☕ This Week’s Focus
Your PUM lab is still a hypervisor. Oracle already shipped the successor.
Dan Iverson, PeopleTools Strategy Director, put it in writing twice. On April 8: “We will be ending support for the VirtualBox DPK in the near future.” On July 27, with FSCM Update Image 57 actually on My Oracle Support: the VirtualBox DPK delivery model “is planned to be retired in a future release.” No date. No countdown. The replacement is three pre-built containers and one compose command.
Most shops will still learn that under a deadline, because the PUM environment is still “the laptop that has VirtualBox.” This week Oracle added a second DPK change — Infrastructure DPK is gone in October — and the August CSPU put VirtualBox 7.2.14 itself in the patch pile.
Let’s get into it.
🧰 Containers Are the Preferred PUM Path. VirtualBox Is Not.
🔗 Coming Soon – PeopleSoft Update Images on Containers (Oracle / Dan Iverson) https://blogs.oracle.com/peoplesoft/peoplesoft-images-on-containers
April 8, 2026. Container images are “easier to download — 1 file per container image, easier to start — 1 command for all the containers, and faster to deploy than the VirtualBox or NativeOS DPKs.” Three containers: database, midtier, Insights. Podman on Linux, Podman Desktop on Windows. And the line shops keep scrolling past: Oracle “will be ending support for the VirtualBox DPK in the near future.”
🔗 Getting Started with Update Image Containers (Oracle / Dan Iverson) https://blogs.oracle.com/peoplesoft/getting-started-with-update-image-containers
July 27, 2026. FSCM Update Image 57 is the first PUM that deploys this way. You no longer run the full VirtualBox DPK build. You load three images (latest-19-ps, ep92u057, 862.2.11), edit four text files, and launch with podman-compose up -d (Linux) or podman compose up -d (Windows). Patch number lives on the PeopleSoft Update Manager Homepage, MOS Doc ID KA615. Combine zip parts 2–N; do not include 1ofX.zip. Config is compose.yaml, in/pum/install.rsp, in/pum/psft_customizations.yaml, and in/osk/install-osk.rsp.
Unlike VirtualBox DPK, the container image includes the full search stack (OpenSearch, Dashboards, Logstash), so Insights actually comes up. Configuration lives in files you can reuse on the next image.
My read: This is not an optional format sitting next to VirtualBox. Iverson called containers the preferred path in April and the planned successor in July. FSCM 57 is first. HCM and Campus are still on the old delivery. Waiting for a sunset date is how you end up learning Podman inside a frozen change window.
🔗 PeopleSoft Update Image Containers: PUM Deployment Just Changed (PeopleSoft Career) https://blog.peoplesoftcareer.com/peoplesoft-update-image-containers/
Derek Tomei’s walkthrough of the Iverson/Vemana path, with the Windows vs Linux compose gotcha and the same retirement language. Useful if you want the four steps without MOS open. Comment from Randy Groncki on August 10: he still had to “cut out some time” to try it. That is the actual adoption curve.
🔐 Two DPK Changes. One of Them Is the Hypervisor.
🔗 Oracle Critical Security Patch Update Advisory — August 2026 (Oracle) https://www.oracle.com/security-alerts/cspuaug2026.html
The August 18 CSPU is now Rev 3 as of August 27. Among the affected products: Oracle VM VirtualBox, version 7.2.14. Next four security Tuesdays, from the same page: 15 September 2026 (CSPU), 20 October 2026 (CPU), 17 November 2026 (CSPU), 15 December 2026 (CSPU).
🔗 Oracle VM VirtualBox (August 2026 CSPU) (Tenable, Nessus 338745) https://www.tenable.com/plugins/nessus/338745
Plugin published August 21, updated August 26. Three Core issues on 7.2.14 worth reading before you shrug:
CVE-2026-71131 — CVSS 8.6. Unauthenticated local attacker, user interaction required, scope change, takeover.
CVE-2026-71129 — High-privileged local attacker, scope change, takeover.
CVE-2026-71130 — Unauthenticated attacker with network access via RDP; critical data read plus some write.
My read: Last week’s Digest treated the August CSPU as a PeopleTools problem. It is also a lab-hypervisor problem. If your PUM still lives on VirtualBox, you are patching the thing Oracle is already walking away from — and you are patching it because the hypervisor itself just took an 8.6.
🔗 The Middleware DPK is Replacing Infrastructure DPK (Oracle / Dan Iverson) https://blogs.oracle.com/peoplesoft/the-middleware-dpk-is-replacing-infrastructure-dpk
August 26, 2026. This is the item from this week. Middleware DPK replaces Infrastructure DPK for WebLogic, Tuxedo, Java, Oracle Database Client, and OPatch. Oracle will keep posting a Middleware DPK zip after each CPU. The new piece is Middleware DPK Builder, shipped with PeopleTools: download current middleware CPUs and generate the zip on your schedule instead of waiting for Oracle’s packaged file.
Starting this fall, 8.61, 8.62, and 8.63 all use Middleware DPK. 8.63 has it built in. 8.61 and 8.62 need a patch that adds --apply_mw_cpu (replaces --apply_infra_cpu) plus the Builder. Oracle plans the first Middleware DPK files for 8.61/8.62 in October and does not plan to post an Infrastructure DPK in October. Plan the Builder for the October CPU cycle. 8.63 shops can use it today.
My read: Two DPK transitions in one quarter is not a coincidence. VirtualBox DPK is the PUM-lab format. Infrastructure DPK is the middleware-CPU format. Both are being replaced with something you can run without waiting on Oracle’s packaging queue. If you learn only one of them, you will still miss October.
💸 The Calendar Moved. The Staffing Did Not.
🔗 PeopleSoft Payroll for North America Tax Update 26-C Delivery Moves to September (Oracle / Anne Leung) https://blogs.oracle.com/peoplesoft/peoplesoft-payroll-for-north-america-tax-update-26-c-delivery-moves-to-september
August 20, 2026. Tax Update 26-C is targeted for Wednesday, September 30, 2026, through the HCM Weekly PeopleSoft Release Patchset. HCM Image 56, targeted for November 2026, will include Tax Update 26-D (first year-end set). Weekly HCM PRPs continue through December 2026 and January 2027 — they are regular HCM patches, not a separate payroll package. Bookmark MOS FAQ2322 (Payroll for North America Hot Topics).
My read: This is the 2027 cadence change showing up early. Images slow down; weekly PRPs carry the legally dated work. Your change calendar has to track both, or 26-C lands as a surprise on a Wednesday.
🤖 Oracle Will Not Build Your Agents. 8.63 Gives You the Socket.
🔗 PeopleTools 8.63: Inside Oracle’s 2026 PeopleSoft Update (PeopleSoft Career) https://blog.peoplesoftcareer.com/peopletools-8-63-2026-update/
Derek Tomei on the PeopleSoft Now update. The 8.63 list that matters for next week: MCP servers so agent platforms can talk to PeopleSoft through a standard interface, semantic search, natural-language query infrastructure, chatbot UI components, Customization Insights v2 with functional groups, SAML, TOTP. Paco Aubrejuan’s boundary, as Tomei quotes it: Oracle will not rearchitect PeopleSoft around agent teams. That investment goes to Fusion. PeopleSoft gets enablement — connective tissue, not the agents.
My read: Last Thursday was “who has PeopleTools Security.” Next Thursday after VirtualBox is “five questions before you trust an AI feature with ERP data.” 8.63 gives you a socket. It does not give you a permission model, a data-classification answer, or a log of what the agent touched. If you cannot answer those, do not plug anything into the socket.
💬 Aaron’s Take
Oracle did not hide this. The PUM replacement is on MOS. The hypervisor is in the CSPU. The middleware DPK change landed Wednesday. Three concrete things this week:
Write down every VirtualBox PUM. Host, image number, last successful refresh, who owns the laptop. If that list does not exist, you do not have a sunset plan. You have a rumor.
Stand up FSCM Image 57 on Podman once. Four config files, one compose command, in a sandbox. HCM and Campus shops: you still run NativeOS this cycle, but Podman fluency is the same skill the next image will demand.
Treat October as a DPK deadline, not a CPU deadline. 8.61/8.62 need the Middleware DPK patch before Oracle stops posting Infrastructure DPK. 8.63 can run the Builder now. Put
--apply_mw_cpuin the runbook before the 20 October CPU.Thursday is the five moves to get off VirtualBox DPK before the sunset — which still has no date — forces you.
This is not a “PeopleSoft is old” problem. It is a lab-tooling problem. PeopleSoft isn’t the deadline. The hypervisor under your PUM is.
🌐 Join the Community
Subscribe to PeopleSoft Cloud for the Monday Digest and Thursday practitioner posts — no vendor spin, just what changed and what to do about it.
✅ Monday: what moved in the PeopleSoft, Oracle and ERP world, with a read on why it matters ✅ Thursday: five verifiable actions you can run this week, free, every week ✅ Written by a practitioner who still has to make the change window