care

Plan owner engagement and potential client upgrades; this is a distributed remediation project, not a simple patch

Key facts

• Exchange Web Services connector retirement announced for Excel Power Query
• New connectors require Microsoft 365 or Office 2024 and manual reconnection of workbooks

What happened

Perplexity introduced a local‑first AI offering that runs local models on an NVIDIA DGX Spark workstation with cloud fallback, claiming comparable accuracy while avoiding per‑token API fees. The key procurement detail: the approach depends on specific hardware (DGX Spark) and vendor claims about token usage and accuracy that need empirical validation. Watch for partner or funding moves that could change pricing, bundling, or availability of local inference stacks

Why the category manager should care

Run a bounded POC to validate performance, TCO, and data‑residency benefits before committing to hardware and vendor lock‑in

Key facts

• Portable Computer uses an NVIDIA DGX Spark workstation with local models and cloud fallback
• Positioned to avoid per‑token API fees and keep sensitive data on‑device

What happened

Research finds the number of large domains running self‑hosted email has roughly halved over a decade, with Google Workspace and Microsoft gaining large shares. The operational detail: new or migrated mail systems face higher acceptance and deliverability hurdles because major providers operate aggressive filters that can silently drop legitimate mail. Watch deliverability failure modes and require remediation commitments in vendor agreements

Why the category manager should care

Validate deliverability and remediation commitments with major mail providers and include acceptance tests for critical notification channels

Key facts

• Share of top domains running self‑hosted mail has declined markedly, concentrating delivery w
• Deliverability and filter enforcement by large providers make getting new or migrated mail ac