The Q&A — one PeopleSoft question, answered straight
The short answer: It’s yours. The partner can lose the contract, but the breach notice, the board conversation and the regulator letter carry your name. Fix it before the next miss. Write down who applies each layer, put a clock on it, and ask for evidence read from the running servers after every cycle, not a ticket marked done.
What changed
On October 6, the FBI’s cyber chief, Brett Leatherman, said the bureau’s breach “occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform.” The FBI removed the contractor. Reuters’ sources said the platform was PeopleSoft and the third party was Accenture. The FBI hasn’t named either one, and the investigation is still open. You don’t need the details to see the pattern. Removing the contractor came after the damage, and it didn’t undo any of it.
Meanwhile, the volume went up. Oracle has shipped monthly CSPUs since May 28. Oracle’s pre-release for this Tuesday’s October CPU listed 109 PeopleSoft patches, and 41 of them can be exploited remotely without credentials. The middleware now arrives through the Middleware DPK, and Oracle has stopped posting Infrastructure DPKs. Hosting doesn’t change the split either. As DXC put it last week, Oracle patches the cloud services it manages, and “everything else is yours, including classic applications hosted on Oracle Cloud Infrastructure (OCI).”
What to do, in order
Draw the line per layer and per environment. List the PeopleSoft application and PUM updates, PeopleTools, the middleware (WebLogic, Tuxedo, Java and the database client, via the Middleware DPK), the database, the OS, and custom code. For each one, name who applies it, who approves it and who verifies it. Include non-prod. Attackers don’t check which environment is “only test.”
Put a clock in the contract. Set days from Oracle’s release to non-prod and to prod, by severity, and a separate rule for out-of-band Security Alerts. Pick numbers your CISO will sign. If the SOW says “timely,” you don’t have a clock.
Ask for evidence, not status. After every cycle, for every environment, get the PeopleTools patch level and middleware versions as read from the servers, the
ptmw-manifestfrom the Middleware DPK zip they applied, and a post-patch scan. “We patched it” is a claim. Versions read from production are evidence.Check it yourself. At least once a quarter, have your own security team scan from outside. For example, confirm
/PSEMHUB/hubdoesn’t answer from the internet. Trust the partner’s report, then verify it.Make a deferral a decision. If the partner can’t make the window, they file a dated risk acceptance with a compensating control and an end date, and your owner signs it. A deferral nobody signed off on is the kind of miss the FBI described.
Ask about October specifically. Has the partner switched its runbooks from
--apply_infra_cputo--apply_mw_cpu? Will it use Oracle’s Middleware DPK zip or build its own? And what’s the date for prod?
My read: most of these misses aren’t a skills problem. They’re a handoff problem. The patch shipped, the partner owned the keyboard, and nobody on the customer side owned checking the result.
Who owns it
Accountability: the CIO, or whoever signed the contract. You can delegate the work, but not the accountability.
The clock and the contract terms: vendor management and the CISO, together.
The evidence review each cycle: the Director of ERP or the PeopleSoft platform owner. Treat it as a standing agenda item, not something you look at only after an incident.
Independent verification: your security team, not the partner’s.
For leaders, in one line: Ask your partner for last month’s proof, with versions read from production, and see how long it takes them to send it.
Got a PeopleSoft question? Reply to this email or leave a comment. I’ll pick one for a future Q&A and answer it straight.
Subscribe at peoplesoftcloud.com.
Sources
🔗 FBI removes Accenture contractor after missed security patch led to breach (Nextgov/FCW, Oct 6, 2026) https://www.nextgov.com/cybersecurity/2026/10/fbi-removes-accenture-contractor-after-missed-security-patch-led-breach/416441/
🔗 Accenture contractor removed from FBI following damaging data breach, sources say (Reuters, Oct 6, 2026) https://www.reuters.com/technology/accenture-contractor-removed-fbi-following-damaging-data-breach-sources-say-2026-10-06/
🔗 FBI breach exposes enterprise patching crisis (InformationWeek, Oct 8, 2026) https://www.informationweek.com/cybersecurity/fbi-breach-exposes-enterprise-patching-crisis
🔗 Oracle Critical Patch Update Pre-Release Announcement – October 2026 (Oracle) https://www.oracle.com/security-alerts/cpuoct2026.html
🔗 Middleware DPK Enablement Patches Now Available (Oracle, Oct 9, 2026) https://blogs.oracle.com/peoplesoft/middleware-dpk-enablement-patches-now-available
🔗 Oracle’s monthly patch cycle: Run classic apps securely and add AI now (DXC Technology, Oct 14, 2026) https://dxc.com/insights/knowledge-base/blogs/oracle-monthly-patching-classic-apps-ai
🔗 ShinyHunters Returns to PeopleSoft With a One-Character WAF Bypass (TrendAI, Oct 1, 2026) https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/shinyhunters-peoplesoft-one-character-waf-bypass