Wednesday’s tax update lands on top of September’s CSPU. Stacked calendars are the leadership problem.

Tax Update 26-C is still aimed at Wednesday, September 30 — delivered through the HCM Weekly PRP, not an Image. Thirteen days earlier, Oracle shipped the September CSPU: 673 patches, PeopleSoft row 16 / 4 unauthenticated. Next cumulative security Tuesday is October 20 (CPU).

Most shops are still proving September is installed. Payroll cannot wait for that argument to finish. That is not a PeopleSoft problem. That is a change-window capacity problem.

Let’s get into it.

Subscribe now

🔐 Score Is Not Exposure — Order the Work by Reachability

🔗 Oracle’s September 2026 CSPU: 673 security patches (Marc-Frédéric Gomez) https://blog.marcfredericgomez.com/oracles-september-2026-cspu-673-security-patches/

September 16, 2026. Independent teardown of Rev 1. Headline numbers match Oracle: 673 patches across 16 product families / 17 matrices; 247 remotely exploitable without authentication (36.7% — sum of matrix openers, not a vendor total). Six CVEs at 10.0. PeopleSoft row in his table: 16 patches, 4 remote-without-auth, top score 8.8. Closing rule worth putting on the CAB whiteboard: the column that orders the work is not the score — it is protocol + unauthenticated exploitation, crossed with what is actually reachable.

🔗 Oracle Critical Security Patch Update Advisory — September 2026 (Oracle) https://www.oracle.com/security-alerts/cspusep2026.html

Still Rev 1, initial release 2026-09-15. PeopleSoft executive summary unchanged: 16 new security patches; 4 remotely exploitable without authentication. PeopleTools 8.61–8.63 still named. Next four security Tuesdays from the same page and the security-alerts calendar: 20 October 2026 (CPU), 17 November 2026 (CSPU), 15 December 2026 (CSPU), 19 January 2027 (CPU).

🔗 Oracle September 2026 CSPU — 672 CVEs, 104 Critical (ThreatAft) https://threataft.com/articles/oracle-september-2026-cspu-mass-disclosure

September 16, 2026. Tally aligns with Tenable’s cut: 672 unique CVEs in 673 patches; 104 critical (15.5%); high severity 74.7%. Priority callout sits on Fusion Middleware identity/runtime (Access Manager, WebLogic T3/IIOP, Internet Directory) — useful if your PeopleSoft estate still trusts those layers.

🔗 Oracle critical patch updates highlights growing patch fatigue (The IT Nerd / Tyler Reguly, Fortra) https://itnerd.blog/2026/09/16/oracle-critical-patch-updates-highlights-growing-patch-fatigue/

September 16, 2026. Reguly’s framing: patch-everything vs patch-minimally vs prioritize-then-patch camps are colliding while monthly volume stays high. Practical test he cites from CISA BOD 26-04: publicly exposed, on the KEV list, automatable, complete control. Also blunt on Oracle complexity — tooling that cannot inventory assets and patch level is the wrong axe.

My read: Ed.37 named the doors (Business Interlink CVE-2026-73954 at 8.1 unauth, Ren Server CVE-2026-73960 at 7.5 unauth, Integration Broker CVE-2026-87264 at 7.7). This week the argument is sequencing. If your CAB still sorts by CVSS alone, you will patch the loud score and miss the reachable row. October 20 is cumulative — everything you deferred in May–September rides into a heavier qualification cycle.

💸 Wednesday Is Payroll — Sep 30 Does Not Move for Your CSPU Backlog

🔗 PeopleSoft Payroll for North America Tax Update 26-C Delivery Moves to September (Oracle / Anne Leung) https://blogs.oracle.com/peoplesoft/peoplesoft-payroll-for-north-america-tax-update-26-c-delivery-moves-to-september

August 20, 2026. Tax Update 26-C targeted for Wednesday, September 30, 2026 through the HCM Weekly PeopleSoft Release Patchset. HCM Image 56 (November target) carries Tax Update 26-D (first year-end set). Weekly HCM PRPs continue through December 2026 and January 2027 — regular HCM patches that also carry Payroll for North America updates, not a separate tax package. Bookmark MOS FAQ2322. Advisor webcast usually one to two weeks after delivery (KB168951).

🔗 Preparing PeopleSoft Suppliers for 2026 1099 Reporting (Oracle / Alicia Kinsey) https://blogs.oracle.com/peoplesoft/preparing-peoplesoft-suppliers-for-2026-1099-reporting

August 13, 2026. For suppliers marked for Withholding with TIN Type SSN, populate Withholding Name 1 / Name 2 as first / last name on a new effective-dated address row. Required for IRS IRIS. Bulk path: ExcelToCI via VNDR_ID_EXCEL; rerun TIN Matching after updates. Bookmark KB878101.

🔗 Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins (Oracle) https://www.oracle.com/security-alerts/

Confirms the next quarterly CPU: 20 October 2026. Pre-release announcement publishes the Thursday before. September CSPU remains at Rev 1 as of this writing; August reached Rev 4 in seventeen days — watch for revisions.

My read: Sep 15 was security Tuesday. Sep 30 is payroll Wednesday. Oct 20 is the cumulative CPU. Three different owners usually fight for the same two change windows. If your whiteboard only tracks Images, all three arrive as emergencies.

🤖 Agentic AI Needs Decision Rights Before It Touches ERP Data

🔗 Five Decision Rights CIOs Need for Agentic AI (Architecture & Governance / Sanjeeve Kumar Gajadi) https://www.architectureandgovernance.com/artificial-intelligence/five-decision-rights-cios-need-for-agentic-ai/

September 25, 2026. Practical matrix for production agents: authorization, data access, human intervention, exception handling, accountability — each with a named owner, enforceable control, and reviewable evidence. Explicitly maps to NIST AI RMF, ISO/IEC 42001, and EU AI Act oversight expectations. Core test on authorization: can you explain why the agent was allowed to perform each consequential action?

🔗 How CIOs Can Govern AI Agents at Scale in 2026 (BCG) https://www.bcg.com/publications/2026/how-cios-govern-ai-agents-at-scale

August 14, 2026. Enterprise AI Control Plane framing: identity, agent/tool registry, runtime policy enforcement, and “golden path” deployment harnesses so the compliant route is the fast one. Failure mode named cleanly — platform-by-platform governance duplicates effort and leaves shadow agents.

My read: PeopleTools 8.63 shipped GenAI options into the same release train that still carries CSPU rows. Before an agent reads or writes payroll, supplier, or IB payloads, name the five rights. “We have a policy” is not the same sentence as “we can stop it, prove who authorized it, and roll it back.”

🧭 Oracle’s Capex Story Is Not Your Patch Calendar — Keep the Columns Separate

🔗 Oracle Announces Q1 Results Driven by Triple Digit Growth in Cloud Infrastructure Revenues (Oracle / PR Newswire) https://www.prnewswire.com/news-releases/oracle-announces-q1-results-driven-by-triple-digit-growth-in-cloud-infrastructure-revenues-302875728.html

September 10, 2026. Q1 FY27: total revenue $19.3B (+30%); Cloud Infrastructure $7.4B (+121%); Cloud Applications $4.2B (+10%); software revenues −3% to $5.5B; Remaining Performance Obligations $664B (+$209B YoY). More than $30B additional AI cloud contracts booked in the quarter; 850MW additional datacenter capacity; 300,000+ GPUs delivered.

My read: Useful board context for hosting and capacity conversations. Useless as a reason to skip Wednesday’s tax PRP or Tuesday’s matrix. Keep OCI growth in the infrastructure column. Keep CSPU / 26-C / IRIS in the operations column.

💬 Aaron’s Take

The vendor published three clocks that all land inside four weeks. Four concrete things:

• Prove September CSPU is installed on every 8.61 / 8.62 / 8.63 environment before you argue about 26-C sequencing. Start with the unauthenticated PeopleSoft rows (Business Interlink CVE-2026-73954, Ren Server CVE-2026-73960), then Integration Broker (CVE-2026-87264). Order remaining work by reachability, not CVSS alone.

• Treat Sep 30 as a hard payroll window. 26-C rides a Weekly PRP. Bookmark FAQ2322. Put it on the same whiteboard as Sep 15 and Oct 20.

• Do not let IRIS wait for January. Withholding Name 1/2 for SSN TIN types; new IRIS TCC (45+ days); A2A PeopleTools floors are published. Bookmark KB878101.

• If AI agents will touch ERP data, assign the five decision rights in writing this week — authorization, data access, human intervention, exception handling, accountability — with named owners and kill-switch evidence.

This is not a “PeopleSoft is old” problem. It is a change-calendar and attack-surface problem. Support runway buys time. It does not buy a free pass on Wednesday’s PRP.

🌐 Join the Community

Subscribe to PeopleSoft Cloud for the Monday Digest — no vendor spin, just what changed and what to do about it.

✅ Monday: what moved in the PeopleSoft, Oracle and ERP world, with a read on why it matters
✅ Written by a practitioner who still has to make the change window

Ask which hosts can reach /PSIGW/HttpListeningConnector, whether ANONYMOUS still runs as a superuser, which nodes still have AUTHOPTN = N, and whether the PSKEY password is still password — and you will get a pause.

That pause stopped being theoretical on August 18. CVE-2026-60831 (CVSS 8.1, PeopleTools 8.61–8.63, Integration Broker) lets an unauthenticated attacker with HTTP access attempt takeover. Oracle rated it difficult. Successful attacks still mean full compromise.

🔗 CVE-2026-60831 (Tenable) https://www.tenable.com/cve/CVE-2026-60831

🔗 Oracle Critical Security Patch Update Advisory — August 2026 (Oracle) https://www.oracle.com/security-alerts/cspuaug2026.html

And the path is not new. Trend Micro’s June write-up of CVE-2026-35273 put the same gateway in writing: unauthenticated POST /PSIGW/HttpListeningConnector as the SSRF entry that reached an internal hub. Waratek’s August CSPU analysis put /PSIGW/ next to the published indicators from the ShinyHunters campaign.

🔗 PeopleSoft PeopleTools Pre-Authentication RCE (Trend Micro) https://www.trendmicro.com/en/research/26/f/PeopleTools.html

🔗 Oracle Ships Its Largest Monthly Security Update (Waratek) https://waratek.com/news/oracle-largest-monthly-security-update/

Patching closes one CVE. Boring Integration Broker closes the class. Here are five ways to replace the shrug with evidence.

Subscribe now

1. Prove who can reach /PSIGW/ — from outside your diagram

Not a network diagram. An evidence pass: for every web tier, record whether HttpListeningConnector answers from the internet, from partner networks, and from internal subnets that should never talk to the gateway.

Trend’s first recommendation after the June chain: take /PSIGW/HttpListeningConnector off untrusted networks and put the Integration Broker gateway behind controls that restrict who can reach it. Waratek’s August note is the same door with a new CVE number attached.

Write the result as a table: environment, hostname, external DNS, last external probe date, allow-list owners. If the table does not exist, you do not have an IB exposure control. You have hope.

Also break the old SSRF pivot while you are there: segment the gateway from PSEMHUB so a gateway-originated loopback cannot satisfy validateClient. That is Trend’s second recommendation — still relevant after the June patch if your network topology never changed.

2. Prove August’s IB patch is installed — then stage Tuesday’s CSPU

“We applied August” is a claim. The artifact is the PeopleTools patch level that includes CVE-2026-60831, on every 8.61 / 8.62 / 8.63 environment that runs a gateway.

Oracle’s September CSPU pre-release is already live: 714 patches overall; PeopleSoft 16 patches, 4 unauthenticated, ceiling 8.8; PeopleTools 8.61–8.63 listed again. Release is Tuesday, September 15.

🔗 Oracle Critical Security Patch Update — September 2026 Pre-Release (Oracle) https://www.oracle.com/security-alerts/cspusep2026.html

For each environment: August IB patch yes/no, current PeopleTools maintenance level, Sep 15 CAB owner, rollback owner. Until that file exists, “we’re current” is storytelling.

3. Make ANONYMOUS boring — or turn it off where it should be

If a client hits the gateway without node credentials, Integration Broker falls back to the ANONYMOUS node and runs as that node’s Default User ID. Cedar Hills Group’s Missing Manual and Integrigy’s IB checklist both draw the same red line: that default user must not be PS, VP1, or any other high-privilege profile, and the routings attached to ANONYMOUS must be the short list of operations you actually intend to expose without credentials.

🔗 Properly Securing the ANONYMOUS IB Node (Cedar Hills / Integration Broker: The Missing Manual) https://ib.books.cedarhillsgroup.com/security/anonymous-node-security/

🔗 PeopleSoft Integration Broker (IB) Security (Integrigy) https://www.integrigy.com/security-resources/peoplesoft-integration-broker-ib-security

Concrete pass this week: open the ANONYMOUS node, record the Default User ID, export its Web Service Security, list active Any-to-Local or anonymous-facing routings, and kill anything that does not belong in production (PTF messages are a common leftover). Create a dedicated least-privilege user if you still need anonymous fall-back at all.

4. Kill AUTHOPTN = N and Any-to-Local — one node at a time

psLens put the quiet finding in writing: a node with AUTHOPTN = 'N' accepts messages without authenticating the sender. Cedar Hills’ node best practices are blunt: never use authentication option “none,” never share one node across partners, give each node a unique Default User ID with no interactive login, and never use Any-to-Local routings when you can name the endpoints.

🔗 Your PeopleSoft Nodes Probably Don’t Have Passwords (psLens) https://pslens.com/blog/peoplesoft-nodes-without-passwords/

🔗 Node Best Practices (Cedar Hills / Integration Broker: The Missing Manual) https://ib.books.cedarhillsgroup.com/nodes/node-security-best-practices/

Query PSMSGNODEDEFN for active nodes with AUTHOPTN = 'N' (or password auth with an empty password — functionally the same). Cross that list to inbound routings. Fix DEV first; a mismatched node password is a quiet way to break an interface, which is exactly why shops leave auth off. The dated CSV — node, auth option, default user, inbound routing count — is the control. “Nodes look fine” is not.

5. Change the default PSKEY and put encrypted keystore passwords in writing

Integrigy’s quick reference is still the shortest version: the PSKEY keystore holds root and node certificates for the Integration Gateway and PIA; the default password is password. Change it with pskeymanager (pskeymanager.sh -changeKeystorePassword), then update the encrypted secureFileKeystorePasswd in the gateway properties and WebLogic.

Oracle’s PeopleTools docs make the failure mode explicit: integrations fail if secureFileKeystorePath and an encrypted secureFileKeystorePasswd are missing. Require TLS for inbound requests while you are in the same change window.

🔗 Configuring Security and General Properties (Oracle PeopleTools documentation) https://docs.oracle.com/cd/G41075_01/pt862pbr3/eng/pt/tiba/ConfiguringSecurityandGeneralProperties-497d0b.html

Artifact: date of last PSKEY password change, who owns the keystore, proof the gateway property is encrypted (not cleartext), and TLS required for inbound. If that page is blank, your certificate story is still the install default.

Do this once, then make it an artifact

Five files, not five opinions: the /PSIGW/ exposure table, the August-IB / Sep-15 patch matrix, the ANONYMOUS user-and-routing export, the AUTHOPTN/Any-to-Local CSV, and the PSKEY/keystore change record.

Re-run the exposure probe and the node query after every CSPU. The diff is the control. “Integration Broker is hardened” is not.

Monday’s Digest covered why this week is the deadline: September CSPU pre-release with 714 patches and PeopleSoft back on the list (16 patches, 4 unauthenticated, ceiling 8.8, PeopleTools 8.61–8.63); August’s CVE-2026-60831 still sitting on Integration Broker at CVSS 8.1; /PSIGW/ still the path Waratek and Trend keep naming; Tax Update 26-C still aimed at September 30.

Next Thursday: 5 ways to model the real cost of staying on PeopleSoft.

🌐 Join the Community

Subscribe to PeopleSoft Cloud — practitioner posts every Thursday, the Modern ERP Digest every Monday.

✅ Concrete actions you can run this week, not advice ✅ Sources cited, costs stated honestly ✅ Free, always

Tuesday’s CSPU pre-release already put PeopleSoft back on the patch list. Integration Broker is still how you get owned.

Oracle published the September 2026 Critical Security Patch Update pre-release. Headline number: 714 new security patches. PeopleSoft row: 16 patches, 4 remotely exploitable without authentication, ceiling 8.8. PeopleTools 8.61–8.63 are still listed. VirtualBox is back too — version 7.2.16.

That lands Tuesday, September 15. Two days after this Digest. Last month’s IB finding did not age out because you were busy with AI slides.

Let’s get into it.

Subscribe now

🔐 Sep 15 Is Not Optional Homework

🔗 Oracle Critical Security Patch Update Advisory — September 2026 Pre-Release (Oracle) https://www.oracle.com/security-alerts/cspusep2026.html

Pre-release for the Tuesday, September 15, 2026 CSPU. 714 new security patches across the product families named in the announcement. Numbers can still move before the full advisory. PeopleSoft executive summary in the same document: 16 new security patches; 4 remotely exploitable without authentication; highest CVSS 8.8. Products named: PeopleSoft Enterprise PeopleTools 8.61–8.63, plus CC Common Application Objects 9.2, FIN Engineering Brazil 9.1, FIN Inventory Brazil 9.1, and PRTL Interaction Hub 9.1. Virtualization: Oracle VM VirtualBox 7.2.16.

🔗 Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins (Oracle) https://www.oracle.com/security-alerts/

Confirms the CSPU cadence and the live pre-release listing for September 2026. Next four security Tuesdays from the same page after Sep 15: 20 October 2026 (CPU), 17 November 2026 (CSPU), 15 December 2026 (CSPU), 16 February 2027 (CSPU). August 2026 CSPU remains Rev 4, 4 September 2026.

My read: Pre-release is the planning document. If your CAB still waits for the full matrix on Tuesday morning, you are inventing a two-day delay Oracle already removed. Put PeopleTools 8.61–8.63 and VirtualBox 7.2.16 on the agenda before the advisory posts.

🧰 Integration Broker Did Not Stop Being the Path

🔗 CVE-2026-60831 (Tenable) https://www.tenable.com/cve/CVE-2026-60831

August 18, 2026 disclosure. PeopleSoft Enterprise PeopleTools, component: Integration Broker. Versions 8.61–8.63. Unauthenticated attacker with network access via HTTP. Successful attacks can result in takeover. CVSS 3.1 8.1 — AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Fixed in the August CSPU.

🔗 Oracle Critical Security Patch Update Advisory — August 2026 (Oracle) https://www.oracle.com/security-alerts/cspuaug2026.html

Still live at Rev 4 as of September 4, 2026. 943 new security patches across the listed product families. PeopleSoft Enterprise PeopleTools 8.61–8.63 remain on the affected-products list. Next security Tuesday from that advisory: 15 September 2026 (CSPU).

🔗 Oracle Ships Its Largest Monthly Security Update (Waratek) https://waratek.com/news/oracle-largest-monthly-security-update/

August 19, 2026 analysis of the August CSPU risk matrices. PeopleSoft tally: 15 patches, 7 unauthenticated, ceiling 9.8. The 9.8 is CVE-2026-60821 in Business Interlink. Two further unauthenticated issues in the integration layer: CVE-2026-60831 in Integration Broker at 8.1, and CVE-2026-60742 in PIA Core Technology at 8.1. Waratek notes Integration Broker is reached through the /PSIGW/ path that appeared in published indicators for the ShinyHunters campaign — so shops that hardened those endpoints in June still need to verify the controls after patching.

🔗 PeopleSoft PeopleTools Pre-Authentication RCE: A PSIGW SSRF Chain That Executes Inside the JVM (Trend Micro) https://www.trendmicro.com/en/research/26/f/PeopleTools.html

June 18, 2026 technical write-up of CVE-2026-35273 (CVSS 9.8). The entry point that mattered: unauthenticated POST /PSIGW/HttpListeningConnector, then an SSRF pivot into the internal PSEMHUB hub. First recommendation after patching: take the listening connector off untrusted networks and put the Integration Broker gateway behind controls that restrict who can reach it.

My read: August closed one IB CVE. June’s campaign already proved /PSIGW/ is the door adversaries try first. “We patched CVE-2026-35273” is not the same sentence as “IB is boring.” Exposure review, node auth, and routing inventory are still the compensating controls.

💸 The Tax Calendar Did Not Move for CSPU Week

🔗 PeopleSoft Payroll for North America Tax Update 26-C Delivery Moves to September (Oracle / Anne Leung) https://blogs.oracle.com/peoplesoft/peoplesoft-payroll-for-north-america-tax-update-26-c-delivery-moves-to-september

August 20, 2026. Tax Update 26-C targeted for Wednesday, September 30, 2026 via the HCM Weekly PRP. HCM Image 56 (November target) carries Tax Update 26-D (first year-end set). Weekly HCM PRPs continue through December 2026 and January 2027. Bookmark MOS FAQ2322.

My read: Same finding as Ed.34 and Ed.35. Sep 15 is security Tuesday. Sep 30 is payroll Wednesday. If your change calendar only tracks Images, both arrive as surprises.

💬 Aaron’s Take

Oracle did not hide the calendar. Pre-release named PeopleSoft. August already named Integration Broker. Three concrete things this week:

• Treat Tuesday’s CSPU as a PeopleTools event, not a Database event. Pre-release: 16 PeopleSoft patches, 4 unauthenticated, ceiling 8.8, PeopleTools 8.61–8.63 listed. Put it on the CAB before the full advisory posts.

• Prove August’s IB patch is actually installed — then re-check /PSIGW/. CVE-2026-60831 is Integration Broker, unauthenticated HTTP, CVSS 8.1, versions 8.61–8.63. Waratek and Trend both point at the gateway path. If HttpListeningConnector is still internet-reachable, you still have an exposure finding.

• Keep Sep 30 (26-C) on the same whiteboard as Sep 15. Weekly PRP, not an Image. Bookmark FAQ2322.

• Thursday is five ways to make Integration Broker boring again — exposure, patch proof, ANONYMOUS, node auth, and keystore defaults turned into artifacts.

This is not a “PeopleSoft is old” problem. It is an attack-surface-management problem. The vendor publishes the door. Your shop still owes the lock inventory.

🌐 Join the Community

Subscribe to PeopleSoft Cloud for the Monday Digest and Thursday practitioner posts — no vendor spin, just what changed and what to do about it.

✅ Monday: what moved in the PeopleSoft, Oracle and ERP world, with a read on why it matters
✅ Thursday: five verifiable actions you can run this week, free, every week
✅ Written by a practitioner who still has to make the change window

Ask which LLM is approved, which record groups may leave the tenancy, who owns the prompt log, and who can flip MCP on in production — and you will get a pause.

That pause stopped being a future-state workshop on July 29. Sasank Vemana shipped PeopleTools 8.63 on OCI with three AI surfaces in writing: Natural Language Search Service, Model Context Protocol (MCP) server support, and Application Designer AI Assist. Mike Krajicek said the quiet part on camera: Oracle is not handing you a finished assistant. You supply the model, the subscription, and the security review.

🔗 Oracle releases PeopleTools 8.63 on OCI (Oracle) https://blogs.oracle.com/peoplesoft/peopletools-863-generally-available

🔗 What’s New in PeopleTools 8.63 (PeopleSoft Career) https://blog.peoplesoftcareer.com/whats-new-in-peopletools-8-63/

“Preserving PeopleSoft security and user context” is the marketing line. It is not a data-classification policy, a retention rule, or an audit trail of what the agent touched. Here are five questions that turn the shrug into a go/no-go.

Subscribe now

1. Which data classes may leave the building — in writing?

Not “we follow least privilege.” The list: employee SSN and bank data, candidate PII, supplier TIN and withholding names, GL detail, payroll results, student records if you run Campus. For each class: allowed in prompts, allowed in search-index answers, allowed as MCP tool output, or never.

If the answer is “MCP respects row-level security,” you answered a different question. RLS decides who can see a row inside PeopleSoft. It does not decide whether that row may be serialized into a model provider’s context window, a vendor prompt log, or a developer’s IDE plugin.

Write the matrix. Date it. Name an owner. Without that file, every AI demo is an unapproved egress path.

2. Which LLM is approved — and where does the prompt log live?

8.63 is pluggable on purpose. App Designer AI Assist and the chat/search components wait on the model you wire up. SMACT’s planning guide says the quiet part: establish LLM selection and data governance before enabling AI Assist or exposing PeopleSoft data through MCP.

🔗 Oracle PeopleTools 8.63: AI, Security, and Upgrade Planning Guide (SMACT Works) https://www.smactworks.com/insights/blogs/2026/08/peopletools-8-63-guide.html

For the approved model, answer in one page: vendor, region, retention, whether training uses your prompts, DPA status, and who can read the logs. If two developers are already pointing Cline or Aider at a personal key, that is not a pilot. That is shadow IT with PeopleCode in the payload.

My read: “Bring your own LLM” is not freedom until procurement and InfoSec finish the same sentence.

3. What is the blast radius if the agent is wrong — or prompt-injected?

Separate read from write. Natural-language search that returns secured results is a different risk class from an MCP tool that can post a voucher, change direct deposit, or update a supplier TIN.

For every MCP tool or magic-button package you plan to expose: is it read-only, does it mutate, and what compensating control sits in front of the mutation (dual control, workflow, TOTP step-up)? 8.63’s TOTP API exists specifically so you can demand a second factor at a sensitive event — direct deposit, SSN lookup — not only at sign-on. Use it.

Also name the failure mode: hallucinated PeopleCode merged to production, an agent that summarizes performance comments into a channel it should not see, a tool description that tricks the model into calling a broader API. If you cannot describe the failure, you cannot monitor for it.

4. Who can enable the feature — and how do you prove what it touched?

Treat AI surfaces like Integration Broker nodes, not like a browser extension.

Inventory, in writing: which environments have MCP enabled, which App Designer clients have AI Assist configured, which magic buttons are live on which pages, which service accounts the agent uses, and which roles can change that config. Export the config. Put it in the same change record you would use for a new IB routing.

Then define the audit artifact before go-live: timestamp, calling identity, tool or prompt, objects touched, success/fail. “We can check WebLogic logs” is not an audit trail. If you cannot answer who asked what about which employee on which day, you are not ready for production HR or Payroll context.

5. What is the smallest non-production pilot that earns a production decision?

Not a town hall. A charter with a start date, an end date, a dataset that is scrubbed or classified as allowed, success metrics, and a written go/no-go.

Good first pilots: App Designer AI Assist against a non-prod project that contains no employee PII; Natural Language Search against a scrubbed index; one read-only MCP tool that returns a non-sensitive lookup. Bad first pilots: production Payroll Q&A, supplier TIN cleanup via an agent, or “let the intern wire Claude to HCM.”

Write the kill criteria in the same document: unexpected data in a prompt log, a mutation without workflow, a model region change, or a missing audit row. If the pilot cannot fail, it is a demo.

Do this once, then make it an artifact

Five artifacts, not five opinions: the data-class matrix, the approved-LLM one-pager, the read-vs-write blast-radius list, the enablement/audit inventory, and a dated pilot charter with kill criteria.

Re-run the inventory every time someone asks to “just turn on MCP.” The diff is the control. “We’re AI ready because we upgraded to 8.63” is not.

Monday’s Digest covered why this landed now: 8.63 GA on OCI put NL Search, MCP, and AI Assist in your upgrade path; Oracle and practitioners both said you supply the model and the security review; August CSPU is at Rev 4 with PeopleTools 8.61–8.63 still listed; Sep 15 CSPU is nine days out.

Next Thursday: 5 ways to make Integration Broker boring again.

🌐 Join the Community

Subscribe to PeopleSoft Cloud — practitioner posts every Thursday, the Modern ERP Digest every Monday.

✅ Concrete actions you can run this week, not advice ✅ Sources cited, costs stated honestly ✅ Free, always

Oracle shipped the AI socket. Your governance is still a shrug.

PeopleTools 8.63 is generally available on OCI. Sasank Vemana put the AI pieces in writing on July 29: Natural Language Search Service, Model Context Protocol (MCP) server support, and Application Designer AI Assist. Mike Krajicek said the quiet part on camera — Oracle is not handing anyone a finished assistant. You supply the model, the subscription, and the security review.

Most shops will still treat “AI ready” as an upgrade checkbox. That is how payroll data ends up in a prompt log nobody owns.

Let’s get into it.

Subscribe now

🤖 8.63 Gave You Plumbing. Not Permission.

🔗 Oracle releases PeopleTools 8.63 on OCI (Oracle / Sasank Vemana) https://blogs.oracle.com/peoplesoft/peopletools-863-generally-available

July 29, 2026. Available on OCI via PeopleSoft Cloud Manager Image 22. On-premises “to follow soon.” The AI line that matters: Natural Language Search Service returns secured PeopleSoft Search results through a REST API. MCP server support gives AI agents “a standards-based way to interact with PeopleSoft through delivered and customer-defined APIs.” Application Designer AI Assist explains code, suggests improvements, troubleshoots issues, generates code, and drafts documentation-style summaries.

Also in the same post: Semantic Search, Typo Tolerance, SAML 2.0, TOTP two-factor, Log Analyzer, Customization Groups, webhooks, Middleware DPK Builder, PeopleTools container images.

My read: Three AI surfaces, one governance problem. Search, App Designer chat, and MCP all move PeopleSoft context toward a model you choose. “Preserving PeopleSoft security and user context” is the claim. The artifact you need is still missing: which data classes may leave the building, which LLM is approved, and who can turn the socket on.

🔗 What’s New in PeopleTools 8.63 (Full Feature Breakdown) (PeopleSoft Career / Derek Tomei) https://blog.peoplesoftcareer.com/whats-new-in-peopletools-8-63/

Tomei’s walkthrough of what Oracle actually shipped versus what shops invent. Mike Krajicek on camera: “Rather than introducing an isolated solution, we’re providing usable components that customers can combine with their AI models and services of their choice.” Three foundation pieces: Chat UI, Natural Language Search Service, MCP server. App Designer Code Assist is Python-based, with working samples for Cline and Aider. The same metadata APIs surface as MCP tools outside App Designer.

The “magic button” is the customer-advisory-board feature: configure it beside a long text field, call an application package, send text to your own LLM, drop the rewrite back on the page — no page customization.

My read: “Nothing answers a question on day one without configuration” is the useful sentence. Configuration without a data-classification answer is just a faster path to a compliance finding.

🔗 Oracle PeopleTools 8.63: AI, Security, and Upgrade Planning Guide (SMACT Works) https://www.smactworks.com/insights/blogs/2026/08/peopletools-8-63-guide.html

August 3, 2026. Hands-on framing after a Cloud Manager upgrade from 8.62 to 8.63 in their COE lab. Same three AI pieces. Explicit guidance: establish LLM selection and data governance before enabling AI Assist or exposing PeopleSoft data through MCP. SAML 2.0 covers IdP-initiated and SP-initiated flows. TOTP can be invoked via API for specific transactions (direct deposit, SSN lookup), not only at sign-on.

My read: Their three starting questions are the right order: where is security exposure highest, where is search friction costing time, and what governance must exist before AI touches production data. Reverse that order and you demo the socket before you own the blast radius.

🔐 The Patch Calendar Did Not Pause for AI

🔗 Oracle Critical Security Patch Update Advisory — August 2026 (Oracle) https://www.oracle.com/security-alerts/cspuaug2026.html

Still the live August advisory. Rev 4 as of September 4, 2026 (product-name cleanup for Clusterware). Headline number on the page: 943 new security patches across the listed product families. PeopleSoft rows still include PeopleSoft Enterprise PeopleTools, versions 8.61–8.63, plus Common Application Objects and FIN Common Objects. Oracle VM VirtualBox 7.2.14 remains on the list.

Next four security Tuesdays, from the same advisory and Oracle’s security-alerts index: 15 September 2026 (CSPU), 20 October 2026 (CPU), 17 November 2026 (CSPU), 15 December 2026 (CSPU). Pre-release for the September CSPU is due the Thursday before — 11 September.

🔗 Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins (Oracle) https://www.oracle.com/security-alerts/

Confirms the CSPU cadence and the next four dates. August 2026 CSPU is listed as Rev 4, 4 September 2026.

My read: Last week the hypervisor under your PUM was the story. This week the calendar is the story. Sep 15 lands nine days after this Digest. If your CAB still treats CSPU as optional between quarterly CPUs, you are inventing a patch policy Oracle already replaced.

💸 IRIS Will Reject the Name Field You Never Separated

🔗 Preparing PeopleSoft Suppliers for 2026 1099 Reporting (Oracle / Alicia Kinsey) https://blogs.oracle.com/peoplesoft/preparing-peoplesoft-suppliers-for-2026-1099-reporting

August 13, 2026. For suppliers marked for withholding with TIN Type SSN, populate Withholding Name 1 = First Name and Withholding Name 2 = Last Name on a new effective-dated address row. IRIS requires first and last names in separate fields for SSN filers. Delivered review SQL against PS_AP_TININQ_VW where TIN_TYPE = 'S'. Bulk path: ExcelToCI with VNDR_ID_EXCEL. After update, TIN Match Status resets to New — rerun TIN Matching. Exception query: AP_TIN_STATUS_CD <> 'M'. Bookmark KB878101.

🔗 IRS FIRE to IRIS: What PeopleSoft Customers Need to Know for 2026 Filings (Oracle / Alicia Kinsey) https://blogs.oracle.com/peoplesoft/irs-fire-to-iris-what-peoplesoft-customers-need-to-know-for-2026-filings

Mandatory for tax year 2026 filings (submitted in 2027). FIRE TCC does not transfer. New IRIS TCC through the IRS Taxpayer Portal; separate codes for A2A and CSV. Portal/CSV cap: 250 records per file. A2A needs JWK plus IRS API Client ID, IRIS ATS testing, and PeopleTools floors with PUM 56: 8.62.07+, 8.61.18+, or 8.60.23+ plus POC 38875082-01. Reporting threshold moves from $600 to $2,000 for most 1099 filings. TCC application: at least 45 days, two responsible officials with ID.me.

My read: This is not a January surprise. It is a supplier-master cleanup you can finish in Q3. Waiting for Image 56 to start the TCC application is how you invent a filing-season outage.

🧰 Calendar Reminder: 26-C Is Still September 30

🔗 PeopleSoft Payroll for North America Tax Update 26-C Delivery Moves to September (Oracle / Anne Leung) https://blogs.oracle.com/peoplesoft/peoplesoft-payroll-for-north-america-tax-update-26-c-delivery-moves-to-september

August 20, 2026. Tax Update 26-C targeted for Wednesday, September 30, 2026 via the HCM Weekly PRP. HCM Image 56 (November target) carries Tax Update 26-D (first year-end set). Weekly HCM PRPs continue through December 2026 and January 2027. Bookmark MOS FAQ2322.

My read: Same finding as Ed.34. Images slow down; weekly PRPs carry the legally dated work. If your change calendar only tracks Images, 26-C arrives as a Wednesday surprise.

💬 Aaron’s Take

Oracle did not hide the boundary. 8.63 is enablement. Fusion gets the agent product. PeopleSoft gets the socket. Three concrete things this week:

• Write the AI data map before anyone enables MCP or AI Assist. Which record groups / search indexes / App Designer projects may leave the tenancy, which LLM is approved, who owns the prompt log, and who can flip the feature on. If that document does not exist, you do not have AI readiness. You have a demo.

• Put Sep 15 CSPU on the CAB agenda now. Pre-release lands ~Sep 11. August is still at Rev 4 with PeopleTools 8.61–8.63 listed. Treat monthly CSPU as the new floor, not optional homework between October’s CPU.

• Start the IRIS TCC and SSN withholding-name cleanup this week. 45-day TCC clock. ExcelToCI on VNDR_ID_EXCEL for NAME1_WTHD / NAME2_WTHD. Rerun TIN Matching. Bookmark KB878101.

• Thursday is five questions to ask before you trust an AI feature with ERP data — before the socket becomes a production egress path.

This is not a “PeopleSoft can’t do AI” problem. It is a governance-latency problem. The vendor shipped the interface. Your shop still owes the rules.

🌐 Join the Community

Subscribe to PeopleSoft Cloud for the Monday Digest and Thursday practitioner posts — no vendor spin, just what changed and what to do about it.

✅ Monday: what moved in the PeopleSoft, Oracle and ERP world, with a read on why it matters ✅ Thursday: five verifiable actions you can run this week, free, every week ✅ Written by a practitioner who still has to make the change window

Ask which Update Image is on it, when it last refreshed, and whether VirtualBox is even patched, and you will get a pause. Then someone remembers the DPK that failed at step 14 last cycle, so they kept the old VM.

Subscribe now

That pause stopped being a lab inconvenience on April 8. Dan Iverson, PeopleTools Strategy Director, wrote that Oracle “will be ending support for the VirtualBox DPK in the near future.” On July 27 he shipped the replacement: FSCM Update Image 57 on containers, and the VirtualBox DPK delivery model “planned to be retired in a future release.”

No date. The successor is already on MOS.

The August CSPU also listed Oracle VM VirtualBox 7.2.14. Tenable’s plugin (338745) calls out CVE-2026-71131 at CVSS 8.6 — unauthenticated local, user interaction, scope change, takeover of the hypervisor your PUM still runs on.

🔗 Coming Soon – PeopleSoft Update Images on Containers (Oracle) https://blogs.oracle.com/peoplesoft/peoplesoft-images-on-containers

🔗 Getting Started with Update Image Containers (Oracle) https://blogs.oracle.com/peoplesoft/getting-started-with-update-image-containers

🔗 Oracle VM VirtualBox (August 2026 CSPU) (Tenable) https://www.tenable.com/plugins/nessus/338745

Patching VirtualBox closes those CVEs. It does not close the format. Here are five ways to leave the hypervisor before Oracle picks the date for you.

1. Inventory every VirtualBox PUM this week, in writing

Not “we have a PUM.” The list: hostname, OS, VirtualBox version, which Update Image, last successful refresh, who owns the machine, and whether RDP is enabled on it (CVE-2026-71130 is the RDP one).

On the lab host:

VBoxManage list vms

VBoxManage list runningvms

VBoxManage --version

Export that to a dated file. Add the MOS patch number you actually downloaded last cycle. If two people say “the PUM” and they mean two different VMs, that is the finding.

You cannot retire what you have not named. The sunset language is “near future” and “a future release.” An inventory is the only artifact that turns that into a project.

2. Install Podman and prove it with podman image ls

Oracle’s path is Podman on Linux, Podman Desktop on Windows. Not Docker. The Getting Started post is the checklist; the Container Installation guide it points at lives with the image.

Install it on the same class of machine you use for PUM today — a workstation, not a fantasy OCI tenancy. Then:

podman image ls

Empty is fine. A command that returns without an argument about PATH is the proof. If Windows, confirm podman compose (no hyphen). If Linux, confirm podman-compose. Mixing those two is how the first afternoon dies.

My read: Podman fluency is the actual work. Image 57 is the excuse to get it. HCM and Campus containers are not out yet; the binary still is.

3. Download FSCM Image 57 containers from MOS and load the three images

Patch number: PeopleSoft Update Manager Homepage, MOS Doc ID KA615. The zip names look like FSCM-920-UPD-057-CNT_*of*.zip. Unzip only the first file, then combine the rest per Instructions.txt.

Windows:

cmd /c copy /b FSCM-920-UPD-057-CNT_*of*.zip ep92u057.zip

Linux:

cat $(ls FSCM-920-UPD-057-CNT_*of*.zip | sort -V) > ep92u057.zip

Do not include 1ofX.zip in the combine. Oracle called that out because it is the failure mode. Extract to a directory named ep92u057. Setup notes are in docs/pum/README.md. Then load:

podman load -i ./image/latest-19-ps.tgz

podman load -i ./image/ep92u057.tgz

podman load -i ./image/862.2.11.tgz

podman image ls

You want three rows: oracle/database/enterprise_ru:latest-19-ps, oracle/peoplesoft/fscm/pum/midtier:ep92u057, oracle/peopletools/osk:862.2.11. If podman image ls does not show all three, stop. Do not compose yet.

FSCM-only this cycle. HCM and Campus stay on NativeOS/VirtualBox until their container images ship. Do not pretend Image 57 is a universal PUM.

4. Treat the four config files as the runbook, not prompts you click through

This is the part VirtualBox DPK trained you to skip. Container PUM configuration is four files:

1. compose.yaml — ORACLE_PWD under the database service. On Windows, uncomment container=windows in the midtier section.

2. in/pum/install.rsp — install_type=PUM, app_type=fscm, passwords, db_name=EP92U057, db_host=database.

3. in/pum/psft_customizations.yaml — FQDN. hostname -f on Linux, $env:COMPUTERNAME on Windows. If you do not have an FQDN, Iverson says use midtier.oraclevcn.com and add it to hosts.

4. in/osk/install-osk.rsp — OpenSearch, Dashboards, Logstash, plus the Integration Broker REST URLs (PSFT_EP for Finance).

Put those four files in version control (redact passwords) after the first successful run. Next image, you copy them. That is the labor VirtualBox never gave back: a repeatable PUM, not a remembered click path.

SELinux enforcing will break volume mounts. Iverson’s appendix: change :ro to :Z on the binds.

5. Run one compose in a sandbox this week — then put October on the same list

From ep92u057:

podman-compose up -d # Linux

podman compose up -d # Windows

Second terminal: podman-compose logs -f or podman logs -f midtier. Oracle’s sample Windows timing: database healthy at ~435s, midtier healthy at ~788s. Yours will differ. Write the number down. That number is what you take to CAB when someone says “we don’t have time to switch.”

If you are not an FSCM shop, still do steps 1–2 this week. NativeOS DPK remains valid until your product line ships containers. Do not wait for HCM Image N to start installing Podman.

And put the other DPK change on the same dated file. August 26: Infrastructure DPK is replaced by Middleware DPK. Oracle does not plan to post an Infrastructure DPK in October. 8.61/8.62 need the patch that adds --apply_mw_cpu. 8.63 can run Middleware DPK Builder now.

🔗 The Middleware DPK is Replacing Infrastructure DPK (Oracle) https://blogs.oracle.com/peoplesoft/the-middleware-dpk-is-replacing-infrastructure-dpk

Two format changes. One October CPU. Learning both during the 20 October window is the failure mode.

Do this once, then make it an artifact

Five artifacts, not five opinions: the VirtualBox inventory, a podman image ls screenshot, the loaded Image 57 trio, the four config files in git, and one compose log with a wall-clock time.

Re-run the inventory next PUM cycle and diff it. The diff is the migration. “We’re moving to containers” is not.

Monday’s Digest covered why this landed now: Iverson ended VirtualBox DPK support “in the near future,” Image 57 is already the FSCM path, the August CSPU put VirtualBox 7.2.14 in the patch list, and Middleware DPK replaces Infrastructure DPK in October.

Next Thursday: 5 questions to ask before you trust an AI feature with ERP data.

🌐 Join the Community

Subscribe to PeopleSoft Cloud — practitioner posts every Thursday, the Modern ERP Digest every Monday.

✅ Concrete actions you can run this week, not advice ✅ Sources cited, costs stated honestly ✅ Free, always

Your PUM lab is still a hypervisor. Oracle already shipped the successor.

Dan Iverson, PeopleTools Strategy Director, put it in writing twice. On April 8: “We will be ending support for the VirtualBox DPK in the near future.” On July 27, with FSCM Update Image 57 actually on My Oracle Support: the VirtualBox DPK delivery model “is planned to be retired in a future release.” No date. No countdown. The replacement is three pre-built containers and one compose command.

Most shops will still learn that under a deadline, because the PUM environment is still “the laptop that has VirtualBox.” This week Oracle added a second DPK change — Infrastructure DPK is gone in October — and the August CSPU put VirtualBox 7.2.14 itself in the patch pile.

Let’s get into it.

Subscribe now

🧰 Containers Are the Preferred PUM Path. VirtualBox Is Not.

🔗 Coming Soon – PeopleSoft Update Images on Containers (Oracle / Dan Iverson) https://blogs.oracle.com/peoplesoft/peoplesoft-images-on-containers

April 8, 2026. Container images are “easier to download — 1 file per container image, easier to start — 1 command for all the containers, and faster to deploy than the VirtualBox or NativeOS DPKs.” Three containers: database, midtier, Insights. Podman on Linux, Podman Desktop on Windows. And the line shops keep scrolling past: Oracle “will be ending support for the VirtualBox DPK in the near future.”

🔗 Getting Started with Update Image Containers (Oracle / Dan Iverson) https://blogs.oracle.com/peoplesoft/getting-started-with-update-image-containers

July 27, 2026. FSCM Update Image 57 is the first PUM that deploys this way. You no longer run the full VirtualBox DPK build. You load three images (latest-19-ps, ep92u057, 862.2.11), edit four text files, and launch with podman-compose up -d (Linux) or podman compose up -d (Windows). Patch number lives on the PeopleSoft Update Manager Homepage, MOS Doc ID KA615. Combine zip parts 2–N; do not include 1ofX.zip. Config is compose.yaml, in/pum/install.rsp, in/pum/psft_customizations.yaml, and in/osk/install-osk.rsp.

Unlike VirtualBox DPK, the container image includes the full search stack (OpenSearch, Dashboards, Logstash), so Insights actually comes up. Configuration lives in files you can reuse on the next image.

My read: This is not an optional format sitting next to VirtualBox. Iverson called containers the preferred path in April and the planned successor in July. FSCM 57 is first. HCM and Campus are still on the old delivery. Waiting for a sunset date is how you end up learning Podman inside a frozen change window.

🔗 PeopleSoft Update Image Containers: PUM Deployment Just Changed (PeopleSoft Career) https://blog.peoplesoftcareer.com/peoplesoft-update-image-containers/

Derek Tomei’s walkthrough of the Iverson/Vemana path, with the Windows vs Linux compose gotcha and the same retirement language. Useful if you want the four steps without MOS open. Comment from Randy Groncki on August 10: he still had to “cut out some time” to try it. That is the actual adoption curve.

🔐 Two DPK Changes. One of Them Is the Hypervisor.

🔗 Oracle Critical Security Patch Update Advisory — August 2026 (Oracle) https://www.oracle.com/security-alerts/cspuaug2026.html

The August 18 CSPU is now Rev 3 as of August 27. Among the affected products: Oracle VM VirtualBox, version 7.2.14. Next four security Tuesdays, from the same page: 15 September 2026 (CSPU), 20 October 2026 (CPU), 17 November 2026 (CSPU), 15 December 2026 (CSPU).

🔗 Oracle VM VirtualBox (August 2026 CSPU) (Tenable, Nessus 338745) https://www.tenable.com/plugins/nessus/338745

Plugin published August 21, updated August 26. Three Core issues on 7.2.14 worth reading before you shrug:

• CVE-2026-71131 — CVSS 8.6. Unauthenticated local attacker, user interaction required, scope change, takeover.

• CVE-2026-71129 — High-privileged local attacker, scope change, takeover.

• CVE-2026-71130 — Unauthenticated attacker with network access via RDP; critical data read plus some write.

My read: Last week’s Digest treated the August CSPU as a PeopleTools problem. It is also a lab-hypervisor problem. If your PUM still lives on VirtualBox, you are patching the thing Oracle is already walking away from — and you are patching it because the hypervisor itself just took an 8.6.

🔗 The Middleware DPK is Replacing Infrastructure DPK (Oracle / Dan Iverson) https://blogs.oracle.com/peoplesoft/the-middleware-dpk-is-replacing-infrastructure-dpk

August 26, 2026. This is the item from this week. Middleware DPK replaces Infrastructure DPK for WebLogic, Tuxedo, Java, Oracle Database Client, and OPatch. Oracle will keep posting a Middleware DPK zip after each CPU. The new piece is Middleware DPK Builder, shipped with PeopleTools: download current middleware CPUs and generate the zip on your schedule instead of waiting for Oracle’s packaged file.

Starting this fall, 8.61, 8.62, and 8.63 all use Middleware DPK. 8.63 has it built in. 8.61 and 8.62 need a patch that adds --apply_mw_cpu (replaces --apply_infra_cpu) plus the Builder. Oracle plans the first Middleware DPK files for 8.61/8.62 in October and does not plan to post an Infrastructure DPK in October. Plan the Builder for the October CPU cycle. 8.63 shops can use it today.

My read: Two DPK transitions in one quarter is not a coincidence. VirtualBox DPK is the PUM-lab format. Infrastructure DPK is the middleware-CPU format. Both are being replaced with something you can run without waiting on Oracle’s packaging queue. If you learn only one of them, you will still miss October.

💸 The Calendar Moved. The Staffing Did Not.

🔗 PeopleSoft Payroll for North America Tax Update 26-C Delivery Moves to September (Oracle / Anne Leung) https://blogs.oracle.com/peoplesoft/peoplesoft-payroll-for-north-america-tax-update-26-c-delivery-moves-to-september

August 20, 2026. Tax Update 26-C is targeted for Wednesday, September 30, 2026, through the HCM Weekly PeopleSoft Release Patchset. HCM Image 56, targeted for November 2026, will include Tax Update 26-D (first year-end set). Weekly HCM PRPs continue through December 2026 and January 2027 — they are regular HCM patches, not a separate payroll package. Bookmark MOS FAQ2322 (Payroll for North America Hot Topics).

My read: This is the 2027 cadence change showing up early. Images slow down; weekly PRPs carry the legally dated work. Your change calendar has to track both, or 26-C lands as a surprise on a Wednesday.

🤖 Oracle Will Not Build Your Agents. 8.63 Gives You the Socket.

🔗 PeopleTools 8.63: Inside Oracle’s 2026 PeopleSoft Update (PeopleSoft Career) https://blog.peoplesoftcareer.com/peopletools-8-63-2026-update/

Derek Tomei on the PeopleSoft Now update. The 8.63 list that matters for next week: MCP servers so agent platforms can talk to PeopleSoft through a standard interface, semantic search, natural-language query infrastructure, chatbot UI components, Customization Insights v2 with functional groups, SAML, TOTP. Paco Aubrejuan’s boundary, as Tomei quotes it: Oracle will not rearchitect PeopleSoft around agent teams. That investment goes to Fusion. PeopleSoft gets enablement — connective tissue, not the agents.

My read: Last Thursday was “who has PeopleTools Security.” Next Thursday after VirtualBox is “five questions before you trust an AI feature with ERP data.” 8.63 gives you a socket. It does not give you a permission model, a data-classification answer, or a log of what the agent touched. If you cannot answer those, do not plug anything into the socket.

💬 Aaron’s Take

Oracle did not hide this. The PUM replacement is on MOS. The hypervisor is in the CSPU. The middleware DPK change landed Wednesday. Three concrete things this week:

• Write down every VirtualBox PUM. Host, image number, last successful refresh, who owns the laptop. If that list does not exist, you do not have a sunset plan. You have a rumor.

• Stand up FSCM Image 57 on Podman once. Four config files, one compose command, in a sandbox. HCM and Campus shops: you still run NativeOS this cycle, but Podman fluency is the same skill the next image will demand.

• Treat October as a DPK deadline, not a CPU deadline. 8.61/8.62 need the Middleware DPK patch before Oracle stops posting Infrastructure DPK. 8.63 can run the Builder now. Put --apply_mw_cpu in the runbook before the 20 October CPU.

• Thursday is the five moves to get off VirtualBox DPK before the sunset — which still has no date — forces you.

This is not a “PeopleSoft is old” problem. It is a lab-tooling problem. PeopleSoft isn’t the deadline. The hypervisor under your PUM is.

🌐 Join the Community

Subscribe to PeopleSoft Cloud for the Monday Digest and Thursday practitioner posts — no vendor spin, just what changed and what to do about it.

✅ Monday: what moved in the PeopleSoft, Oracle and ERP world, with a read on why it matters ✅ Thursday: five verifiable actions you can run this week, free, every week ✅ Written by a practitioner who still has to make the change window

Subscribe now

Then run the query. It’s eleven, two of them left in 2023, and one is a service account somebody cloned from PS because it was easier than building a permission list.

That gap stopped being an audit-season embarrassment on August 18. CVE-2026-60879 (CVSS 8.8, PeopleTools 8.61-8.63, Configuration Manager) lets a low-privileged authenticated user take over PeopleTools over SQL. Not an admin. Any account that got a role it never needed.

🔗 CVE-2026-60879 (Tenable) https://www.tenable.com/cve/CVE-2026-60879

Patching closes that one instance. Least privilege closes the class — and it’s the only compensating control you have for the next one. Here are five ways to replace the shrug with evidence.

1. Produce the roles-to-permissions-to-users matrix, in writing

Not a screenshot of one user profile. The whole join: PSOPRDEFN → PSROLEUSER → PSROLECLASS → PSCLASSDEFN. That’s the standard security audit query every consultant builds on day one, and you can build it yourself in an afternoon.

🔗 Advanced PeopleSoft Security Audit (SpearMC) https://spearmc.com/wp-content/uploads/SpearMC_Advanced_PeopleSoft_Security_Audit.pdf

Export it to CSV, then filter for every permission list granting PeopleTools Security, Application Designer, Data Mover, or Query create-public. That short list is your real administrator population — and the population an attacker only needs one of.

2. Find the stale accounts before they find you

Users who haven’t signed on in a year are pure liability: nobody notices their password, nobody notices their session.

SELECT * FROM SYSADM.PSPTLOGINAUDIT;

Reconcile that against PSOPRDEFN and against HR’s termination list — the second reconciliation finds the ex-contractors. And handle the delivered accounts explicitly: PS, VP1 and the rest of the install-time superusers should be disabled or rekeyed, and documented.

🔗 PeopleSoft User Security (Integrigy) http://www.integrigy.com/security-resources/peoplesoft-user-security

Disable before you delete, test in non-production first, and expect to break exactly one batch job you didn’t know existed. That’s the cost, and it’s cheaper than the alternative.

3. Run SYSAUDIT’s security integrity checks and read the output

SYSAUDIT’s Audit Security Integrity section checks the AUTH* and OPRDF* structures for orphaned and inconsistent security rows — permission lists pointing at objects that no longer exist, profiles referencing roles that were deleted around them.

🔗 Running SYSAUDIT (Oracle PeopleTools documentation) https://docs.oracle.com/cd/G23954_01/pt862pbr1/eng/pt/tadm/RunningSYSAUDIT-077a77.html

Most sites run SYSAUDIT before an upgrade and never again. Run it now, keep the report, and track the exception count over time. A number that goes down is evidence; “security is clean” is not.

4. Prove your dynamic role rules still do what they were written to do

Dynamic roles assign access programmatically through a query, PeopleCode or LDAP rule, then a batch process applies it. Two failure modes are common and neither announces itself: the process quietly stops being scheduled, so leavers keep access forever — or the rule is broader than anybody remembers.

🔗 Defining Role Options (Oracle PeopleTools documentation) https://docs.oracle.com/cd/G10809_01/pt861pbr4/eng/pt/tsec/DefiningRoleOptions-c076a7.html

For each dynamic role: open the rule, run the underlying query yourself, count the rows, then check the last successful run of the role-assignment process in Process Monitor. If that run was during a project that ended two years ago, your access model has been frozen since then. (Queries with bind variables will not work as role rules — the system errors, and someone may have “fixed” that by making the rule static.)

5. Audit query and row-level security separately from page access

Page security is the part everyone checks. Query security is where the data actually leaves.

Check the permission-list query profile flags — QRY_RUN_ONLY, QRY_CREATE_PUBLIC, QRY_MAX_FETCH — and the access groups attached through SCRTY_ACC_GRP. Query access is inherited only through roles, while row security comes from the primary and row security permission lists assigned directly to the profile. A user with modest page access and generous query access can still read the entire employee table.

🔗 Defining Permissions (Oracle PeopleTools documentation) https://docs.oracle.com/cd/G41075_01/pt862pbr3/eng/pt/tsec/DefiningPermissions-c07686.html

The Permission List Audit tab tells you when each list was last changed and by whom. If a list critical to segregation of duties was last touched by someone who no longer works there, that’s a finding, not trivia.

Do this once, then make it an artifact

Five queries, one SYSAUDIT run, one afternoon. What you produce is not “we reviewed security” — it’s a dated file: every account with administrative capability, every stale profile, every dynamic rule and when it last ran, every open query profile, and a name against each exception.

Re-run it quarterly, and diff it. The diff is the audit. It takes twenty minutes once the queries exist, and it is the only thing that will answer the question you’ll get after the next PeopleTools CVE lands: not “did we patch?” but “who could have used it?”

Monday’s Digest covered why that question keeps arriving faster — Oracle’s August CSPU carried 925 CVEs across 23 product families, with three PeopleTools issues in 8.61-8.63.

Next Thursday: 5 ways to get off VirtualBox DPK before the sunset forces you.

🌐 Join the Community

Subscribe to PeopleSoft Cloud — practitioner posts every Thursday, the Modern ERP Digest every Monday.

✅ Concrete actions you can run this week, not advice ✅ Sources cited, costs stated honestly ✅ Free, always

Patch fatigue is a staffing problem, not a patching problem.

Two years ago, an Oracle shop planned around four events a year: January, April, July, October. You knew the dates, you booked the change windows, you got through it. Since May, Oracle has layered monthly Critical Security Patch Updates on top of the quarterly CPUs — roughly a dozen patch events a year instead of four. The August CSPU alone carried 943 security updates.

Nobody’s DBA headcount tripled to match. That’s the whole story. Fatigue isn’t a discipline failure or a maturity-model gap; it’s arithmetic. Three times the events, the same two people, the same change advisory board that meets every other Thursday. And this week Oracle handed PeopleSoft customers a 9.8 to prove the point.

Let’s get into it.

Subscribe now

🔐 The August CSPU: What You Actually Have to Do

🔗 Oracle Critical Security Patch Update August 2026 addresses 925 CVEs (Tenable) https://www.tenable.com/blog/oracle-august-2026-critical-security-patch-update-cspu-addresses-925-cves

Released August 18: 925 unique CVEs in 943 security updates across 23 product families, 154 of them rated critical. Compare that to the June CSPU — 243 CVEs, 245 patches, 11 product families. A nearly fourfold jump in a release that is supposed to be the small one between quarterly CPUs.

🔗 CVE-2026-60821 — PeopleTools Business Interlink, CVSS 9.8 https://notcve.org/cve/CVE-2026-60821

This is the one to read first. Unauthenticated, network-accessible over HTTP, low attack complexity, full takeover of PeopleSoft Enterprise PeopleTools. Affected: 8.61 through 8.63 — including the release Oracle shipped last month.

My read: Business Interlink is legacy plumbing most sites forgot they had enabled. That is exactly the profile of CVE-2026-35273 in June: an old component, still listening, still reachable. If your PeopleTools tier answers HTTP from anywhere untrusted, treat this as a same-week job, not a next-cycle job.

🔗 CVE-2026-60879 — Configuration Manager, CVSS 8.8 (Tenable) https://www.tenable.com/cve/CVE-2026-60879

A low-privileged authenticated user, over SQL, to complete PeopleTools takeover. Versions 8.61-8.63 again. The companion, CVE-2026-60856 (CVSS 7.4, Install and Packaging, unauthenticated but high complexity), and CVE-2026-60884 (Panel Processor, scope-changing) round out the batch.

🔗 CVE-2026-60856 (Tenable) https://www.tenable.com/cve/CVE-2026-60856

My read: 60879 is the item that should change behavior, not just patch schedules. “Low privileged” means any ordinary account that got a role it never needed is now a takeover path. Patching closes this instance. Least privilege closes the class. That’s Thursday’s post.

🔗 Oracle Critical Patch Update, August 2026 Security Update Review (Qualys) https://blog.qualys.com/vulnerabilities-threat-research/2026/08/19/oracle-critical-patch-update-august-2026-security-update-review

Useful if you scan: QID 388371 covers the PeopleTools multi-vuln set, 388372 VirtualBox, 87617 WebLogic, 20609 Database 19c. Detection first, evidence second, argument with your CAB third.

🧰 Oracle Is Re-Timing the Treadmill (Slowly)

🔗 PeopleSoft aligns HCM and FSCM update cadence with customer adoption starting in 2027 (Oracle) https://blogs.oracle.com/peoplesoft/peoplesoft-aligns-hcm-and-fscm-update-cadence-with-customer-adoption-starting-in-2027

From 2027, HCM and FSCM drop from three update images a year to two. Campus Solutions stays at three; Cloud Manager, ELM and CRM are unchanged. Oracle’s stated reason is honest: most customers get current every 12-18 months and were never consuming all three.

My read: This is Oracle admitting the adoption arithmetic on the functional side — and it makes the security side stand out more sharply. Feature delivery slows down to match what teams can absorb; security delivery speeds up regardless. Those two curves now point in opposite directions, and your staffing plan has to serve both.

🔗 PeopleSoft Update Image containers: PUM deployment just changed (PeopleSoft Career) https://blog.peoplesoftcareer.com/peoplesoft-update-image-containers/

FSCM Update Image 57 is the first PUM you can stand up with Podman instead of VirtualBox — pre-built images, one compose command — and Oracle stated in the same breath that the VirtualBox DPK is expected to be retired in future releases.

My read: This is the one piece of genuine labor relief on the table. A PUM environment that comes up in minutes instead of a morning is real capacity given back to a two-person team. It costs you Podman fluency now instead of under deadline later.

🔗 PeopleTools 8.63: AI, security, and upgrade planning (SmactWorks) https://www.smactworks.com/insights/blogs/2026/08/peopletools-8-63-guide.html

8.63 went GA on OCI July 29 via Cloud Manager Image 22; on-premises is still “to follow.” Highlights that matter for this week’s theme: SAML 2.0 and TOTP two-factor, Customization Groups (cross-reference your customizations against delivered PUM maintenance), Log Analyzer, and webhooks. Also the release carrying three of this month’s CVEs — being current is not the same as being safe.

💸 The Arithmetic Behind the Staffing

🔗 Oracle spent $55.7 billion on data centres in a single year (The Next Web) https://thenextweb.com/news/oracle-q4-fy2026-capex-55-billion-ai-data-center-openai

FY2026 capex came in at ~$55.7B against $50B guidance, with FY2027 net outlay guided to ~$70B and reported capex expected $20-25B higher. Remaining performance obligations: $638B. Q1 FY2027 results are expected September 8.

🔗 Oracle Cloud Infrastructure revenue up 93% as capex keeps climbing (DCD) https://www.datacenterdynamics.com/en/news/oracle-cloud-infrastructure-revenue-up-93-as-firms-capex-keeps-climbing/

🔗 Oracle cuts up to 30,000 jobs globally, putting enterprise support and roadmaps at risk (CIO) https://www.cio.com/article/4153113/oracle-cuts-up-to-30000-jobs-globally-putting-enterprise-support-and-roadmaps-at-risk.html

The CIO piece names the failure mode precisely: not an outage, but “unevenness that creeps in quietly — slower escalation handling, thinner backline expertise, more handoffs.” Ask your account team for named support-coverage continuity and confirmation that release commitments hold for the next two quarters. Vague answers are themselves the answer.

🔗 The 2026 Data Infrastructure Survey (DataStrike) https://www.datastrike.com/blogs/the-2026-data-infrastructure-survey-why-rising-budgets-arent-solving-its-biggest-challenges

74% of IT organizations expect budget increases, yet only about a third employ dedicated DBAs — and over half of those run on one or two people. 60% now lean on managed service providers, up from 26% a year ago.

My read: That is the patch-fatigue equation stated in someone else’s data. Budget is not the constraint; hours from people who know your estate are. If you are going to buy your way out, buy hours, not licenses.

🤖 The AI-vs-ERP File

🔗 Agentic ERP won’t scale until CIOs control the proof, the price, and the portability (Forrester) https://www.forrester.com/blogs/agentic-erp-wont-scale-until-cios-control-the-proof-the-price-and-the-portability/

Only 7% of ERP decision-makers run a single instance. Agents inherit every regional variant and acquired system in the estate, and 65% of adopters already rate their data accuracy as “complex.”

🔗 AI is moving faster than enterprise systems can adapt (ERP Today) https://erp.today/ai-erp-transformation-enterprise-systems-gap/

My read: Every agentic-ERP pitch assumes a clean identity and permission model underneath it. Most PeopleSoft estates do not have one — see CVE-2026-60879. Before you let an agent act inside PeopleSoft, you need to be able to say precisely what a low-privileged account can reach. Almost nobody can.

💬 Aaron’s Take

The fix for patch fatigue is not a better attitude toward patching. It’s three concrete things:

• Stop treating each CSPU as a project. One standing runbook, a fixed monthly window already on the calendar for the rest of 2026 (next CSPUs: Sept 15, Nov 17, Dec 15), and a pre-approved emergency path for anything ≥9.0. Approval latency, not patch application, is where the weeks go.

• Buy hours, not tools. If you have one DBA and twelve patch events a year, that is a staffing decision someone made without saying it out loud. Say it out loud, with the CVSS scores attached.

• Move the PUM lab to containers now. Image 57 on Podman is the only item this month that gives time back rather than taking it.

• Shrink the blast radius. 60879 needs a low-privileged account to work. That’s this Thursday’s post: five ways to audit your roles and permission lists before somebody else does.

ERP isn’t dying and PeopleSoft isn’t the problem. The customization layer and the staffing model are what’s out of date — and only one of those two is on your roadmap.

🌐 Join the Community

Subscribe to PeopleSoft Cloud for the Monday Digest and Thursday practitioner posts — no vendor spin, just what changed and what to do about it.

✅ Monday: what moved in the PeopleSoft, Oracle and ERP world, with a read on why it matters ✅ Thursday: five verifiable actions you can run this week, free, every week ✅ Written by a practitioner who still has to make the change window

Ask a PeopleSoft team how fast they patch, and you’ll hear “we’re current within a quarter.” Ask them to prove it with dates — Oracle’s release date, your test apply date, your production apply date — and the number turns into a story.

CISA set the real benchmark in June: CVE-2026-35273 hit the KEV catalog on June 12 with a remediation deadline of June 15. Three days. And as Monday’s Digest covered, Oracle now ships Critical Security Patch Updates monthly, with the next on August 18.

Here are the five places the time actually goes, and how to measure each one.

Subscribe now

1. You’re still planning around four dates a year

Oracle isn’t. Since May 28, CSPUs land on the third Tuesday of February, March, May, June, August, September, November and December, on top of the quarterly CPUs — with a pre-release announcement the Thursday before each one.

🔗 Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins (Oracle) https://www.oracle.com/security-alerts/

Measure it: count the security windows on your change calendar for the next 12 months. If the answer is 4, you have designed a 30-60 day lag into every critical fix Oracle ships between quarters. Add the eight CSPU dates, and subscribe to Oracle’s security alert email so the Thursday pre-release reaches a human, not a shared mailbox.

2. Nobody owns the triage window

Between Oracle’s release and your first decision, the patch is public — and so is the vulnerability class. July’s CPU carried 1,449 patches across 1,235 CVEs, of which PeopleSoft took 84, with 45 exploitable over the network without credentials.

🔗 Oracle July 2026 Critical Patch Update Addresses 1,235 CVEs (Tenable) https://www.tenable.com/blog/oracle-july-2026-critical-patch-update-addresses-1235-cves

Measure it: for the last CPU, write down the release date and the date a named person first read the advisory. If that gap exceeds 48 hours, the problem isn’t patching — triage is nobody’s job. Assign it by name, with a backup.

3. You patch the whole CPU or nothing

The all-or-nothing apply is the biggest source of delay: a full CPU means a full regression test, and a full regression test means a quarter. Oracle built CSPUs to break that coupling — targeted fixes in a smaller format, with quarterly CPUs staying cumulative.

Measure it: take July’s PeopleSoft CVE list and mark which entries touch components you actually run. Sites without Global Payroll Switzerland, FIN Common Objects Brazil or In-Memory Project Discovery are testing patches for code they will never execute. A component-scoped applicability list turns a quarterly project into a two-day change.

🔗 Oracle CPU July 2026 Security Update Review (Qualys ThreatPROTECT) https://threatprotect.qualys.com/2026/07/22/oracle-critical-patch-update-july-2026-security-update-review/

4. Your test environment isn’t a copy of production

Every team that misses a window tells the same story: it broke in test, we ran out of time, we deferred. Usually because test drifted — different PeopleTools patch level, different customizations, data from two refreshes ago.

Measure it: run a diff today. Compare PeopleTools release and patch level, applied bundle list, and customization inventory between test and production. Every difference is a false test result waiting to cost you a weekend. It is also the strongest argument for container-based Update Images: an environment you rebuild in a pipeline stops drifting, because it stops being a pet.

5. Your clock starts at the advisory — the attacker’s started earlier

The arithmetic from the last big one: Mandiant observed exploitation of CVE-2026-35273 between May 27 and June 9. Oracle’s advisory came June 10. Even a perfect response was two weeks late, because the race started before the gun.

🔗 Active Exploitation of the Oracle PeopleSoft Zero-Day (Rapid7) https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/

Measure it: pick your two most exposed components and ask what compensating control protects them while unpatched. If the answer is “the patch,” you have no answer. Perimeter blocks, egress restrictions and disabled unused services buy the days you don’t have.

Do this once, then make it repeatable

Build one dated table: for the last four Oracle security releases, record release date → triage date → test apply date → production apply date. Four rows, one afternoon. Almost nobody has it.

That table ends the argument. It gives you a real mean time to patch, shows leadership where the days go, and when the next KEV entry lands with a three-day deadline you will already know whether three days is possible — instead of finding out on the day.

Next Thursday: 5 ways to audit PeopleSoft roles and permission lists before someone else audits them for you.

🌐 Join the Community

Subscribe at www.peoplesoftcloud.com for weekly PeopleSoft, ERP, and cloud platform guidance — the Monday Digest for what happened, Thursdays for what to do about it.

Oracle published something this week that is easy to scroll past and expensive to ignore: Prepare Now: Apply Oracle Database Release Update Immediately Upon Availability.

Read it twice. Oracle is not announcing a patch. It is telling customers to have the change window, the test plan, and the inventory already built so the next quarterly Release Update goes on fast when it drops — Oracle Database 19c RU 19.32 and Oracle AI Database 26ai RU 23.26.3, plus the matching Grid Infrastructure, client, and component updates. The next quarterly CPU/RU date is 20 October 2026.

Why the tone changed

This is the follow-through on Oracle’s April guidance, Take Action Today: Protect Your Oracle Database Against AI-Enabled Cybersecurity Threats. The argument there was blunt: frontier AI models are now good enough at finding vulnerabilities that the discovery half of an exploit chain got cheap. Oracle said the April RUs (19.31 / 23.26.2) contained the first wave of fixes for issues surfaced with those models.

If vulnerability discovery accelerates and your patch cadence doesn’t, the gap between “fix exists” and “fix installed” is your exposure window. That’s the whole thesis, and it’s the same reason Oracle added monthly Critical Security Patch Updates this year on top of the quarterly CPUs — next ones 15 September, 17 November, 15 December 2026, with a pre-release announcement the Thursday before.

Oracle also says the quiet part out loud in the new post: the risk is not limited to internet-facing databases. Attackers pivot through compromised apps, credentials, endpoints, and adjacent systems. So the scope is production and DR, test, dev, and supporting infrastructure.

Subscribe now

The PeopleSoft translation

Nothing in that post is PeopleSoft-specific, which is exactly why PeopleSoft shops under-react to it. Three things to be honest about:

1. Your database inventory is bigger than your PROD list. Every PeopleSoft environment refresh clones a database. Demo, PUM source images, that “temporary” 2024 upgrade copy nobody decommissioned — they all run the same binaries and often sit on the same subnet as something that matters. Oracle’s guidance is estate-wide. Yours should be too.

2. Clients and Grid Infrastructure count. Oracle explicitly lists database clients and Grid Infrastructure alongside the RU. In PeopleSoft that means your app server and process scheduler tiers, not just the DB nodes. Patching the database and leaving 19c clients from three years ago on the mid-tier is a half-done job.

3. Your constraint is the change window, not the patch. Nobody in a PeopleSoft shop fails to patch because they can’t find the RU on My Oracle Support. They fail because the CAB slot is 30 days out, the regression suite is manual, and one payroll run is always in the way. Oracle’s advice — test rapidly with representative workloads, use rolling and low-downtime patching, prioritize by exposure — is really advice about removing organizational latency.

What to do this month, before 19.32 exists

• Inventory now. Every database, Grid Infrastructure home, and client, with current RU level and owner. If you can’t produce that list in an hour, that’s the finding.

• Pre-book the window. Ask for the October change slot in August, when it’s cheap to reserve, not in October when it competes with year-end.

• Decide your regression floor. The minimum set of PeopleSoft tests that gates a database RU. Write it down; make it repeatable; stop rebuilding the argument each quarter.

• Use rolling patching where you already paid for it. RAC, Data Guard, out-of-place patching with gold images in 26ai. If you own the capability and still take a full outage, you’re absorbing risk you already bought insurance against.

• Subscribe to the alerts. Oracle’s Critical Patch Updates and Security Alerts page publishes the CSPU pre-release on the Thursday before each release. Free early warning.

My read: the meaningful shift isn’t the patch content, it’s the expectation. Oracle has moved from “stay reasonably current” to “be staged and ready on day zero.” Shops that treat patching as an event will keep sliding a quarter behind. Shops that treat it as a standing pipeline — fixed windows, fixed test set, fixed inventory — will apply 19.32 in days and barely notice.

Pick which one you are before October.

🌐 Join the Community

Subscribe to PeopleSoft Cloud for practical PeopleSoft and Oracle infrastructure analysis: ✅ Weekly ERP Digest every Monday ✅ Practical PeopleSoft every Thursday ✅ No hype, no vendor talking points — just what actually changes your week

Tomorrow — Tuesday, August 18 — Oracle ships a Critical Security Patch Update. Not a quarterly CPU. A monthly one.

That is the story of this edition, and it is bigger than a calendar change. Since May, Oracle has been releasing targeted security fixes on the third Tuesday of eight additional months a year. Meanwhile the July CPU you already applied has been revised twice — Rev 5 on July 30, Rev 6 on August 12. Your patch cycle was built for four events a year. Oracle now generates roughly twelve, plus revisions, plus out-of-band alerts like CVE-2026-35273.

The vendor changed tempo. Most PeopleSoft shops have not.

Let’s get into it.

Subscribe now

🔐 Security: The New Cadence Is Live

🔗 Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins (Oracle) https://www.oracle.com/security-alerts/

Read the CSPU section, not just the CPU table. The next four CSPU dates are 18 August, 15 September, 17 November, 15 December 2026. A pre-release announcement now lands the Thursday before each one — which means the August pre-release was published August 13 and you could already know what is coming.

🔗 Monthly Critical Security Patch Updates Begin May 28, 2026 (Oracle Security blog) https://blogs.oracle.com/security/update-monthly-critical-security-patch-updates-cspus-begin-may-28-2026

The rationale from Oracle: smaller, focused, high-priority fixes that don’t wait for the quarterly train. Quarterly CPUs stay cumulative and still include everything shipped in the CSPUs.

My read: This is a genuine improvement in Oracle’s posture and a genuine problem in yours. “We patch quarterly” was never great, but it at least matched the vendor. It no longer does. If your change calendar has four security windows on it, you are structurally 30-60 days behind on every critical fix Oracle now ships between quarters. Fix the calendar before you argue about the patches.

🔗 Oracle July 2026 Critical Patch Update Addresses 1,235 CVEs (Tenable) https://www.tenable.com/blog/oracle-july-2026-critical-patch-update-addresses-1235-cves

The largest CPU Oracle has ever released: 1,449 patches, 1,235 unique CVEs, 261 critical. PeopleSoft took 84 patches, 45 of them remotely exploitable without authentication.

🔗 Oracle CPU July 2026 Security Update Review (Qualys ThreatPROTECT) https://threatprotect.qualys.com/2026/07/22/oracle-critical-patch-update-july-2026-security-update-review/

Qualys’ breakdown of the PeopleSoft share: 17 of those CVEs carry critical severity ratings with remote code execution as the outcome.

🔗 CVE-2026-47017 — PeopleTools Process Scheduler (Armis) https://cve.armis.com/CVE-2026-47017

Worth singling out. CVSS 8.7, PeopleTools 8.61 and 8.62 only, improper access control in Process Scheduler: a low-privileged authenticated user can read and modify critical application data by tricking another user into a single HTTP interaction. No known exploitation. Fixed in the July CPU.

My read: 45 unauthenticated-network PeopleSoft CVEs in one quarter, and the one people will actually get burned by is an 8.7 that needs a login and a click. Most shops model the perimeter and ignore the authenticated blast radius. Which is Thursday’s topic — see below.

🧰 PeopleSoft Platform: 8.63, Containers, RECONNECT

🔗 PeopleSoft Monthly Newsletter – August 2026 (Quest Oracle Community) https://questoraclecommunity.org/learn/newsletters/peoplesoft-community-news-2026-august/

Still the single best roll-up: PeopleTools 8.63 GA on OCI, Cloud Manager Image 22, FSCM 9.2.057, Interaction Hub 9.1.022. On-premises 8.63 has still not shipped — Oracle’s line remains “will follow soon.” If your 8.63 plan has a date on it, that date is a guess.

🔗 PeopleSoft Update Image Containers (PeopleSoft Career blog) https://blog.peoplesoftcareer.com/peoplesoft-update-image-containers/

A hands-on walkthrough of the container-based Update Image: three images, Podman runtime, no more VirtualBox appliance download.

🔗 The PeopleSoft Connection, Episode 12 — Modernizing PeopleSoft with AI Enablement and PeopleTools 8.63 (Oracle) https://blogs.oracle.com/peoplesoft/the-peoplesoft-connection-episode-12-modernizing-peoplesoft-with-ai-enablement-and-peopletools-8-63

Oracle’s own product team on where 8.63’s AI features are meant to land. Useful for hearing what Oracle thinks the release is for, versus what the feature list implies.

🔗 RECONNECT Dive Deep 2026 — October 19-22, virtual (Quest) https://questoraclecommunity.org/events/conferences/peoplesoft-reconnect-dive-deep/

150+ sessions, all online, roadmap updates from Paco Aubrejuan, Robbin Velayedam, Richa Dubey and Sasank Vemana. Earliest-bird pricing ends August 21 — this Friday.

My read: Register now if you’re going. Not for the discount — because the roadmap sessions are where you’ll find out whether on-prem 8.63 lands in 2026, and that answer changes upgrade budgets.

💰 Oracle’s Balance Sheet Is Now a Planning Input

🔗 Oracle goes for high-stakes ratings gamble in AI strategy (Reuters via Yahoo Finance) https://finance.yahoo.com/technology/ai/articles/analysis-oracle-corp-goes-high-171918690.html

S&P cut Oracle to BBB- in July — one notch above junk. Debt of $129.5B, roughly 4.3x EBITDA, plus ~$260B in data center leases that don’t yet count as debt but that analysts count anyway.

🔗 Oracle plans fresh August layoffs as its AI spending spree bites (TNW) https://thenextweb.com/news/oracle-august-2026-layoffs-ai-capex

Another round this month, per Business Insider, some teams facing double-digit-percentage cuts, targeted to land before September 1. Context: ~21,000 roles gone in FY2026 (162k → ~141k), $1.8B in restructuring charges booked, capex $55.7B against $21.2B a year earlier.

🔗 Oracle’s AI Data Center Funding Tests OCI Delivery Timelines (TechRepublic) https://www.techrepublic.com/article/news-oracle-ai-data-center-funding/

The buyer-side framing: $638B in remaining performance obligations, negative $23.7B free cash flow, ~$40B more debt and equity expected in FY2027. The advice is unglamorous and correct — verify delivery dates, power availability, and contract protections before committing to future OCI capacity.

🔗 Oracle Gets Cheaper Only If The Megawatts Arrive (Trefis) https://www.trefis.com/stock/orcl/articles/611550/oracle-gets-cheaper-only-if-the-megawatts-arrive/2026-08-14

Consensus assumes ~39% annual revenue growth against 17.4% actually delivered over the trailing year, with FY2027 gross margin stepping down as data centers ramp. The valuation rests on construction, not software.

My read: I don’t care about the stock. I care that the company holding my support contract is spending like a utility and cutting like a turnaround. Two consequences worth acting on: test support responsiveness on niche PeopleSoft modules before you depend on it, and put delivery-date language in any OCI capacity commitment past next year. UBS cut its target to $245 from $285 on August 7 partly over a construction delay at one New Mexico site — if a bank’s model bends on one site’s power schedule, so can your migration plan.

🤖 The Agent Layer Arrives in the App Layer

🔗 Oracle Adds New Fusion Agentic Applications and AI Agents for Talent Management (Oracle) https://www.oracle.com/news/announcement/oracle-adds-new-fusion-agentic-applications-and-ai-agents-to-help-improve-talent-management-2026-08-11/

Announced August 11: agent teams for job design, skills profiles, learning, manager coaching, internal mobility and workforce planning — acting inside business processes with access to enterprise data, approval hierarchies and permissions.

🔗 Oracle Turns AI Agents Loose on Talent Management Tasks (UC Today) https://www.uctoday.com/productivity-automation/oracle-ai-agents-talent-management/

The skeptical read of the same launch, and the detail that matters most: the Intelligent Talent Profiles Agent infers employee skills from connected work-system data.

My read: Agentic HCM is where the PeopleSoft-vs-Fusion conversation gets real again. An agent that infers skills from work-system data is exactly the pitch that makes a CHRO ask why HR data still lives in a system nobody’s touched since the last upgrade. Note the asymmetry: PeopleSoft 8.63 gets AI in the developer loop, Fusion gets AI in the business process. That gap is the actual roadmap story, and it will not narrow.

💬 Aaron’s Take

The through-line this week is tempo. Oracle has accelerated everything — security releases from 4 to ~12 a year, feature delivery through continuous images, capital deployment at 2.6x last year’s rate — and PeopleSoft shops are still running annual planning cycles against it.

Three things to do this week:

• Put the CSPU dates on the change calendar today. August 18, September 15, November 17, December 15. Subscribe to the Thursday pre-release announcements so you get 5 days of warning instead of zero.

• Confirm which PeopleTools release you’re actually on. Both fresh PeopleSoft CVEs this quarter affect 8.61 and 8.62 only. Knowing your version is not the same as knowing your patch level — check both, in writing.

• Register for RECONNECT before Friday if the on-prem 8.63 date affects your 2027 budget. The roadmap sessions are the cheapest intelligence available to you all year.

And one thing not to do: don’t treat 45 unauthenticated CVEs as a perimeter problem. The perimeter was Edition 31’s story. The authenticated interior is Thursday’s.

This Thursday: 5 Reasons Your PeopleSoft Patch Cycle Is Slower Than Your Attackers — where the days actually go between Oracle’s release and your production apply.

🌐 Join the Community

Subscribe at www.peoplesoftcloud.com for weekly PeopleSoft, ERP, and cloud platform guidance.

✅ Monday: the Digest — what happened and what it means for your environment ✅ Thursday: practical, verifiable actions you can run this week ✅ Always: primary sources, real numbers, no vendor press-release energy

Good. Patching was the easy part. The uncomfortable part is that the vulnerability was only interesting because those endpoints were reachable from the internet in the first place — and patching doesn’t change that. /PSEMHUB/hub and /PSIGW/HttpListeningConnector are still exposed in most environments I’ve seen, still answering requests from anyone who asks.

“We patched it” is a claim. Here are five ways to turn it into evidence.

Subscribe now

1. Enumerate from the outside, not from the inside

Your network diagram is not evidence. It describes intent, not reality — and it was accurate the day it was drawn.

Censys counted roughly 40 internet-facing PeopleSoft hosts worldwide during the exploitation window, and called that a conservative estimate. Separately, IPinfo surfaced 24 live PeopleSoft instances across 16 organizations from a single day of scraped web data — without sending a single packet at any target.

🔗 Finding exposed PeopleSoft instances using web scrape data (IPinfo) https://community.ipinfo.io/t/finding-exposed-peoplesoft-instances-using-ipinfos-web-scrape-data/7376

That’s the test that counts: can a stranger find you without trying? Get an external view of your own perimeter — a scan from a cloud host, a Censys or Shodan query on your domains and ASN — and compare it to what you believe is published. The gap is your actual attack surface.

2. Curl the two paths from a network you don’t control

Not from the DMZ. Not from the VPN. From a coffee shop, or a $5 VM.

Request /PSEMHUB/hub and /PSIGW/HttpListeningConnector on every PIA URL you own — prod, test, dev, and the one somebody stood up for a 2019 project and never decommissioned. A connection refused or a perimeter-level block is a pass. An HTTP response of any kind is a finding, including a 401 or a 404.

Rapid7 is specific on this point, and it matters: block these at the network perimeter, not with WAF body-inspection rules alone.

🔗 Active Exploitation of the Oracle PeopleSoft Zero-Day (Rapid7) https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/

3. Decide whether EMHub should exist at all

Most sites do not need the Environment Management Hub running, and almost none need it published. The guidance from multiple responders converged: disable the EMHub service in multi-server configurations, or remove the PSEMHUB application entirely in single-server deployments.

🔗 Defending Against the PSEMHUB Authentication Bypass (Qualys ThreatPROTECT) https://threatprotect.qualys.com/2026/06/18/cve-2026-35273-defending-against-the-oracle-peoplesoft-psemhub-authentication-bypass/

There is a real cost — you lose Change Assistant’s environment discovery — and you should decide that deliberately rather than leave it running because nobody asked.

4. Check egress, not just ingress

The RCE got them in. Outbound SMB on TCP/445 is what let them harvest machine-account NetNTLM hashes and move.

Almost nobody audits this. Your PeopleSoft web and app tiers should not be able to open arbitrary outbound connections to the internet. Verify that from the host, not from the firewall policy — try it and watch it fail.

5. Know what your login page volunteers

Attackers pick targets by fingerprint. Sign-in pages leak PeopleTools version, server names, and full internal hostnames in redirects and error pages. And one rule worth writing on the wall: PeopleSoftListeningConnector should never be the target of an external integration — that’s what HttpListeningConnector behind a proxy is for.

🔗 PeopleSoft Online Security (Oracle docs) https://docs.oracle.com/cd/F70249_01/pt860pbr1/eng/pt/tsec/PeopleSoftOnlineSecurity-c0765d.html

Do this once, then make it repeatable

CISA added CVE-2026-35273 to the KEV catalog on June 12 with a remediation deadline of June 15 — three days. That is the tempo now, and you will not meet it by starting from scratch each time.

So produce an artifact: a dated list of every PeopleSoft URL you own, what each one exposes externally, and who signed off. Re-run it quarterly. When the next 9.8 lands — and it will — the question won’t be “are we patched?” It’ll be “what’s reachable?” You should already have that answer written down.

Next Thursday: why your patch cycle is slower than your attackers, and the four handoffs where the time actually goes.

🌐 Join the Community

Subscribe at www.peoplesoftcloud.com for weekly PeopleSoft, ERP, and cloud platform guidance — the Monday Digest for what happened, Thursdays for what to do about it.

Edition 30 went out in April. It’s August. Let’s not pretend otherwise.

The gap wasn’t for lack of news — it’s that I’ve been heads-down building. But the four months I was quiet turned out to be the most consequential stretch for PeopleSoft shops in years: a 9.8-severity zero-day exploited in the wild before Oracle knew, PeopleTools 8.63 landing with AI baked into the developer experience, the VirtualBox DPK finally being put out to pasture, and Oracle shedding 21,000 people while booking a $638 billion backlog.

So this edition is a catch-up. One theme ties it together:

Oracle is spending its balance sheet on AI infrastructure and its headcount on the bill. PeopleSoft customers are the ones who have to plan around that.

Let’s get into it.

Subscribe now

🔐 Security: The One You Cannot Defer

🔗 Oracle Security Alert CVE-2026-35273 https://www.oracle.com/security-alerts/alert-cve-2026-35273.html

A CVSS 9.8 unauthenticated RCE in the PeopleTools Updates Environment Management component. PeopleTools 8.61 and 8.62 affected. Oracle shipped an out-of-band patch the same day it disclosed — June 10 — which tells you how bad it was.

🔗 Rapid7: Active Exploitation of the PeopleSoft Zero-Day https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/

The detail that should keep you up: Mandiant observed exploitation between May 27 and June 9 — two weeks before Oracle’s advisory. Added to CISA KEV on June 12. Entry points were /PSEMHUB/hub and /PSIGW/HttpListeningConnector, with outbound SMB used to harvest machine-account NetNTLM hashes. Roughly 100 organizations targeted, education hit hardest.

My read: I wrote about the ShinyHunters campaign back in June. Two months on, the interesting question isn’t the CVE anymore — it’s whether your PSEMHUB and Integration Broker endpoints are still reachable from the internet at all. The patch closed one door. The architecture that exposed it is still there in most shops.

🧰 PeopleTools 8.63: AI Arrives in the Developer Loop

🔗 Quest PeopleSoft Community Newsletter – August 2026 https://questoraclecommunity.org/learn/newsletters/peoplesoft-community-news-2026-august/

The release wave in one place: PeopleTools 8.63 is GA on Cloud, FSCM 9.2.057 posted, Cloud Manager Image 22 available, Interaction Hub 9.1.022 posted. RECONNECT Dive Deep registration is open.

What’s actually new in 8.63 is worth more than a version bump — Oracle put AI where developers and admins live: an AI Assistant inside Application Designer, the “Magic Button” for faster AI enablement, smarter Search, Customization Group Insights, and improved access controls.

My read: Customization Group Insights is the sleeper. Every modernization conversation I’ve ever sat in stalls on the same question — what did we actually customize, and does anyone still need it? Teams answer that with spreadsheets and folklore. Tooling that answers it from the metadata changes the economics of a roadmap. If you’re planning an assessment, 8.63 is now a prerequisite, not an upgrade.

📦 The VirtualBox DPK Era Is Ending

🔗 Coming Soon – PeopleSoft Update Images on Containers (Oracle PeopleSoft blog) https://blogs.oracle.com/peoplesoft/peoplesoft-images-on-containers

Update Images are moving to containers: three images — database, midtier, Insights — pre-installed, one command to start, Podman as the recommended runtime.

🔗 The PeopleSoft VirtualBox DPK Is Dying. Here Is What Replaces It. https://www.linkedin.com/pulse/peoplesoft-virtualbox-dpk-dying-here-what-replaces-derek-tomei-ekkve

A practical walkthrough of the shift: FSCM Update Image 57 ships with a container deployment option. Load three images into Podman, edit four files, launch the stack.

My read: This is the change I’ve been waiting years for, and it’s bigger than convenience. A DPK build was an afternoon and a coin flip. A container pull is a step in a pipeline. Once PUM environments are declarative and disposable, “we only have one test environment” stops being a constraint you defend and starts being a decision you made. That’s the door to real CI for PeopleSoft.

💰 Oracle’s Numbers: Record Everything, Minus 21,000 People

🔗 Oracle Announces Record Q4 and FY 2026 Results https://investor.oracle.com/investor-news/news-details/2026/Oracle-Announces-Record-Q4-and-FY-2026-Results-Driven-by-Cloud-Infrastructure--Cloud-Applications/default.aspx

FY26 revenue $67.4B (+17%). Cloud $34B (+39%). Q4 IaaS $5.8B, up 93%. And the number that matters: RPO of $638B, up 363% YoY, after growing $85B in a single quarter. Backlog is now roughly ten times annual revenue. Reported capex plans run near $95B, with only ~12% of that backlog expected to convert inside 12 months.

🔗 Oracle sheds 21,000 roles over the past year (CNBC) https://www.cnbc.com/2026/06/23/oracle-ai-job-cuts-layoffs-21000.html

Headcount down from 162,000 to 141,000 — about 13% — with AI deployment cited in the annual filing.

🔗 Oracle layoffs hit sales, engineering, security (CRN) https://www.crn.com/news/ai/2026/oracle-layoffs-hit-sales-engineering-security-5-things-to-know

🔗 Layoffs continue into a second month across US, India, Philippines (DCD) https://www.datacenterdynamics.com/en/news/oracle-continues-widespread-layoffs-across-us-india-philippines-and-beyond/

Cuts extending into OCI, Oracle Health, Advanced Customer Services and NetSuite teams.

My read: Put those two links side by side and you have the only Oracle story that matters to a PeopleSoft customer this year. Cloud infrastructure growing 93% while Advanced Customer Services gets thinned is not a contradiction — it’s a stated priority. Practically: assume slower SR turnaround, more churn in your account team, and more of the burden of “knowing your own system” landing on you. Own your runbooks. Document your integrations. Do not architect on the assumption that a support engineer will remember your environment.

🤖 ERP Strategy: Is AI Ending the ERP Era?

🔗 Does AI Mark The End Of The ERP Era? (IT Jungle) https://www.itjungle.com/2026/07/27/does-ai-mark-the-end-of-the-erp-era/

A good walk through McKinsey’s five scenarios for the ~$100B ERP market, including the radical one where agents replicate ERP capability outright and logic becomes a commodity. It also revisits the early-2026 “SaaSpocalypse” selloff that took hundreds of billions off SaaS-ERP market caps.

🔗 What’s New in Oracle AI – August 2026 (Oracle Blog) https://blogs.oracle.com/ai-and-datascience/whats-new-in-ai-august-2026

OCI Enterprise AI: IAM authentication on hosted app endpoints, H100 multi-node serving for imported models, expanded on-demand model availability. Also: Oracle AI World, Las Vegas, October 25–28, 2026.

My read: I don’t buy the disintegration thesis, and this is the third year running I’ve said so. Agents are extremely good at processes and extremely bad at being the system of record for a regulated general ledger. What actually erodes is the layer we spent twenty years defending — the customizations, the bolt-on reporting, the human-in-the-loop shuffling between screens. That’s the part agents eat. The ledger stays.

Which is why 8.63’s AI-in-App-Designer and Customization Group Insights are the more honest signal about where this goes than any market-cap swing.

💬 Aaron’s Take

Four months away gave me a cleaner view of the pattern.

Every item above is the same story told in a different register. Oracle is redirecting enormous capital toward AI infrastructure. It is funding part of that by reducing the human surface area of everything that isn’t AI infrastructure — including the support and services layer PeopleSoft customers have leaned on for two decades. At the same time, it’s shipping genuinely useful tooling into PeopleSoft: containers, metadata insight, AI in the developer loop.

The read is not “Oracle is abandoning PeopleSoft.” The tooling is too good for that. The read is:

Oracle is handing you better tools and expecting you to need less help using them.

That’s a fair trade if you’re ready for it, and a serious problem if your operating model assumes someone else holds the institutional knowledge about your environment.

So, the four things worth doing this quarter:

• Patch, then verify exposure. 8.61/8.62 patched is table stakes. Get PSEMHUB and Integration Broker off the public internet. • Get to 8.63. Not for the version — for Customization Group Insights and the assessment work it unlocks. • Pilot container Update Images. Podman, one Image, one non-prod. Prove the pipeline before you’re forced to. • Write down what only you know. Runbooks, integration inventories, batch dependencies. Assume the outside expert is gone.

None of that is a modernization program. All of it is what makes one possible.

🌐 Join the Community

If you want to stay current on ERP strategy, PeopleSoft innovation, and cloud platform trends, subscribe at www.peoplesoftcloud.com.

Each week you’ll get: ✅ Curated ERP and PeopleSoft insights ✅ Context around AI and cloud developments ✅ Practical, real-world guidance

Edition 31, back on schedule. Thanks for still being here.

If you run PeopleSoft, that sentence is supposed to make your stomach drop. And the migration crowd is already using it to make a familiar argument: see, this is what happens when you stay on legacy software. Move to SaaS and let the vendor own the security.

That argument is wrong, and the details of this breach are exactly why. Let me walk through what actually happened, and what it does and doesn’t say about the platform you’re running.

What happened

Between May 27 and June 9, 2026, a financially motivated group called ShinyHunters, tracked by Google’s Mandiant as UNC6240, exploited a previously unknown flaw in Oracle PeopleSoft PeopleTools. Oracle didn’t publish its advisory until June 10. The attacks had been running in the wild for two weeks before anyone outside the attacker’s circle knew the vulnerability existed. This was a true zero-day.

The flaw is tracked as CVE-2026-35273. It carries a CVSS score of 9.8 out of 10. It is unauthenticated, remotely exploitable, and low-complexity. There is no need for login, no stolen credentials, and no user clicking anything. Just network access over HTTP. TrendAI’s Zero Day Initiative, which reported it to Oracle, classified the root cause as server-side request forgery that chains into remote code execution.

The damage was concentrated where it hurts. According to Mandiant, 68% of the notified organizations were in higher education. Overwhelmingly, U.S. colleges and universities are the exact shops that run Campus Solutions, housing student PII, financial aid records, and billing data. The University of Nottingham was among the first confirmed victims; ShinyHunters reportedly stole 40GB covering 450,000 current and former students and posted it to their leak site on June 9 after the university declined to pay. CISA added the CVE to its Known Exploited Vulnerabilities catalog on June 12.

So far, this reads like a vendor problem. Here’s the part that should change how you think about it.

Subscribe now

The vulnerability was in the part you forgot was exposed.

The flaw lives in the Updates Environment Management component — the machinery behind the Environment Management Hub, PSEMHUB. Mandiant’s analysis points to two endpoints: /PSEMHUB/hub and /PSIGW/HttpListeningConnector.

Read that again. The breach didn’t come through the front door that your users log in to every day. It came through environment-management plumbing. Most organizations stood up their infrastructure years ago, configured it once, and never thought about it again. The attack only works if that machinery is reachable from an untrusted network.

That is the whole ballgame. Oracle itself describes the vulnerability as easily exploitable and remotely reachable, which makes external exposure the single biggest risk multiplier. The organizations that got hit had PeopleSoft components exposed to the internet that had no business being exposed. In many cases, security teams didn’t even know those endpoints were reachable. They were simply forgotten DNS records pointing at legacy endpoints, a hub that was supposed to be internal but wasn’t, a reverse proxy that was more permissive than anyone remembered.

This is not a “PeopleSoft is old” problem. This is an attack-surface-management problem. An attack surface is something you control, not something the platform inflicts on you.

What this says about “let the vendor own security”

The migration pitch says SaaS makes the patching problem disappear. It doesn’t. It moves it somewhere you can’t see and can’t act on.

The post-mortem on this campaign reads like a competence checklist, not a platform indictment. Mandiant found that the attackers extracted credentials from psappsrv.cfg, mapped connected nodes, and walked the web, app, and batch tiers. This requires AI and a deep familiarity with PeopleSoft architecture, yes, but every one of those moves is something a properly segmented, properly monitored environment makes harder. The organizations that had their app servers walled off from untrusted networks, that watched outbound SMB traffic, that didn’t have PSEMHUB hanging off a public IP, were a far harder target.

Note also what ShinyHunters is known for. This is a group that usually wins through weak authentication, stolen credentials, and cloud misconfigurations, not exotic malware. That profile should be clarifying. The same crew constantly breaches SaaS platforms and cloud services. Moving your HR and finance data into someone else’s tenant doesn’t take you off their menu. It just means that when the next misconfiguration occurs, you find out about it via a breach notification email rather than in your own logs.

The honest framing is this: security is an operational discipline, and operational discipline is exactly the thing you keep when you modernize in place and lose visibility into when you hand the whole stack to a vendor.

The one-person problem this exposed

There’s an uncomfortable staffing truth underneath this incident, and it’s worth saying to the executive who controls the headcount.

A large share of PeopleSoft shops run with one person owning PeopleTools, security configuration, environment management, and patching. On a normal week, that’s a workload problem. During an actively exploited zero-day, when the same person is suddenly responsible for emergency mitigations, log hunting, and exposure assessment against attackers already inside the perimeter, it becomes an incident-response failure waiting to happen.

That risk has nothing to do with whether PeopleSoft is modern. A single-threaded SaaS admin is just as exposed; you’ve simply outsourced the parts they can no longer touch. The lesson isn’t “the platform is fragile.” It’s “we under-resourced a system that runs payroll, finances, and student records, and the bill came due.” This breach is the business case for fixing that.

What the CIO should actually do

Four moves. None of them is “evaluate migration.”

Find out what’s actually exposed — today. The exploit needs network reachability to PSEMHUB and Integration Gateway endpoints. Confirm whether anything PeopleSoft-related answers from outside your trusted network: /PSEMHUB/*, /PSIGW/*, the PIA and app server tiers. Don’t trust the assumption that PeopleSoft is “internal.” Check public DNS records, legacy endpoints, and anything a reverse proxy might be quietly forwarding. Even if you patched, exploitation started May 27. Assume you need to hunt for a prior compromise, not just close the door.

Patch, then verify you weren’t already hit. Oracle released mitigations with the June 10 alert and folded fixes into the June 2026 Critical Security Patch Update. Apply them. Then review web and app server logs for suspicious requests to those endpoints, watch for unexpected outbound SMB connections from PeopleSoft hosts, and look for unfamiliar files or processes. A patch closes the future; it says nothing about the two weeks the door was open.

Treat environment-management infrastructure as a first-class attack surface. What got people wasn’t the application; it was the operational scaffolding around it. Inventory every PeopleSoft endpoint, segment the tiers, put the management hub behind authentication or off the network entirely, and monitor it as it matters. Because it does.

Fund the team, or accept the risk in writing. If one person owns tooling, security, environments, and patching, you do not have an incident-response capability; you have a single point of failure with a pulse. Decide deliberately whether that’s acceptable for a system holding your most sensitive records, and make whoever owns the risk sign off on the answer.

The actual lesson

CVE-2026-35273 is a serious vulnerability, and Oracle’s two-week disclosure gap is a fair reason to be angry. But the organizations that weathered it well and the ones that ended up on a leak site weren’t separated by how old their ERP was. They were separated by whether they knew what they had exposed, whether they segmented it, and whether they had more than one person watching it.

That’s not a migration decision. That’s a management decision. The question was never whether to abandon the platform. It’s whether you’re operating it like it carries the weight it actually carries.

Run the exposure check this week. Not because PeopleSoft is fragile, but because every system that holds payroll and student data deserves to be treated like an asset, and right now, you have a concrete reason to prove yours is.

Aaron Engelsrud writes about PeopleSoft modernization, cloud infrastructure, and ERP strategy at peoplesoftcloud.com.

The Monday morning of Week 5 started with an argument.

Maya walked into the office at 7:30 AM to find Jake sitting at his desk, arms crossed, staring at his monitor with an expression that could curdle milk.

“Morning,” Maya said cautiously.

“We need to talk,” Jake said.

Maya set down her coffee. “Okay. What’s up?”

“I got your email last night,” Jake said. “The one about Week 5 plans. Database modernization using Oracle Cloud Exadata.”

“Right,” Maya said. “That’s the plan for this week—”

“You want to move our databases to a managed service,” Jake interrupted. “You want to give Oracle control of our databases.”

“I want us to use Oracle Exadata on Google Cloud,” Maya corrected. “Which is Oracle’s engineered system running on GCP infrastructure. It’s still Oracle Database, still fully featured, still something you have administrative access to.”

“But Oracle manages the infrastructure,” Jake said. “The storage, the patching, the high availability configuration. We lose control.”

“We lose operational burden,” Maya countered. “There’s a difference.”

Subscribe now

“Maya, I’ve been a DBA for twenty-six years,” Jake said, his voice tight. “I know how to manage Oracle databases. I know how to tune, optimize, and keep them running. You’re asking me to hand that over to a service that I can’t see inside of, can’t customize the way I want, can’t—”

“Can’t spend forty hours a quarter patching?” Maya suggested gently. “Can’t spend weekends troubleshooting storage performance? Can’t wake up at 3 AM when a backup script fails?”

Jake was quiet.

Maya sat down next to him. “Walk me through what you’re really worried about.”

Jake took a breath. “I’m worried that if we move to managed Exadata, my job becomes irrelevant. If Oracle handles the infrastructure, the backups, the patching, the high availability—what’s left for me to do? I become a glorified report writer. And then in a year, someone asks why we’re paying a DBA salary for work that doesn’t require a DBA.”

“Is that what you think I’m trying to do?” Maya asked. “Eliminate your position?”

“I don’t know,” Jake said honestly. “Two months ago, we were running PeopleSoft the traditional way. Now we’re doing infrastructure-as-code, observability platforms, and cloud migrations. Every week, something I used to do manually gets automated. At some point, you automate me out of a job.”

Maya was quiet for a moment, choosing her words carefully.

“Jake, do you remember last week? When we built the observability dashboards?”

“Yeah.”

“Who configured Oracle to export those metrics?” Maya asked. “Who knew which wait events matter for PeopleSoft performance? Who explained why we should monitor the DB file sequential read versus the DB file scattered read?”

“I did,” Jake said.

“Right. Because you understand Oracle performance at a level none of us do. Now let me ask you something else: how much time do you spend per month on tasks that require that deep expertise versus tasks that are just… keeping the lights on?”

Jake thought about it. “Maybe twenty percent on actual performance tuning and optimization. The rest is backups, patches, monitoring disk space, restarting failed jobs, dealing with tablespace extensions—”

“Operational toil,” Maya finished. “Important work, but not work that requires twenty-six years of expertise. What if we could flip that ratio? What if eighty percent of your time was spent on performance optimization, data architecture, query tuning, and helping developers write better SQL? What if the tool got automated?”

“That’s what managed Exadata does?” Jake asked skeptically.

“That’s what it enables,” Maya said. “Let me show you something.”

She pulled up a document she’d been working on over the weekend: a detailed comparison of their current Oracle environment versus Oracle Exadata on GCP.

Current State: Oracle Database on Self-Managed RAC

Jake’s Time Allocation (Monthly):

• Backup management and monitoring: 12 hours

• Patch management and testing: 16 hours (quarterly spike: 40 hours)

• Storage management: 8 hours

• High availability configuration and testing: 6 hours

• Performance monitoring: 10 hours

• Performance tuning and optimization: 8 hours

• Incident response and troubleshooting: 12 hours

• Capacity planning: 4 hours

• Documentation and runbooks: 4 hours

Total: 80 hours/month on average

Breakdown:

• 70% operational toil (backups, patches, storage, HA, monitoring, incidents)

• 30% strategic work (optimization, tuning, capacity planning)

Maya scrolled down to the next section.

Future State: Oracle Exadata Database Service on Google Cloud

Jake’s Time Allocation (Monthly):

• Backup management: 0 hours (automated by Oracle)

• Patch management: 2 hours (reviewing and approving automated patches)

• Storage management: 0 hours (automated scaling)

• High availability configuration: 0 hours (built-in, automated)

• Performance monitoring: 4 hours (dashboard review, alert investigation)

• Performance tuning and optimization: 30 hours

• Query optimization and developer support: 20 hours

• Data architecture and design: 15 hours

• Capacity planning: 3 hours (simplified with automated scaling)

• Strategic database projects: 6 hours

Total: 80 hours/month

Breakdown:

• 8% operational toil (patch approval, monitoring, capacity planning)

• 92% strategic work (optimization, tuning, architecture, developer support)

Jake studied the comparison. “You’re saying I’d spend the same amount of time, just on different things.”

“Not just different things,” Maya said. “More valuable things. Things that actually leverage your expertise. Right now, you’re spending twelve hours a month babysitting backups. Oracle’s Exadata service handles that automatically with built-in snapshot capabilities and point-in-time recovery. Those twelve hours could be spent optimizing SQL queries that are costing us database performance.”

“But what about when something goes wrong with the backups?” Jake asked.

“Then Oracle’s support team troubleshoots it,” Maya said. “Because it’s their infrastructure, their responsibility. You’re not on call at 3 AM because a backup script failed. They are.”

“And if I need to tune something at the storage layer?” Jake pressed.

“You can’t,” Maya admitted. “Because Oracle’s engineers optimize Exadata’s storage layer. But here’s the thing—when was the last time you actually needed to tune storage parameters for performance?”

Jake thought about it. “Honestly? Not in years. We set it up correctly initially, and it’s been stable since then. Most performance issues are bad SQL or missing indexes, not storage configuration.”

“Exactly,” Maya said. “So we’re protecting your ability to tune something you rarely need to tune, at the cost of you spending twelve hours a month managing backups you shouldn’t have to think about.”

She pulled up another document. “Let me show you the cost analysis. Because this isn’t just about your time—it’s about total cost of ownership.”

Current State: Self-Managed Oracle RAC on Premise

Infrastructure Costs:

• Database servers (2 nodes): $180K capital (5-year depreciation: $36K/year)

• Storage (SAN): $240K capital (5-year depreciation: $48K/year)

• Network equipment: $40K capital (5-year depreciation: $8K/year)

• Data center space, power, cooling: $24K/year

• Hardware maintenance contracts: $32K/year

Software Costs:

• Oracle Database Enterprise Edition licenses: $94K (already owned)

• Oracle RAC licenses: $47K (already owned)

• Oracle support contracts (22% annually): $31K/year

Personnel Costs:

• Jake’s time on database infrastructure: 80 hours/month × $85/hour = $81,600/year

• Infrastructure team support: $24K/year

Total Annual Cost: $284,600/year

Maya scrolled to the comparison.

Future State: Oracle Exadata Database Service @ Google Cloud

Infrastructure Costs:

• Exadata X9M Quarter Rack: $168,000/year (consumption-based pricing)

• Includes: compute, storage, networking, all infrastructure

• Includes: automated backups, patching, and high availability

• Includes: Oracle’s 24/7 infrastructure support

Software Costs:

• Oracle Database Enterprise Edition: included in Exadata service

• Oracle RAC: included in Exadata service.

• Oracle support: included in Exadata service

Personnel Costs:

• Jake’s time on database infrastructure: 6 hours/month × $85/hour = $6,120/year

• Jake’s time on strategic work: 74 hours/month (no additional cost, reallocated time)

• Infrastructure team support: $0 (no longer needed)

Total Annual Cost: $174,120/year

Annual Savings: $110,480

Jake stared at the numbers. “We’d save $110,000 per year by moving to Exadata?”

“And that’s conservative,” Maya said. “I didn’t account for the cost of our time during the quarterly patch cycles. I didn’t include the cost of storage upgrades every three years. I didn’t factor in the opportunity cost of incident response time. The real savings are probably closer to $140,000 annually.”

“But we already own the hardware,” Jake protested. “That’s sunk cost.”

“True,” Maya said. “But the hardware is six years old. In two years, we’ll need to replace it. That’s another $460,000 capital expense that we can avoid entirely by moving to Exadata as a service. Plus, we can decommission the data center space and stop paying for power and cooling.”

“What about the Exadata cost?” Jake asked. “That’s $168,000 per year. That’s not cheap.”

“It’s not,” Maya agreed. “But it’s less than what we’re spending now, and it includes things we currently pay for separately—software licenses, support contracts, infrastructure maintenance. Plus, it scales. Right now, if we need more database capacity, we have to buy another SAN array and another server. Six-month lead time, huge capital expense. With Exadata on GCP, we can scale up in hours by adjusting our consumption tier.”

Jake was carefully reading the cost breakdown. “You said Jake’s time on database infrastructure drops to six hours per month. What are those six hours?”

“Reviewing automated patch schedules and approving them, checking capacity trends, and investigating any performance alerts that come through observability,” Maya said. “The stuff that actually requires your judgment. Everything else—the backups, the storage management, the HA configuration, the routine monitoring—that’s handled by Oracle’s automation.”

“And the other seventy-four hours I’m supposedly spending on strategic work,” Jake said. “What does that actually look like?”

Maya pulled up a new document. “I’m glad you asked. I’ve been thinking about this a lot. Here’s what a modern DBA role looks like when you’re not buried in operational toil.”

The Strategic DBA: Redefining Value

Performance Optimization (30 hours/month):

• Proactive SQL tuning based on observed query patterns

• Identifying and fixing performance anti-patterns

• Working with application developers on database-efficient code

• Analyzing and optimizing batch job performance

• Eliminating performance bottlenecks before users notice them

Data Architecture (15 hours/month):

• Designing efficient database schemas for new functionality

• Planning and executing data model improvements

• Evaluating and implementing new Oracle features

• Capacity planning based on business growth projections

• Data archiving and retention strategy

Developer Enablement (20 hours/month):

• Reviewing SQL queries in code reviews

• Teaching developers database best practices.

• Creating reusable query patterns and templates

• Building tools that help developers write better SQL

• Pair programming on complex database interactions

Platform Evolution (9 hours/month):

• Evaluating new database technologies and features

• Planning database modernization initiatives

• Contributing to platform architecture decisions

• Researching industry best practices

• Strategic projects (machine learning, analytics, etc.)

Jake read through the list, his expression slowly changing from defensive to thoughtful.

“This is what you think I should be doing instead of managing backups,” he said.

“This is what you’re uniquely qualified to do,” Maya said. “Nobody else on the team can do this work at the level you can. Priya’s a good developer, but she doesn’t understand Oracle internals as well as you do. Tom knows infrastructure, but he can’t tune SQL. Sarah’s brilliant at automation, but she doesn’t have your depth of database expertise.”

“But they can all click a button to run a backup,” Maya continued. “And frankly, Oracle’s automated backup system can do it better than any of us because it’s designed specifically for that purpose. So why are we paying you $85 an hour to babysit backups when you could be preventing the kind of performance issues that slow down the entire university?”

Jake was quiet, processing.

“Let me ask you something,” Maya said. “In the last month, how many times have you wanted to work on a database performance issue but couldn’t because you were dealing with operational overhead?”

Jake exhaled. “Last week. We had a batch job running slowly—probably a missing index or a bad query plan. But I was in the middle of patch testing, and by the time I got to it, the job had finished. It’ll probably be slow again next month, but I haven’t had time to investigate properly.”

“That’s exactly what I’m talking about,” Maya said. “You have expertise that could have prevented that slow batch job. But you were spending your time on patch testing that could be automated. That’s a misallocation of your talent.”

“Okay,” Jake said slowly. “I see the argument. But I still have concerns. What about control? Right now, if I need to change an Oracle parameter, I can. With Exadata as a service, do I lose that?”

“Some parameters you can still change,” Maya said. “Database-level configuration, optimizer settings, memory allocation within your allocated resources—all of that’s still under your control. What you can’t change is infrastructure-level stuff like storage configuration or networking. But again, when was the last time you needed to change those?”

“Fair point,” Jake admitted.

“And here’s the thing,” Maya continued. “The infrastructure parameters Oracle sets for Exadata are based on thousands of customer deployments and years of engineering. They’re probably better than what we configured six years ago when we set up our RAC cluster.”

Tom had wandered over during the conversation and was listening from the doorway.

“Can I jump in here?” Tom asked.

“Please,” Maya said.

“Jake, I had the same reaction you’re having when Maya talked about infrastructure as code,” Tom said. “I felt like we were throwing away fifteen years of experience. But what I learned is that automation doesn’t replace expertise—it multiplies it. My knowledge of how to configure an application server is now in Chef cookbooks that anyone can run. That doesn’t make me less valuable. It makes my knowledge more valuable because it’s reusable.”

“And you’re not worried about job security?” Jake asked.

“I was,” Tom admitted. “But then I realized—organizations don’t pay us to click buttons. They pay us to solve problems and make good decisions. If all we’re doing is clicking buttons, then yeah, we should worry. But if we’re solving problems? That’s always going to be valuable.”

Sarah had joined them now, too, along with Marcus and Priya.

“What’s going on?” Sarah asked.

“Jake’s concerned about moving to managed Exadata,” Maya explained. “He’s worried about losing control and becoming irrelevant.”

“Oh, I can speak to that,” Sarah said. “Before I came here, I worked at a company that moved from self-managed databases to Amazon RDS. The DBAs freaked out initially. Same concerns—losing control, becoming unnecessary.”

“What happened?” Jake asked.

“Their jobs got way more interesting,” Sarah said. “They stopped spending time on backups and patches and started building internal database tooling. They created query analysis frameworks that automatically identified slow queries and suggested optimizations. They built a data pipeline automation. They became strategic partners to the development teams instead of people you ticket when the database is full.”

“And nobody got laid off?” Jake asked.

“Nobody,” Sarah confirmed. “They just redirected their energy to higher-value work. One guy became the data architecture lead. Another one built an entire internal analytics platform. The third one began providing database performance consulting to all development teams. They went from firefighters to architects.”

Maya pulled up one more document on the screen. “Jake, I want to show you something else. This is what happens to organizations that resist managed services.”

The Traditional DBA Career Path: Self-Managed Databases

Year 1-5: Learning database administration, operational basics
Year 6-15: Deep expertise in backup/recovery, performance tuning, HA configuration
Year 16-25: Senior DBA, mentoring others, and making architecture decisions
Year 26+: ???

Common challenges:

• Skills become increasingly niche as the industry moves to managed services.

• Operational toil increases with system complexity.

• Difficult to stay current with modern data platforms

• Career mobility decreases (fewer companies want self-managed DBAs)

• Burnout from on-call and operational burden

The Modern DBA Career Path: Managed Services + Strategic Work

Year 1-5: Learning database fundamentals
Year 6-15: Performance optimization, query tuning, data modeling
Year 16-25: Data architecture, platform strategy, cross-platform expertise
Year 26+: Database architect, data platform lead, strategic advisor

Advantages:

• Skills remain relevant (performance optimization always matters)

• Learning time freed up for new technologies (cloud platforms, analytics, ML)

• Career mobility increases (strategic skills transfer across companies)

• Better work-life balance (less on-call operational burden)

• Higher compensation (strategic roles pay more than operational roles)

Jake studied both paths. “You’re saying that by resisting managed services, I’m actually limiting my career growth.”

“I’m saying the industry is moving to managed services whether we like it or not,” Maya said gently. “AWS, GCP, Azure—they’re all betting big on managed databases. Oracle is investing heavily in Exadata as a service. In five years, most enterprise databases will be managed services. DBAs who only know how to manage infrastructure will struggle. DBAs who can optimize performance and design data architectures will thrive.”

“And you think I can make that transition?” Jake asked.

“I know you can,” Maya said. “Because you’re already doing it. Last week, you spotted a performance issue in our monitoring data before it became critical. That’s the kind of proactive work that managed services enable. You weren’t busy patching, so you had time to actually analyze performance trends.”

Priya spoke up. “Jake, can I ask you something? What part of your DBA work do you actually enjoy?”

Jake thought about it. “The puzzle-solving. When someone says, ‘this query is slow,’ and I get to figure out why. Looking at execution plans, finding the missing index or the bad join, fixing it, and seeing the performance improve. That’s satisfying.”

“That’s the work Maya’s saying you’d get to do more of,” Priya said.

“Yeah,” Jake said quietly. “I guess it is.”

Marcus added, “And honestly, Jake, we need you to do more of that. I’ve got integration queries that I know could be faster, but I don’t know enough about Oracle to optimize them. If you had more time to work with me on that, our integrations would be way more efficient.”

“Same with me,” Priya said. “I write SQL in my customizations, but I know I’m probably doing dumb things. I could use a DBA who has time to review my queries and teach me better patterns.”

Jake looked at his team—people who wanted to learn from him, who valued his expertise, who needed him to do more strategic work than he currently had time for.

“Okay,” Jake said finally. “I’m still nervous about this. But I see the argument. Show me what this Exadata migration actually looks like.”

Maya pulled up the migration plan she’d drafted. “We’re not ripping and replacing. We’re doing a methodical migration with extensive testing.”

Exadata Migration Plan: 6 Weeks

Week 5 (This Week): Planning and Preparation

• Jake evaluates Exadata capabilities vs. the current RAC setup.

• Identify any features we use that work differently on Exadata.

• Build a test plan for functionality validation.

• Set up Exadata test environment on GCP.

Week 6: Development Environment Migration

• Migrate the dev database to Exadata.

• Run full test suite

• Validate performance, functionality, and integrations.

• Team learns Exadata management interfaces.

Week 7: QA Environment Migration

• Migrate the QA database using the refined process.

• Extended testing with real workloads

• Performance benchmarking

• Backup/recovery testing

Week 8: Performance Validation

• Compare performance metrics: Exadata vs. RAC.

• SQL query performance analysis

• Batch job timing validation

• User acceptance testing

Week 9-10: Production Migration Planning

• Final migration runbook

• Rollback procedures

• Communication plan

• Schedule maintenance window

Production Migration: Week 11

• Execute during scheduled maintenance.

• Monitor closely post-migration

• Jake’s full attention is on performance validation.

“Six weeks from planning to production,” Maya said. “And you’re involved in every step. You’re the one validating that Exadata meets our performance requirements. You’re the one deciding if we’re ready to migrate production. This isn’t me taking control away from you—it’s you using your expertise to evaluate a better platform.”

Jake nodded slowly. “Okay. I can work with this. But I have conditions.”

“Name them,” Maya said.

“One: if we migrate to Exadata and performance is worse than our current RAC setup, we roll back. I’m not going to sacrifice database performance to save money.”

“Agreed,” Maya said. “Performance is non-negotiable.”

“Two: I’m the one who decides when we’re ready to migrate production. If I say we need more testing, we take more time.”

“Absolutely,” Maya said. “You’re the database expert. I trust your judgment.”

“Three: I want time allocated for learning. If I’m going to become this strategic DBA you’re describing, I need to actually learn new skills. Performance tuning, data architecture, and modern analytics platforms. I can’t just figure it out on my own while doing my regular job.”

“I can support that,” Maya said. “How about four hours per week for focused learning? Online courses, conferences, certifications—whatever you need.”

“Four hours per week is good,” Jake said. “And one more thing: I want regular check-ins with you about my career development. If we’re redefining what a DBA does, I want to make sure I’m actually growing into that role and not just spinning my wheels.”

“Monthly one-on-ones focused on career development,” Maya offered. “On top of our regular status meetings. We’ll talk about what you’re learning, what projects you want to work on, and where you want to grow.”

“Okay,” Jake said, extending his hand. “I’m in. Let’s evaluate Exadata.”

Maya shook his hand. “Thank you for being open to this. I know it’s uncomfortable.”

“It’s terrifying,” Jake corrected with a slight smile. “But Tom’s right—I don’t want to be clicking buttons for the next ten years. If managed services free me up to do more interesting work, I should at least give it a fair evaluation.”

As the impromptu meeting dispersed, Sarah lingered behind with Maya.

“That was well handled,” Sarah said quietly. “You could have pulled rank and just mandated the migration. But you made the case and let him come to the decision himself.”

“People don’t resist change,” Maya said. “They resist being changed. If I’d just mandated Exadata, Jake would have complied but resented it. By walking him through the reasoning and giving him control over the migration, he’s bought in. Now he’ll make this succeed because he chose it.”

“Very Machiavellian,” Sarah said, grinning.

“Very practical,” Maya corrected. “We have eight weeks left to prove PeopleSoft modernization works. I need my team engaged and motivated, not compliant and resentful. Jake’s expertise is critical to this working. I need him all-in.”

“Do you think Exadata will actually be better than our current setup?” Sarah asked.

“Honestly? I think it’ll be roughly equivalent performance-wise with significantly lower operational burden,” Maya said. “But the real win isn’t performance—it’s freeing Jake to do higher-value work. If we can show Harrison that we’re not just cutting infrastructure costs, but also making our team more strategic and valuable, that’s a compelling story.”

“Strategic team modernization,” Sarah said. “Not just technology modernization.”

“Exactly,” Maya said. “The platform doesn’t matter if the people operating it aren’t growing.”

Wednesday Afternoon: The Exadata Evaluation

By Wednesday afternoon, Jake had spent two days deep in Oracle Exadata documentation, architecture diagrams, and performance whitepapers. The team gathered for his evaluation presentation.

“Alright,” Jake said, pulling up his slides. “Maya asked me to evaluate whether Oracle Exadata Database Service on Google Cloud is a viable replacement for our current RAC environment. Here’s what I found.”

He clicked to his first slide: a comparison chart.

Oracle RAC (Current) vs. Exadata (Proposed)

Architecture:

• RAC: Two database nodes, shared SAN storage, application-level high availability

• Exadata: Integrated system with compute nodes and intelligent storage servers

Performance Features:

• RAC: Standard Oracle performance (dependent on our tuning)

• Exadata: Smart Scan, Hybrid Columnar Compression, Storage Indexes, Flash Cache

High Availability:

• RAC: Node failover (we manage), manual storage failover

• Exadata: Automatic failover, storage redundancy built in, automated recovery

Backup/Recovery:

• RAC: RMAN scripts we maintain, recovery time depends on backup size

• Exadata: Automated snapshots, incremental forever backups, fast recovery

Patching:

• RAC: Manual patch application, extensive testing, quarterly 40-hour effort

• Exadata: Rolling patches with zero downtime, Oracle-tested combinations

“First thing I looked at was whether Exadata could actually run PeopleSoft,” Jake said. “Answer: yes. Oracle specifically supports PeopleSoft on Exadata. In fact, several large universities are already running it—Ohio State, University of Michigan, Penn State. So we’re not pioneers. We’re followers, which is good for risk management.”

He clicked to the next slide.

Performance Analysis

“Second question: will it be faster, slower, or the same as our current setup? This is what I spent most of my time on.”

Jake pulled up a detailed analysis. “Exadata has several performance features we don’t have with standard RAC. Smart Scan pushes query processing down to the storage layer, dramatically speeding up full-table scans. Hybrid Columnar Compression can reduce storage requirements by 10x for historical data. Flash Cache speeds up frequently accessed data.”

“But here’s the thing,” Jake continued. “Those features mainly help with analytics workloads and data warehouse queries. PeopleSoft is primarily an OLTP workload—lots of small transactions, index lookups, not many full table scans. So we won’t see massive performance gains from Smart Scan.”

“So it won’t be faster?” Tom asked.

“I didn’t say that,” Jake clarified. “The flash cache and faster storage will help our random read performance, which PeopleSoft does a lot of. And the automated performance tuning that Exadata does in the background is better than what I do manually. Overall, I’d expect 10-20% better performance for typical PeopleSoft operations, with potentially much better performance for reporting and analytics.”

“What about batch jobs?” Priya asked.

“That’s where it gets interesting,” Jake said. “Our batch jobs do a lot of full table processing. Smart Scan could significantly speed those up—potentially 30-50% faster. But I won’t know for sure until we test with real workloads.”

He clicked to the next slide: Operational Considerations.

“Third question: what do we give up by moving to a managed service?”

What We Lose:

• Direct access to storage layer configuration

• Ability to customize RAC parameters that we never customize

• Some diagnostic capabilities (replaced by Exadata-specific tools)

• The satisfaction of manually managing infrastructure (not actually a loss)

What We Gain:

• Automated patching with zero downtime

• Better performance out of the box

• Oracle’s 24/7 infrastructure support

• Automated scaling (add capacity in hours, not months)

• Advanced performance features (Smart Scan, compression, flash cache)

• Simplified disaster recovery (automated snapshots, fast recovery)

“Honestly?” Jake said. “Most of what we ‘lose’ is stuff I rarely touch. We set up our RAC cluster six years ago and haven’t changed the fundamental configuration since. I’ve tweaked database parameters, sure, but I can still do that on Exadata. The infrastructure-level stuff we lose access to? I won’t miss it.”

“What about the diagnostic tools?” Marcus asked. “You use those for troubleshooting, right?”

“I use Oracle’s diagnostic tools—AWR reports, SQL tuning advisor, execution plans,” Jake said. “All of those still work on Exadata. What I lose is access to low-level storage diagnostics. But Exadata has its own diagnostic tools that are actually better for that platform. It’s not a loss—it’s a different toolset.”

Jake pulled up his next slide: Risk Assessment.

Migration Risks:

High Risk:

• None identified

Medium Risk:

• Performance regression for specific queries (mitigation: extensive testing)

• Team learning curve on Exadata management (mitigation: training and Oracle support)

• Migration execution issues (mitigation: detailed runbook, tested rollback)

Low Risk:

• Compatibility issues (PeopleSoft is certified on Exadata)

• Functional gaps (Exadata is a superset of RAC capabilities)

“I spent a lot of time looking for showstopper risks,” Jake said. “Things that would make this migration a bad idea. I didn’t find any. The biggest risk is that we screw up the migration itself, not that Exadata can’t handle our workload.”

Sarah raised her hand. “What about vendor lock-in? Once we’re on Exadata, are we stuck with Oracle forever?”

“We’re already stuck with Oracle,” Jake said bluntly. PeopleSoft runs on Oracle Database. Whether it’s RAC in our data center or Exadata on GCP, we’re committed to Oracle. The Exadata service doesn’t increase our lock-in—it just changes who operates the infrastructure.”

“Fair point,” Sarah said.

Jake pulled up his final slide: Recommendation.

Recommendation: Proceed with Exadata Migration

Rationale:

• Meets all functional requirements

• Expected 10-20% performance improvement for OLTP, 30-50% for batch

• Reduces operational burden by ~90%

• Lowers total cost by $110K annually

• Enables strategic DBA work vs. operational toil

• Low migration risk with a proven rollback plan

Conditions:

• Complete testing in dev and QA before production migration

• Performance validation with real workloads

• Team training on Exadata management

• My approval is required before production migration.

“I’m recommending we do this,” Jake said. “Not because Maya told me to, but because it’s legitimately a better platform for less money with less operational overhead. The only way I’d recommend against it is if we found performance issues in testing. But I don’t expect to find them.”

The room was quiet.

“Questions?” Jake asked.

Tom spoke up. “Jake, are you actually comfortable with this? You were pretty opposed on Monday.”

“I was,” Jake admitted. “Because I was thinking about what I’d lose. But after two days of really looking at Exadata—reading the architecture docs, reviewing performance benchmarks, and thinking through the operational model—I’m convinced this is the right move. Not just for cost savings. For operational excellence.”

“What changed your mind?” Priya asked.

“Two things,” Jake said. “First, I realized I was defending my ability to do work I don’t actually want to do. Managing backups isn’t fulfilling. Patching databases isn’t fun. I was defending that work because I thought it made me valuable. But it doesn’t. What makes me valuable is my ability to optimize database performance and to design effective data architectures. Exadata frees me up to do more of that.”

“And second?” Maya prompted.

“Second, I realized that resisting managed services is like… you know how some sysadmins refused to learn virtualization ten years ago because they thought it was ‘not real infrastructure’? And then virtualization became standard, and those sysadmins became obsolete? I don’t want to be that person. The industry is moving to managed services. I can either complain about it and become irrelevant, or I can adapt and stay valuable.”

“That’s a pretty mature perspective,” Marcus said.

“I’m twenty-six years into my career,” Jake said. “I’d like to have another twenty years. That means evolving with the industry, not fighting it.”

Maya stood up. “Alright. Jake recommends proceeding with the Exadata migration. I agree. Unless anyone has serious objections?”

Silence.

“Good,” Maya said. “Here’s the plan for the rest of this week. Jake, you’re setting up the Exadata test environment on GCP. Sarah, you’re helping him with the GCP integration. Tom, start documenting our application server connection strings so we can update them during migration. Marcus, review our integrations that hit the database directly—we need to make sure they’ll work on Exadata. Priya, work with Jake on the testing plan. Lisa, start building the migration runbook.”

“What about you?” Jake asked.

“I’m updating our cost model for Harrison’s weekly report,” Maya said. “And drafting the business case for Exadata that we’ll use in the final Week 12 presentation. This is a big deal—$110,000 in annual savings is significant. I want to make sure we communicate the value clearly.”

As the team dispersed to start their work, Jake pulled Maya aside.

“Thank you,” he said quietly.

“For what?” Maya asked.

“For not just ramming this through,” Jake said. “You could have said, ‘We’re migrating to Exadata, deal with it.’ Instead, you made the case, showed me the data, and let me come to my own conclusion. That matters.”

“You’re the database expert,” Maya said simply. “If you thought Exadata was a bad idea, I would have listened. I’m not trying to push technology for technology’s sake. I’m trying to build a better operation. And that only works if the people doing the work believe in it.”

“I believe in it now,” Jake said. “And I’m actually excited about this. For the first time in years, I’m thinking about database work as something more than just keeping the lights on.”

“That’s what I was hoping for,” Maya said. “Now go set up that test environment. I want to see Exadata running by the end of the week.”

Friday Afternoon: First Test

By Friday afternoon, Jake had the Exadata test environment running on Google Cloud. The team gathered to watch the first database restore from their production backup to the new platform.

“This is it,” Jake said, initiating the restore process. “Production database backup from last night, restoring to Exadata. On our old system, this would take about six hours. On Exadata with their snapshot technology…”

They watched the progress indicator.

Forty-two minutes later, the restore was completed.

“Forty-two minutes,” Jake said, staring at the screen. “For a 1.2 terabyte database. That’s… that’s eight times faster than our current restore process.”

“That’s your disaster recovery time,” Maya said. “Forty-two minutes from disaster to running database.”

“Run a query,” Tom suggested. “Let’s see if it actually works.”

Jake opened SQL Developer and connected to the Exadata instance. He ran a complex query that he knew typically took about eight seconds on their production system.

It returned in 4.3 seconds.

“That’s almost twice as fast,” Jake said, running it again to make sure. 4.2 seconds. “Same query, half the time.”

“Is that the Smart Scan feature?” Priya asked.

“Probably a combination of things,” Jake said, pulling up the execution plan. “Flash cache, faster storage, and yeah, some Smart Scan optimization. This query does a full table scan on a large table, which is exactly what Smart Scan helps with.”

He ran another query—a typical PeopleSoft transaction query with lots of index lookups.

Production time: 0.3 seconds
Exadata time: 0.2 seconds

“About 30% faster on OLTP queries too,” Jake noted. “The flash cache is helping with hot data.”

Sarah was watching the Exadata performance monitoring console. “Look at the storage I/O. Those storage servers are doing offload processing—they’re filtering data before sending it to the database layer. That’s really cool architecture.”

“It is,” Jake admitted. “Oracle actually did something smart here. Instead of just throwing faster hardware at the problem, they redesigned the architecture to push processing closer to the data.”

Marcus had a question. “What about our batch jobs? Can we test one?”

“Let’s try the nightly student enrollment batch,” Jake said. “In production, that typically runs for two hours. Let me kick it off here with yesterday’s data.”

He started the batch job, and they watched the progress.

One hour and fourteen minutes later, it was completed.

“That’s 38% faster than production,” Jake said, checking the logs. “Same data volume, same processing logic, just running on better infrastructure.”

“So everything’s faster,” Tom summarized. “Restore time, query time, batch time. All better than what we have.”

“So far,” Jake cautioned. “This is one day of testing with a handful of queries. We need weeks of testing with real workloads before I’m comfortable migrating production.”

“But you’re not seeing any red flags?” Maya asked.

“None,” Jake said. “Which honestly surprises me. I expected to find something that didn’t work well. Some queries were slower, and some features were incompatible. But so far? It’s just better.”

“Maybe Oracle actually knows what they’re doing with this product,” Sarah suggested.

“Don’t get crazy,” Jake said with a smile. “But yeah, they did good work here. This is legitimately impressive infrastructure.”

Maya pulled up the week’s summary on the screen.

Week 5: Database Modernization

Decision Made:

• Migrate from self-managed Oracle RAC to Exadata Database Service on GCP.

• Jake’s full evaluation and recommendation

• Team consensus and buy-in

Test Environment:

• Exadata Quarter Rack deployed on GCP

• Production database restored (42 minutes vs. 6 hours)

• Initial performance testing (10-40% faster across workloads)

• No compatibility issues identified

Business Value:

• Annual cost savings: $110,480

• Operational time savings: 74 hours/month (Jake’s time)

• Performance improvement: 10-40% depending on workload type

• Risk reduction: Automated backups, faster DR, Oracle infrastructure support

Next Steps:

• Week 6: Dev database migration and testing

• Week 7: QA database migration and extended testing

• Week 8-10: Performance validation and production migration planning

“This is what I’m reporting to Harrison on Monday,” Maya said. “One week from ‘we need to evaluate this’ to ‘we have a working test environment and initial positive results.’ That’s execution.”

“Can I add something to the report?” Jake asked.

“Of course.”

“Include that the DBA team fully supports this migration,” Jake said. “I want Harrison to know this isn’t being forced on us. We evaluated it, we tested it, and we believe it’s the right move.”

“That’s valuable,” Maya said, making a note. “I’ll quote you directly in the status report.”

As the team started to pack up for the weekend, Tom pulled Jake aside.

“Hey, I wanted to say something. Your presentation on Wednesday was really good. You could have just rubber-stamped Maya’s plan, but you did real analysis. That matters.”

“Thanks,” Jake said. “I figured if I’m going to recommend a major migration, I should actually understand what we’re migrating to.”

“I think you surprised Maya a little,” Tom said. “In a good way. She was probably expecting more resistance.”

“I surprised myself,” Jake admitted. “Monday morning, I was ready to dig in and fight this. But the more I looked at it objectively, the more I realized the fight was about ego, not engineering. I didn’t want to admit that there might be a better way to run databases than how I’ve been doing it for twenty years.”

“That’s hard to admit,” Tom said.

“Yeah,” Jake agreed. “But you know what’s harder? Spending the next twenty years doing work I don’t enjoy because I was too proud to change. I’d rather spend my time optimizing SQL than babysitting backups. If Exadata lets me do that, I’m all for it.”

They walked out together, leaving the conference room with its whiteboard full of Exadata architecture diagrams and performance benchmarks.

Maya stayed behind for a moment to update her timeline.

Five weeks down. Seven weeks to go.

Week 1: Honest assessment and baseline
Week 2-3: Infrastructure as Code
Week 4: Observability
Week 5: Database modernization decision

They were more than on track. They were ahead.

And more importantly, her team was evolving. Jake had gone from defensive to analytical to advocating for change. That transformation—from “we lose control” to “this is legitimately better”—was exactly what Maya needed to see.

Because the twelve-week challenge wasn’t just about proving PeopleSoft could be modernized.

It was about proving that traditional IT teams could modernize themselves.

One mindset shift at a time.

Technical Takeaway: The Managed Database Services Decision Framework

Jake’s journey from resistance to advocacy illustrates the critical decision framework for PeopleSoft DBAs evaluating managed database services:

The Core Question

Not: “Can we manage databases ourselves?”
But: “Should we manage database infrastructure ourselves?”

These are fundamentally different questions with different answers.

The Traditional DBA Value Proposition

For decades, DBAs justified their value through operational tasks:

• Managing backups and recovery

• Applying patches and updates

• Configuring high availability

• Monitoring disk space and storage

• Troubleshooting infrastructure issues

• Performing routine maintenance

This work is necessary. It’s also increasingly commoditized.

The Managed Services Shift

Managed database services (Oracle Exadata, AWS RDS, Azure SQL Database, Google Cloud SQL), and automated operational tasks:

• Backups happen automatically with point-in-time recovery.

• Patches apply with zero downtime on managed schedules.

• High availability is built in and automated.

• Storage scales automatically

• The provider handles infrastructure monitoring.

• Routine maintenance is automated.

This shift terrifies traditional DBAs because it appears to eliminate their value.

The Reality: Strategic vs. Operational Work

DBAs create value in two categories:

Operational Work (automatable):

• Backup management

• Patch application

• Storage management

• Infrastructure monitoring

• Routine maintenance

• Disaster recovery execution

Strategic Work (not automatable):

• SQL query optimization

• Execution plan analysis

• Index strategy and design

• Data modeling and architecture

• Performance troubleshooting

• Capacity planning based on business trends

• Developer education and support

• Database platform evolution

Managed services eliminate operational work. They amplify strategic work.

The Time Allocation Analysis

Most PeopleSoft DBAs spend:

• 60-80% of time on operational tasks

• 20-40% of time on strategic work

With managed services:

• 5-10% of time on operational oversight

• 90-95% of time on strategic work

Same total hours. Radically different value creation.

The Cost Model

Self-Managed Database Total Cost:

• Infrastructure (servers, storage, networking)

• Software licenses and support

• Data center (space, power, cooling)

• DBA operational time

• Infrastructure team support

• Opportunity cost of DBA time on toil

Managed Database Service Total Cost:

• Service subscription (includes infrastructure, software, support)

• DBA strategic time

• Training and skill development

For most organizations, Managed services cost 30-50% less than self-managed while delivering better performance and reliability.

The Performance Reality

Managed database services often perform better than self-managed:

Why?

• Specialized hardware (Exadata, custom AWS instances)

• Optimized configurations based on millions of workloads

• Advanced features (Smart Scan, storage offload, flash cache)

• Regular performance tuning by provider engineers

• Latest patches and optimizations are applied automatically.

When self-managed might be better:

• Highly specialized configurations requiring deep customization

• Regulatory requirements preventing cloud deployment

• Existing infrastructure with capacity to spare

• Extremely cost-sensitive scenarios (rare)

For typical PeopleSoft workloads, Managed services match or exceed self-managed performance.

The Control Argument

What you actually lose:

• Infrastructure-level configuration (storage, networking)

• Ability to apply custom patches outside provider schedules

• Direct hardware access for diagnostics

What you retain:

• Database-level configuration and tuning

• SQL optimization and query control

• Schema design and modifications

• User and security management

• Application-level performance tuning

The key insight: Most of what DBAs think they need control over, they rarely actually change.

The Career Development Perspective

Traditional DBA skills are decreasing in value:

• Manual backup/recovery procedures

• Infrastructure hardware troubleshooting

• Physical storage management

• On-premise high availability configuration

Modern DBA skills are increasing in value:

• SQL performance optimization (always relevant)

• Cloud database architecture

• Multi-database platform expertise

• Data modeling and design patterns

• Performance analysis and tuning

• Developer enablement and education

• Database automation and tooling

Managed services force DBAs to develop higher-value skills.

The Decision Framework

Evaluate managed services when:

• Operational overhead exceeds 50% of DBA time.

• Infrastructure is aging and needs replacement.

• Disaster recovery is difficult or untested.

• Team lacks deep infrastructure expertise.

• The organization is moving to the cloud.

• Want to reduce operational risk.

Proceed with managed services if:

• Performance testing shows equivalent or better results.

• Cost analysis shows savings (usually 30-50%)

• Team is willing to adapt skillsets.

• Provider supports your database platform and version.

• Regulatory requirements are met.

Stay with self-managed if:

• Truly unique configuration requirements exist

• In-house expertise dramatically exceeds provider capability (rare)

• Regulatory constraints prevent cloud deployment

• Cost analysis definitively favors self-managed (very rare)

The Implementation Approach

Phase 1: Evaluation (1-2 weeks)

• Deep dive on provider capabilities

• Compatibility verification

• Feature gap analysis

• Cost modeling

Phase 2: Proof of Concept (2-3 weeks)

• Deploy test environment

• Restore production data

• Performance benchmarking

• Functionality validation

Phase 3: Migration Planning (2-3 weeks)

• Detailed migration runbook

• Rollback procedures

• Team training

• Risk mitigation planning

Phase 4: Staged Migration (4-6 weeks)

• Migrate the dev environment

• Extended testing in dev

• Migrate QA environment

• Performance validation in QA

• Production migration with careful monitoring

Phase 5: Optimization (ongoing)

• Leverage advanced provider features

• Tune for specific workloads

• Continuous performance improvement

The Team Transformation

Successful managed services adoption requires:

Leadership:

• Clear communication about role evolution

• Career development support

• Training budget allocation

• Patience during the learning curve

DBAs:

• Willingness to learn new tools and approaches

• Focus on strategic skill development

• Embrace of automation (not resistance)

• Trust in provider capabilities

Organization:

• Recognition that value shifts from operational to strategic

• Investment in DBA skill development

• Support for new ways of working

The Bottom Line

The decision between managed and self-managed databases isn’t about technology capabilities.

It’s about organizational priorities:

Choose self-managed if: You want control over infrastructure and are willing to pay (in time and money) for that control.

Choose managed services if: You want to redirect DBA expertise toward strategic work that directly impacts business outcomes.

For most PeopleSoft organizations, managed services are the better choice.

Not because DBAs are unnecessary.

But because DBAs are too valuable to spend their time on operational toil that can be automated.

Jake learned this lesson in Week 5.

The question is: will your DBAs learn it before or after the industry makes the decision for them?

Subscribe now

A strong roadmap reflects how the organization wants to operate in the future. It connects business priorities to technology capabilities in a measurable, adaptable way. Without this alignment, even well-funded initiatives struggle to deliver meaningful outcomes. ERP modernization should not be treated as a one-time project. It should be structured as a continuous evolution guided by clear decision points.

Step 1: Establish Strategic Objectives

Every effective roadmap begins with a clear articulation of strategic objectives. These objectives should reflect both business priorities and operational realities. CIOs need to define what modernization is meant to achieve, whether that is increased agility, cost optimization, improved data visibility, or enhanced user experience. Without this clarity, it becomes difficult to evaluate tradeoffs or measure success.

Strategic objectives also help align stakeholders. Business leaders, finance teams, and IT organizations often have different expectations for ERP outcomes. A shared set of objectives ensures that decisions are evaluated against consistent criteria. This alignment reduces friction later in the roadmap. It also strengthens executive sponsorship and accountability.

Step 2: Assess the Current State Honestly

An honest assessment of the current ERP environment is essential. This assessment should go beyond infrastructure and include processes, integrations, data quality, and team capabilities. Many organizations underestimate the strength of what they already have. Others overlook areas where technical debt or inefficiency has accumulated.

A comprehensive assessment should include:

• Core system stability and performance metrics

• Integration landscape and data flow complexity

• Customizations and their business value

This level of visibility allows CIOs to separate perception from reality. It also highlights areas where modernization can deliver immediate value. Without this baseline, roadmap decisions are based on incomplete information.

Step 3: Define the Target Operating Model

The target operating model describes how the ERP environment will function in the future. It includes decisions about cloud strategy, integration patterns, governance, and team structure. This model is not about specific tools. It is about defining how work gets done and how systems interact.

A well-defined operating model provides a blueprint for modernization. It clarifies roles and responsibilities across IT and business teams. It also establishes standards for deployment, monitoring, and change management. These standards reduce variability and improve predictability.

CIOs should ensure that the operating model supports both stability and innovation. The goal is not to optimize for one at the expense of the other. A balanced model enables continuous progress without introducing unnecessary risk.

Step 4: Prioritize Modernization Initiatives

Once objectives and operating models are defined, the next step is prioritization. Not all modernization efforts deliver equal value. CIOs must identify initiatives that provide the highest impact with manageable risk. This requires evaluating both technical complexity and business benefit.

Effective prioritization often focuses on areas such as:

• Infrastructure modernization to improve scalability and cost efficiency

• Integration improvements to accelerate data flow and reduce friction

• Automation initiatives that reduce manual effort and increase reliability

These initiatives create momentum without requiring large-scale disruption. They also build confidence across stakeholders. Over time, this approach allows organizations to modernize incrementally while maintaining operational continuity.

Step 5: Establish Governance and Metrics

Governance is the mechanism that keeps the roadmap on track. It ensures that decisions align with strategic objectives and that progress is measurable. Without governance, even well-designed roadmaps can drift. CIOs need to define how decisions are made, how priorities are adjusted, and how success is evaluated.

Metrics play a critical role in this process. They provide visibility into whether modernization efforts are delivering the intended outcomes. Metrics should go beyond uptime and include delivery speed, cost efficiency, and business impact. Clear measurement reinforces accountability and supports continuous improvement.

Strong governance also creates transparency. Stakeholders can see how decisions are made and how progress is tracked. This visibility builds trust and reduces resistance to change.

Step 6: Execute in Phases, Not Events

ERP modernization should be implemented in phases rather than as a single transformation event. Phased execution reduces risk by limiting the scope of change at any given time. It also allows organizations to learn and adapt as they move forward. Each phase builds on the previous one, creating a cumulative effect.

Phased approaches also improve resilience. If a particular initiative encounters challenges, it does not derail the entire roadmap. CIOs can adjust priorities and timelines without compromising overall strategy. This flexibility is essential in complex environments.

Over time, phased execution creates a pattern of continuous improvement. The organization becomes more comfortable with change and better able to manage it. This capability is one of the most valuable outcomes of a well-designed roadmap.

Turning Strategy into Sustained Progress

An effective ERP modernization roadmap is not a static document. It is a living framework that evolves with the organization. CIOs who approach modernization as a continuous process are better positioned to adapt to change and capture new opportunities. They avoid the pitfalls of both stagnation and overreach.

The ultimate goal is not modernization for its own sake. It is the ability to deliver consistent, measurable value to the business. A well-structured roadmap provides the clarity and discipline needed to achieve that goal.

☕ This Week’s Focus

Edition 30 marks a major milestone—30 editions of The Modern ERP Digest.

What started as a way to consolidate PeopleSoft, ERP, and cloud insights has grown into a consistent signal for what’s actually happening in the market. And if there’s one theme that stands out this week, it’s this:

ERP is being redefined in real time.

Subscribe now

We’re seeing a collision of forces between AI agents, multicloud architectures, workforce shifts, and evolving expectations of what ERP systems should actually do. The conversation is no longer about systems of record. It’s about systems of action.

At the same time, the PeopleSoft ecosystem continues to evolve in practical, meaningful ways, especially in areas like containerization and AI integration.

Let’s get into it.

☁️ Oracle, Cloud & AI Momentum

🔗 Oracle Multicloud: What’s New
https://blogs.oracle.com/cloud-infrastructure/oracle-multicloud-whats-new-blog
Oracle continues expanding its multicloud strategy, reinforcing a reality many enterprises already accept: no single cloud will meet every need. The focus is shifting toward interoperability and platform flexibility.

🔗 Oracle’s AI Pivot and “Agentic Applications” Strategy
https://markets.financialcontent.com/stocks/article/finterra-2026-4-9-the-ai-landlord-inside-oracles-pivot-to-fusion-agentic-applications
Oracle is leaning heavily into agent-based applications—systems that can act, decide, and automate end-to-end processes. This represents a shift from traditional ERP workflows to more autonomous, AI-driven operations.

👥 Workforce & Organizational Signals

🔗 Oracle Layoff Stories and Employee Perspective (Business Insider)
https://www.businessinsider.com/oracle-employee-laid-off-after-almost-10-years-learned-lessons-2026-4
Personal stories from layoffs highlight the human side of transformation. Behind every strategic shift are real teams navigating uncertainty and change.

🔗 Severance Benchmarking Under the Microscope (HR Executive)
https://hrexecutive.com/oracles-layoff-package-puts-severance-benchmarking-under-the-microscope/
Oracle’s severance approach is drawing attention as organizations rethink how they manage workforce transitions during large-scale transformation efforts.

📊 ERP Strategy & Industry Direction

🔗 Why Your ERP Is Now a Liability—Not an Asset (Manufacturing.net)
https://www.manufacturing.net/artificial-intelligence/article/22964443/why-your-erp-is-now-a-liability-not-an-asset
A provocative take: ERP systems that fail to evolve can become constraints rather than enablers. The key issue isn’t ERP itself, it’s whether it can adapt to modern demands.

🔗 The Next Evolution of ERP: Intelligence Built Around People (Diginomica)
https://diginomica.com/next-evolution-erp-intelligence-built-around-people
ERP is shifting toward more human-centered, intelligence-driven design. AI isn’t just optimizing processes—it’s reshaping how users interact with enterprise systems.

👩‍💻 PeopleSoft Community & Practice

🔗 PeopleSoft Images on Containers (Oracle Blog)
https://blogs.oracle.com/peoplesoft/peoplesoft-images-on-containers
Oracle continues advancing containerization for PeopleSoft, enabling more flexible deployments and aligning with modern platform engineering practices. This is a key step toward scalable, cloud-native PeopleSoft environments.

🔗 PeopleSoft AI Agent – Copilot Studio (YouTube)

This demo showcases how AI agents can integrate with PeopleSoft workflows using tools like Copilot Studio. It’s a glimpse into how conversational and automated interfaces may become part of the PeopleSoft experience.

💬 Aaron’s Take

Thirty editions in, one thing has become very clear:

ERP isn’t standing still—and neither can we.

The narrative that ERP is “dead” keeps resurfacing, but that’s not what’s actually happening. ERP is evolving—sometimes quietly, sometimes aggressively—into something far more dynamic.

AI agents, multicloud strategies, and composable architectures are all pushing ERP beyond its traditional boundaries. But at the same time, platforms like PeopleSoft are adapting in practical ways, through containers, AI integrations, and lifecycle tools.

The real risk isn’t that ERP becomes obsolete.
The real risk is that organizations fail to evolve how they use it.

The teams that win in this next phase won’t chase every trend. They’ll focus on:

• Integrating intelligently
• Automating deliberately
• Modernizing incrementally
• Leading with architecture, not hype

That’s where real progress happens.

🌐 Join the Community

If you want to stay current on ERP strategy, PeopleSoft innovation, and cloud platform trends, subscribe at www.peoplesoftcloud.com.

Each week you’ll get:

✅ Curated ERP and PeopleSoft insights
✅ Context around AI and cloud developments
✅ Practical, real-world guidance

Thanks for being part of the first 30 editions.
On to the next 30.

Subscribe now

However, stability can create a false sense of security. Over time, systems that are not actively modernized drift away from the business’s needs. Integration becomes more difficult, reporting becomes slower, and innovation moves elsewhere. These shifts rarely trigger immediate alarms, but they accumulate into meaningful constraints. What appears safe in the moment can become limiting over time.

The Hidden Risks of Stagnation

The risks of not modernizing are rarely captured in traditional risk registers. They do not show up as outages or critical incidents. Instead, they emerge gradually through reduced agility, increased manual effort, and declining alignment with business priorities. These risks are harder to quantify, which makes them easier to ignore.

Several patterns tend to emerge in stagnant ERP environments:

• Increasing reliance on manual workarounds to bridge system gaps

• Slower delivery timelines for new capabilities and integrations

• Growing disconnect between IT capabilities and business expectations

These patterns create friction that compounds over time. Teams spend more effort maintaining workarounds than delivering new value. Business units begin seeking alternatives outside IT governance. The organization becomes less coordinated and more reactive.

Read more

☕ This Week’s Focus

Edition 29 highlights a growing tension in the ERP and cloud space: acceleration versus alignment.

Oracle is pushing aggressively into AI, with infrastructure investments, partnerships, and now large-scale agent-based automation. At the same time, workforce changes and market reactions remind us that transformation always comes with trade-offs.

Subscribe now

Across the ERP landscape, the conversation is shifting toward ecosystems and composability. Organizations are no longer asking “Which ERP should we choose?” but rather “How should our ERP fit into a broader architecture?”

Meanwhile, the PeopleSoft community continues to move forward with clarity by leveraging OCI, expanding Cloud Manager capabilities, and aligning with the 2026 roadmap.

⚙️ Oracle, AI & Market Signals

🔗 Oracle Layoff Plan Raises Questions (Yahoo Finance)
https://finance.yahoo.com/news/oracle-layoff-plan-raises-questions-011119909.html
Reports of layoffs are raising questions about how Oracle is balancing cost management with its aggressive investments in AI and the cloud. It’s a reminder that large-scale transformation often includes difficult operational decisions.

🔗 Oracle + NVIDIA at GTC 2026: Key Announcements (OCI Blog)
https://blogs.oracle.com/cloud-infrastructure/oracle-nvidia-gtc-2026-key-announcements
Oracle and NVIDIA announced deeper collaboration around AI infrastructure, including expanded GPU capabilities and performance optimizations. The focus remains clear: enable enterprise-scale AI workloads with high-performance compute.

🔗 Oracle Unleashes 1,000 AI Agents (CloudWars)
https://cloudwars.com/ai/oracle-unleashes-1000-ai-agents-to-automate-entire-industries/
Oracle is introducing a large portfolio of AI agents designed to automate complex business processes across industries. This marks a significant step toward agentic ERP, where systems don’t just process data; they act on it.

📊 ERP Strategy & Architecture

🔗 Why ERP Ecosystems Are a Strategic Architecture Decision (Forbes)
https://www.forbes.com/councils/forbestechcouncil/2026/03/20/why-erp-ecosystems-are-a-strategic-architecture-decision/
This piece makes a strong case that ERP is no longer a standalone system, it’s part of a broader ecosystem. Integration strategy, data flow, and platform alignment now matter as much as core functionality.

🔗 Composable ERP: Architectural Reality or Executive Imperative? (ERP Today)
https://erp.today/composable-erp-architectural-reality-or-executive-imperative/
Composable ERP continues gaining attention as organizations look to assemble capabilities rather than replace entire systems. The challenge is balancing flexibility with governance and long-term maintainability.

👩‍💻 PeopleSoft Community & Practice

🔗 Enabling AI for PeopleSoft with OCI (PeopleSoftCareer)
https://blog.peoplesoftcareer.com/enabling-ai-for-peoplesoft-with-oci/
A practical guide to integrating AI capabilities into PeopleSoft using Oracle Cloud Infrastructure. It outlines how AI services can enhance existing workflows without disrupting the core system.

🔗 Cloud Manager Image 21 (Oracle PeopleSoft Blog)
https://blogs.oracle.com/peoplesoft/cloud-manager-image-21
Oracle highlights updates to Cloud Manager Image 21, including improvements to provisioning, lifecycle management, and automation. Cloud Manager continues evolving into a key platform tool for PeopleSoft operations.

🔗 PeopleSoft 2026 Product Roadmap (PeopleSoftCareer)
https://blog.peoplesoftcareer.com/peoplesoft-2026-product-roadmap/
An overview of the 2026 roadmap, including continued investment in UX, AI capabilities, and platform enhancements. The roadmap reinforces Oracle’s long-term commitment to PeopleSoft.

💬 Aaron’s Take

Edition 29 reinforces a shift that’s been building for a while: ERP is no longer a destination; it’s a component of a larger system.

Oracle’s AI push, NVIDIA partnerships, and agent-based automation are all part of a broader strategy to move beyond traditional ERP boundaries. But those moves come with real operational considerations, including cost, workforce alignment, and execution risk.

At the same time, the ERP conversation itself is evolving. Ecosystems and composability are replacing monolithic thinking. The question isn’t whether ERP changes, it’s how well it integrates with everything around it.

PeopleSoft continues to fit into this new model in a very practical way. Instead of being replaced, it’s being extended and connected to AI services, managed through Cloud Manager, and aligned with a clear roadmap.

The organizations that succeed won’t be the ones chasing the biggest changes. They’ll be the ones who thoughtfully architect, deliberately integrate, and consistently evolve.

🌐 Join the Community

If you want to stay current on ERP strategy, PeopleSoft innovation, and cloud platform trends, subscribe at PeopleSoftCloud.com.

Each week you’ll receive:

✅ Curated ERP and PeopleSoft insights
✅ Context around AI and cloud developments
✅ Practical guidance for enterprise technology teams

See you next week for Edition 30.