The short answer: Get onto the Middleware DPK path and prove it works in non-prod before Tuesday. If you’re on 8.61 or 8.62 at an older patch level, that means applying an enablement patch, running the Builder once, and rehearsing --apply_mw_cpu. Then decide, in writing, whether you build on Day 1 or wait a few days for Oracle’s package.
What changed
On August 26, Oracle announced that the Middleware DPK replaces the Infrastructure DPK for middleware CPUs and CSPUs on PeopleTools 8.61, 8.62, and 8.63. On October 9, Oracle posted the enablement patches on My Oracle Support: 40124711 for 8.61 and 40124744 for 8.62. Oracle calls October the changeover, and it “does not plan to post any more Infrastructure DPKs.”
Today, October 15, the pre-release announcement for the October CPU is out. The CPU itself lands Tuesday, October 20.
If your runbook downloads an Infrastructure DPK and runs --apply_infra_cpu, the package it expects isn’t coming. You don’t have a patch problem yet. You have a path problem.
What to do, in order
Inventory today. For every environment: PeopleTools release and patch level, OS per tier, owner. 8.61.23 or earlier and 8.62.13 or earlier need the enablement patch. 8.61.24+, 8.62.14+, and 8.63 already have Middleware DPK support and the Builder built in.
Kill the old flag. Search runbooks and scripts for
--apply_infra_cpu. Oracle says--apply_mw_cpureplaces it.Apply enablement in non-prod, README first. Snapshot first. No minimum PeopleTools patch level is required, and the patch updates the PeopleTools DPK directory on each server, so plan for every tier. It doesn’t change your PeopleTools release level, and it doesn’t apply any middleware security updates. Enabled isn’t patched. Don’t let anyone report it that way.
Run the Builder once. It ships in
PS_HOME/setup/PsMWDPKBuilder. Extract it and runptmwdb.sh(Linux) orptmwdb.bat(Windows). It can build a DPK, download CPUs only, or just report what’s available. Start with the report. It tells you now, not Tuesday, whether that host can pull from MOS. Keep theptmw-manifestin the generated zip. That’s your evidence.Rehearse the apply. Put the generated zip next to your existing PeopleTools DPKs and run
psft-dpk-setup.sh --apply_mw_cpuon Linux, orpsft-dpk-setup.bat --apply_mw_cpufrom a Windows command prompt (not PowerShell). Confirm versions match the manifest, then smoke test and re-scan.Choose your path. Build your own package with the Builder on Day 1, and your non-prod rehearsal is the only QA it gets. Or wait for the Oracle-built zip, which Oracle posts “shortly after” the CPU. Building and validating it “can take a few days.” Either way, check the risk matrix for fixes published after the Middleware DPK posts and apply those by hand.
Write the Solaris/AIX exception. Oracle’s wording: the Middleware DPK covers Windows and Linux only, and “there is no Middleware DPK replacement for Infrastructure DPK on Oracle Solaris or IBM AIX.” Oracle’s posts don’t describe a packaged alternative. If you run those tiers, document which ones, who patches them and how, what evidence security gets, and when you’ll decide whether they move. Open an SR if you need Oracle’s supported procedure in writing.
My read: most shops should wait for the Oracle-built zip but rehearse the Builder now, so Day 1 is a choice, not a scramble. Mike Engel at New Resources nailed the real constraint: “If you can create the Middleware DPK on Day 1 but your testing process, approvals, documentation, and people are not ready until Day 10, the technology was never the only constraint.”
Who owns it
Three calls, three named owners.
Path choice and rehearsal: the Director of ERP or PeopleSoft platform owner.
How long the middleware stays exposed: the CISO or security lead. Waiting a few days is a risk acceptance, so get it in writing with an end date.
The Solaris/AIX exception: the CIO. That’s a platform and funding decision, not a ticket.
Pushing it to January isn’t a delay. It means running without the packaged path through the October 20 CPU and the November 17 and December 15 CSPUs. If that’s your call, make it on purpose.
For leaders, in one line: Ask your team whether the new path has been rehearsed in non-prod, which option you chose, and who signed the exposure window.
Got a PeopleSoft question? Reply to this email or leave a comment. I’ll pick one for a future Q&A and answer it straight.
Subscribe at peoplesoftcloud.com.
Sources
🔗 Middleware DPK Enablement Patches Now Available (Oracle, Oct 9, 2026) https://blogs.oracle.com/peoplesoft/middleware-dpk-enablement-patches-now-available
🔗 The Middleware DPK is Replacing Infrastructure DPK (Oracle, Aug 26, 2026) https://blogs.oracle.com/peoplesoft/the-middleware-dpk-is-replacing-infrastructure-dpk
🔗 Applying CPUs with PT-MW-DPK on an Existing PeopleSoft Environment (Oracle Docs) https://docs.oracle.com/en/applications/peoplesoft/peopletools/8.63/peopletools-middleware-dpk-builder/applying-cpus-pt-mw-dpk-existing-peoplesoft-environment.html
🔗 Critical Patch Updates, Security Alerts and Bulletins (Oracle) https://www.oracle.com/security-alerts/
🔗 PeopleSoft Patching Is a Team Sport (New Resources / Mike Engel) https://newresources.com/peoplesoft-on-the-record-patching-is-a-team-sport/