In Oracle’s latest quarterly security update, 174 products with 401 CVE identified bugs were patched, some dating back to 2017. Among the identified bugs, one in particular is of high interest to companies leveraging Java applications. The vulnerability, identified as CVE-2022-21449 and dubbed “Psychic Signatures,” allows remote code execution (RCE) in programs that utilize Java’s Elliptic Curve cryptography functions. It was discovered in November 2021 by the security researcher Neil Madden. Typically, when verifying a piece of information using cryptography, a private key is needed to prove the information was signed by the owner of the private key and was not changed. The researcher found that when passed a completely blank private key (a memory buffer filled with “0”s), the function flagged the information as valid. An attacker utilizing this exploit can modify signed information then resign it with a blank key to keep the validity of the data. Unlike the Log4Shell bug, which was only exploitable if Log4j was included in the code, Psychic Signatures exists within the standard library and can potentially infect any application that uses Elliptic Curve cryptography. To mitigate the vulnerability, users should update to the latest versions of Java 7, 8, and 11. Oracle is known for not following the trend of monthly security updates that companies such as Microsoft, Adobe, and Google follow. Due to this infrequent update schedule, organizations must stay on top of Oracle product updates as vulnerabilities in these applications could be in threat actors’ hands for months before a patch is issued.