☕ This Week’s Focus
Edition 30 went out in April. It’s August. Let’s not pretend otherwise.
The gap wasn’t for lack of news — it’s that I’ve been heads-down building. But the four months I was quiet turned out to be the most consequential stretch for PeopleSoft shops in years: a 9.8-severity zero-day exploited in the wild before Oracle knew, PeopleTools 8.63 landing with AI baked into the developer experience, the VirtualBox DPK finally being put out to pasture, and Oracle shedding 21,000 people while booking a $638 billion backlog.
So this edition is a catch-up. One theme ties it together:
Oracle is spending its balance sheet on AI infrastructure and its headcount on the bill. PeopleSoft customers are the ones who have to plan around that.
Let’s get into it.
🔐 Security: The One You Cannot Defer
🔗 Oracle Security Alert CVE-2026-35273 https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
A CVSS 9.8 unauthenticated RCE in the PeopleTools Updates Environment Management component. PeopleTools 8.61 and 8.62 affected. Oracle shipped an out-of-band patch the same day it disclosed — June 10 — which tells you how bad it was.
🔗 Rapid7: Active Exploitation of the PeopleSoft Zero-Day https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/
The detail that should keep you up: Mandiant observed exploitation between May 27 and June 9 — two weeks before Oracle’s advisory. Added to CISA KEV on June 12. Entry points were /PSEMHUB/hub and /PSIGW/HttpListeningConnector, with outbound SMB used to harvest machine-account NetNTLM hashes. Roughly 100 organizations targeted, education hit hardest.
My read: I wrote about the ShinyHunters campaign back in June. Two months on, the interesting question isn’t the CVE anymore — it’s whether your PSEMHUB and Integration Broker endpoints are still reachable from the internet at all. The patch closed one door. The architecture that exposed it is still there in most shops.
🧰 PeopleTools 8.63: AI Arrives in the Developer Loop
🔗 Quest PeopleSoft Community Newsletter – August 2026 https://questoraclecommunity.org/learn/newsletters/peoplesoft-community-news-2026-august/
The release wave in one place: PeopleTools 8.63 is GA on Cloud, FSCM 9.2.057 posted, Cloud Manager Image 22 available, Interaction Hub 9.1.022 posted. RECONNECT Dive Deep registration is open.
What’s actually new in 8.63 is worth more than a version bump — Oracle put AI where developers and admins live: an AI Assistant inside Application Designer, the “Magic Button” for faster AI enablement, smarter Search, Customization Group Insights, and improved access controls.
My read: Customization Group Insights is the sleeper. Every modernization conversation I’ve ever sat in stalls on the same question — what did we actually customize, and does anyone still need it? Teams answer that with spreadsheets and folklore. Tooling that answers it from the metadata changes the economics of a roadmap. If you’re planning an assessment, 8.63 is now a prerequisite, not an upgrade.
📦 The VirtualBox DPK Era Is Ending
🔗 Coming Soon – PeopleSoft Update Images on Containers (Oracle PeopleSoft blog) https://blogs.oracle.com/peoplesoft/peoplesoft-images-on-containers
Update Images are moving to containers: three images — database, midtier, Insights — pre-installed, one command to start, Podman as the recommended runtime.
🔗 The PeopleSoft VirtualBox DPK Is Dying. Here Is What Replaces It. https://www.linkedin.com/pulse/peoplesoft-virtualbox-dpk-dying-here-what-replaces-derek-tomei-ekkve
A practical walkthrough of the shift: FSCM Update Image 57 ships with a container deployment option. Load three images into Podman, edit four files, launch the stack.
My read: This is the change I’ve been waiting years for, and it’s bigger than convenience. A DPK build was an afternoon and a coin flip. A container pull is a step in a pipeline. Once PUM environments are declarative and disposable, “we only have one test environment” stops being a constraint you defend and starts being a decision you made. That’s the door to real CI for PeopleSoft.
💰 Oracle’s Numbers: Record Everything, Minus 21,000 People
🔗 Oracle Announces Record Q4 and FY 2026 Results https://investor.oracle.com/investor-news/news-details/2026/Oracle-Announces-Record-Q4-and-FY-2026-Results-Driven-by-Cloud-Infrastructure--Cloud-Applications/default.aspx
FY26 revenue $67.4B (+17%). Cloud $34B (+39%). Q4 IaaS $5.8B, up 93%. And the number that matters: RPO of $638B, up 363% YoY, after growing $85B in a single quarter. Backlog is now roughly ten times annual revenue. Reported capex plans run near $95B, with only ~12% of that backlog expected to convert inside 12 months.
🔗 Oracle sheds 21,000 roles over the past year (CNBC) https://www.cnbc.com/2026/06/23/oracle-ai-job-cuts-layoffs-21000.html
Headcount down from 162,000 to 141,000 — about 13% — with AI deployment cited in the annual filing.
🔗 Oracle layoffs hit sales, engineering, security (CRN) https://www.crn.com/news/ai/2026/oracle-layoffs-hit-sales-engineering-security-5-things-to-know
🔗 Layoffs continue into a second month across US, India, Philippines (DCD) https://www.datacenterdynamics.com/en/news/oracle-continues-widespread-layoffs-across-us-india-philippines-and-beyond/
Cuts extending into OCI, Oracle Health, Advanced Customer Services and NetSuite teams.
My read: Put those two links side by side and you have the only Oracle story that matters to a PeopleSoft customer this year. Cloud infrastructure growing 93% while Advanced Customer Services gets thinned is not a contradiction — it’s a stated priority. Practically: assume slower SR turnaround, more churn in your account team, and more of the burden of “knowing your own system” landing on you. Own your runbooks. Document your integrations. Do not architect on the assumption that a support engineer will remember your environment.
🤖 ERP Strategy: Is AI Ending the ERP Era?
🔗 Does AI Mark The End Of The ERP Era? (IT Jungle) https://www.itjungle.com/2026/07/27/does-ai-mark-the-end-of-the-erp-era/
A good walk through McKinsey’s five scenarios for the ~$100B ERP market, including the radical one where agents replicate ERP capability outright and logic becomes a commodity. It also revisits the early-2026 “SaaSpocalypse” selloff that took hundreds of billions off SaaS-ERP market caps.
🔗 What’s New in Oracle AI – August 2026 (Oracle Blog) https://blogs.oracle.com/ai-and-datascience/whats-new-in-ai-august-2026
OCI Enterprise AI: IAM authentication on hosted app endpoints, H100 multi-node serving for imported models, expanded on-demand model availability. Also: Oracle AI World, Las Vegas, October 25–28, 2026.
My read: I don’t buy the disintegration thesis, and this is the third year running I’ve said so. Agents are extremely good at processes and extremely bad at being the system of record for a regulated general ledger. What actually erodes is the layer we spent twenty years defending — the customizations, the bolt-on reporting, the human-in-the-loop shuffling between screens. That’s the part agents eat. The ledger stays.
Which is why 8.63’s AI-in-App-Designer and Customization Group Insights are the more honest signal about where this goes than any market-cap swing.
💬 Aaron’s Take
Four months away gave me a cleaner view of the pattern.
Every item above is the same story told in a different register. Oracle is redirecting enormous capital toward AI infrastructure. It is funding part of that by reducing the human surface area of everything that isn’t AI infrastructure — including the support and services layer PeopleSoft customers have leaned on for two decades. At the same time, it’s shipping genuinely useful tooling into PeopleSoft: containers, metadata insight, AI in the developer loop.
The read is not “Oracle is abandoning PeopleSoft.” The tooling is too good for that. The read is:
Oracle is handing you better tools and expecting you to need less help using them.
That’s a fair trade if you’re ready for it, and a serious problem if your operating model assumes someone else holds the institutional knowledge about your environment.
So, the four things worth doing this quarter:
• Patch, then verify exposure. 8.61/8.62 patched is table stakes. Get PSEMHUB and Integration Broker off the public internet. • Get to 8.63. Not for the version — for Customization Group Insights and the assessment work it unlocks. • Pilot container Update Images. Podman, one Image, one non-prod. Prove the pipeline before you’re forced to. • Write down what only you know. Runbooks, integration inventories, batch dependencies. Assume the outside expert is gone.
None of that is a modernization program. All of it is what makes one possible.
🌐 Join the Community
If you want to stay current on ERP strategy, PeopleSoft innovation, and cloud platform trends, subscribe at www.peoplesoftcloud.com.
Each week you’ll get: ✅ Curated ERP and PeopleSoft insights ✅ Context around AI and cloud developments ✅ Practical, real-world guidance
Edition 31, back on schedule. Thanks for still being here.