🧠 The Modern ERP Digest – Edition 32
Curated by Aaron Engelsrud | Published on PeopleSoftCloud.com
☕ This Week’s Focus
Tomorrow — Tuesday, August 18 — Oracle ships a Critical Security Patch Update. Not a quarterly CPU. A monthly one.
That is the story of this edition, and it is bigger than a calendar change. Since May, Oracle has been releasing targeted security fixes on the third Tuesday of eight additional months a year. Meanwhile the July CPU you already applied has been revised twice — Rev 5 on July 30, Rev 6 on August 12. Your patch cycle was built for four events a year. Oracle now generates roughly twelve, plus revisions, plus out-of-band alerts like CVE-2026-35273.
The vendor changed tempo. Most PeopleSoft shops have not.
Let’s get into it.
🔐 Security: The New Cadence Is Live
🔗 Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins (Oracle) https://www.oracle.com/security-alerts/
Read the CSPU section, not just the CPU table. The next four CSPU dates are 18 August, 15 September, 17 November, 15 December 2026. A pre-release announcement now lands the Thursday before each one — which means the August pre-release was published August 13 and you could already know what is coming.
🔗 Monthly Critical Security Patch Updates Begin May 28, 2026 (Oracle Security blog) https://blogs.oracle.com/security/update-monthly-critical-security-patch-updates-cspus-begin-may-28-2026
The rationale from Oracle: smaller, focused, high-priority fixes that don’t wait for the quarterly train. Quarterly CPUs stay cumulative and still include everything shipped in the CSPUs.
My read: This is a genuine improvement in Oracle’s posture and a genuine problem in yours. “We patch quarterly” was never great, but it at least matched the vendor. It no longer does. If your change calendar has four security windows on it, you are structurally 30-60 days behind on every critical fix Oracle now ships between quarters. Fix the calendar before you argue about the patches.
🔗 Oracle July 2026 Critical Patch Update Addresses 1,235 CVEs (Tenable) https://www.tenable.com/blog/oracle-july-2026-critical-patch-update-addresses-1235-cves
The largest CPU Oracle has ever released: 1,449 patches, 1,235 unique CVEs, 261 critical. PeopleSoft took 84 patches, 45 of them remotely exploitable without authentication.
🔗 Oracle CPU July 2026 Security Update Review (Qualys ThreatPROTECT) https://threatprotect.qualys.com/2026/07/22/oracle-critical-patch-update-july-2026-security-update-review/
Qualys’ breakdown of the PeopleSoft share: 17 of those CVEs carry critical severity ratings with remote code execution as the outcome.
🔗 CVE-2026-47017 — PeopleTools Process Scheduler (Armis) https://cve.armis.com/CVE-2026-47017
Worth singling out. CVSS 8.7, PeopleTools 8.61 and 8.62 only, improper access control in Process Scheduler: a low-privileged authenticated user can read and modify critical application data by tricking another user into a single HTTP interaction. No known exploitation. Fixed in the July CPU.
My read: 45 unauthenticated-network PeopleSoft CVEs in one quarter, and the one people will actually get burned by is an 8.7 that needs a login and a click. Most shops model the perimeter and ignore the authenticated blast radius. Which is Thursday’s topic — see below.
🧰 PeopleSoft Platform: 8.63, Containers, RECONNECT
🔗 PeopleSoft Monthly Newsletter – August 2026 (Quest Oracle Community) https://questoraclecommunity.org/learn/newsletters/peoplesoft-community-news-2026-august/
Still the single best roll-up: PeopleTools 8.63 GA on OCI, Cloud Manager Image 22, FSCM 9.2.057, Interaction Hub 9.1.022. On-premises 8.63 has still not shipped — Oracle’s line remains “will follow soon.” If your 8.63 plan has a date on it, that date is a guess.
🔗 PeopleSoft Update Image Containers (PeopleSoft Career blog) https://blog.peoplesoftcareer.com/peoplesoft-update-image-containers/
A hands-on walkthrough of the container-based Update Image: three images, Podman runtime, no more VirtualBox appliance download.
🔗 The PeopleSoft Connection, Episode 12 — Modernizing PeopleSoft with AI Enablement and PeopleTools 8.63 (Oracle) https://blogs.oracle.com/peoplesoft/the-peoplesoft-connection-episode-12-modernizing-peoplesoft-with-ai-enablement-and-peopletools-8-63
Oracle’s own product team on where 8.63’s AI features are meant to land. Useful for hearing what Oracle thinks the release is for, versus what the feature list implies.
🔗 RECONNECT Dive Deep 2026 — October 19-22, virtual (Quest) https://questoraclecommunity.org/events/conferences/peoplesoft-reconnect-dive-deep/
150+ sessions, all online, roadmap updates from Paco Aubrejuan, Robbin Velayedam, Richa Dubey and Sasank Vemana. Earliest-bird pricing ends August 21 — this Friday.
My read: Register now if you’re going. Not for the discount — because the roadmap sessions are where you’ll find out whether on-prem 8.63 lands in 2026, and that answer changes upgrade budgets.
💰 Oracle’s Balance Sheet Is Now a Planning Input
🔗 Oracle goes for high-stakes ratings gamble in AI strategy (Reuters via Yahoo Finance) https://finance.yahoo.com/technology/ai/articles/analysis-oracle-corp-goes-high-171918690.html
S&P cut Oracle to BBB- in July — one notch above junk. Debt of $129.5B, roughly 4.3x EBITDA, plus ~$260B in data center leases that don’t yet count as debt but that analysts count anyway.
🔗 Oracle plans fresh August layoffs as its AI spending spree bites (TNW) https://thenextweb.com/news/oracle-august-2026-layoffs-ai-capex
Another round this month, per Business Insider, some teams facing double-digit-percentage cuts, targeted to land before September 1. Context: ~21,000 roles gone in FY2026 (162k → ~141k), $1.8B in restructuring charges booked, capex $55.7B against $21.2B a year earlier.
🔗 Oracle’s AI Data Center Funding Tests OCI Delivery Timelines (TechRepublic) https://www.techrepublic.com/article/news-oracle-ai-data-center-funding/
The buyer-side framing: $638B in remaining performance obligations, negative $23.7B free cash flow, ~$40B more debt and equity expected in FY2027. The advice is unglamorous and correct — verify delivery dates, power availability, and contract protections before committing to future OCI capacity.
🔗 Oracle Gets Cheaper Only If The Megawatts Arrive (Trefis) https://www.trefis.com/stock/orcl/articles/611550/oracle-gets-cheaper-only-if-the-megawatts-arrive/2026-08-14
Consensus assumes ~39% annual revenue growth against 17.4% actually delivered over the trailing year, with FY2027 gross margin stepping down as data centers ramp. The valuation rests on construction, not software.
My read: I don’t care about the stock. I care that the company holding my support contract is spending like a utility and cutting like a turnaround. Two consequences worth acting on: test support responsiveness on niche PeopleSoft modules before you depend on it, and put delivery-date language in any OCI capacity commitment past next year. UBS cut its target to $245 from $285 on August 7 partly over a construction delay at one New Mexico site — if a bank’s model bends on one site’s power schedule, so can your migration plan.
🤖 The Agent Layer Arrives in the App Layer
🔗 Oracle Adds New Fusion Agentic Applications and AI Agents for Talent Management (Oracle) https://www.oracle.com/news/announcement/oracle-adds-new-fusion-agentic-applications-and-ai-agents-to-help-improve-talent-management-2026-08-11/
Announced August 11: agent teams for job design, skills profiles, learning, manager coaching, internal mobility and workforce planning — acting inside business processes with access to enterprise data, approval hierarchies and permissions.
🔗 Oracle Turns AI Agents Loose on Talent Management Tasks (UC Today) https://www.uctoday.com/productivity-automation/oracle-ai-agents-talent-management/
The skeptical read of the same launch, and the detail that matters most: the Intelligent Talent Profiles Agent infers employee skills from connected work-system data.
My read: Agentic HCM is where the PeopleSoft-vs-Fusion conversation gets real again. An agent that infers skills from work-system data is exactly the pitch that makes a CHRO ask why HR data still lives in a system nobody’s touched since the last upgrade. Note the asymmetry: PeopleSoft 8.63 gets AI in the developer loop, Fusion gets AI in the business process. That gap is the actual roadmap story, and it will not narrow.
💬 Aaron’s Take
The through-line this week is tempo. Oracle has accelerated everything — security releases from 4 to ~12 a year, feature delivery through continuous images, capital deployment at 2.6x last year’s rate — and PeopleSoft shops are still running annual planning cycles against it.
Three things to do this week:
Put the CSPU dates on the change calendar today. August 18, September 15, November 17, December 15. Subscribe to the Thursday pre-release announcements so you get 5 days of warning instead of zero.
Confirm which PeopleTools release you’re actually on. Both fresh PeopleSoft CVEs this quarter affect 8.61 and 8.62 only. Knowing your version is not the same as knowing your patch level — check both, in writing.
Register for RECONNECT before Friday if the on-prem 8.63 date affects your 2027 budget. The roadmap sessions are the cheapest intelligence available to you all year.
And one thing not to do: don’t treat 45 unauthenticated CVEs as a perimeter problem. The perimeter was Edition 31’s story. The authenticated interior is Thursday’s.
This Thursday: 5 Reasons Your PeopleSoft Patch Cycle Is Slower Than Your Attackers — where the days actually go between Oracle’s release and your production apply.
🌐 Join the Community
Subscribe at www.peoplesoftcloud.com for weekly PeopleSoft, ERP, and cloud platform guidance.
✅ Monday: the Digest — what happened and what it means for your environment ✅ Thursday: practical, verifiable actions you can run this week ✅ Always: primary sources, real numbers, no vendor press-release energy