☕ This Week’s Focus
Day-1 access to the October CPU is worthless if your delivery path still points at a package Oracle stopped shipping.
On October 9, Oracle posted the Middleware DPK enablement patches for PeopleTools 8.61 and 8.62. October is the changeover: Oracle plans to deliver Middleware DPK files for those releases with the October CPU cycle and does not plan to post any more Infrastructure DPKs. If your October runbook still says --apply_infra_cpu, you do not have a patch problem yet. You have a path problem.
CIOs do not need another CVE score this week. They need a yes or no: can this shop absorb the cumulative CPU on the delivery mechanism Oracle will actually ship? That is an operating-model question — owners, non-prod rehearsal, Solaris/AIX exceptions, Builder vs Oracle-built zip — and it sits above the CAB ticket.
Let’s get into it.
🧰 October Changed the Delivery Path
🔗 Middleware DPK Enablement Patches Now Available (Oracle / Dan Iverson) https://blogs.oracle.com/peoplesoft/middleware-dpk-enablement-patches-now-available
October 9, 2026. Enablement patches on My Oracle Support: PeopleTools 8.61 patch 40124711, PeopleTools 8.62 patch 40124744. They unlock the Middleware Deployment Package (MW DPK) for middleware CPUs and CSPUs and ship the Middleware DPK Builder. Apply if you run 8.61.23 or earlier or 8.62.13 or earlier on Windows or Linux. 8.63, 8.61.24+, and 8.62.14+ already include support — no enablement patch. The patch does not raise your PeopleTools release level and does not apply middleware security updates. After enablement, apply with --apply_mw_cpu. Middleware DPK supports 8.61–8.63 on Windows and Linux only. There is no Middleware DPK replacement for Infrastructure DPK on Oracle Solaris or IBM AIX.
🔗 The Middleware DPK is Replacing Infrastructure DPK (Oracle / Dan Iverson) https://blogs.oracle.com/peoplesoft/the-middleware-dpk-is-replacing-infrastructure-dpk
August 26, 2026 (the transition notice this week’s enablement closes). Oracle will keep posting an Oracle-built Middleware DPK shortly after CPU patches land; building and validating that package can take a few days. The Builder lets shops that cannot wait generate their own zip from current MOS patches for Java, WebLogic, Tuxedo, Oracle Database Client, and OPatch. First Middleware DPK files for 8.61 and 8.62 planned for October; no Infrastructure DPK planned for October.
🔗 Understanding the PeopleTools Middleware DPKs (Oracle Docs) https://docs.oracle.com/en/applications/peoplesoft/peopletools/8.63/peopletools-middleware-deployment-package-installation-peopletools-863/understanding-peopletools-middleware-dpks.html
Docs confirm the rename (Infrastructure DPK → Middleware DPK prior to 8.63) and a second constraint: PT-MW-DPKs cannot be used for new installations — only to apply CPUs on existing environments. If fixes publish after the MW DPK is posted, you still pull and apply them manually against the PeopleSoft risk matrix.
My read: This is not a “nice-to-have automation” story. It is a prerequisite on the critical path to October 20. Shops that treated the August transition post as roadmap noise now have eleven days to enable, README the patch, and rehearse --apply_mw_cpu in non-prod. Solaris and AIX shops need a written exception path this week, not a surprise on CPU Tuesday.
🔐 Reachability Still Beats the Arrest Headline
🔗 Despite ShinyHunters arrests after FBI jobs data breach, enterprises still have no answers about PeopleSoft risks (CIO / Evan Schuman) https://www.cio.com/article/4230914/shinyhunters-exploitation-of-a-new-peoplesoft-zero-day-hole-threatens-to-change-enterprise-risk-dynamics-2.html
October 5, 2026. Arrests in the ShinyHunters orbit do not answer the operational question for PeopleSoft shops. Frank Dickson (Dickson Research): pull Environment Management Hub and Integration Broker off the public internet — “Doing so does not break normal user sessions.” Short list: apply Oracle’s patch; disable or remove PSEMHUB if unused; hunt logs for encoded PSEMHUB path variants, not just the literal string; if you find a web shell, treat the server as compromised and rotate every credential it could read. On WAF-only shops: attackers walked past path blocks with /%50SEMHUB/. IDC’s Philip Harris fences the “second zero-day” claim: no CVE, not on CISA KEV, Oracle has not commented — the claim comes from the threat actor. Acceligence’s Jeff Valdes: customers reasonably want Oracle to say whether original guidance still holds and which configs raise exposure.
My read: Fence the second-zero-day claim. You do not need it to be true to act on Dickson’s list. Pulling admin endpoints off the public internet is a board-ready control; waiting for an arrest presser is not. Pair this with last week’s compensating-control expiry work — same risk register, same owner question.
🤖 The Socket Shipped. You Still Own the Tools.
🔗 PeopleSoft MCP Server: What PeopleTools 8.63 Means for AI Agents (PeopleSoft Career / Derek Tomei) https://blog.peoplesoftcareer.com/peoplesoft-mcp-server/
October 10, 2026. Walkthrough of Oracle’s Sasank Vemana on Quest’s PeopleSoft Connection podcast. PeopleTools 8.63 ships an MCP server so agents discover PeopleSoft APIs as tools under existing security and user context. Natural Language Search Service routes agent questions through the search index (not live SQL against payroll). Bring-your-own LLM across MCP, Magic Button, and App Designer AI Assist. Vemana’s write example: an agent booking PTO via a time-entry API. Ownership table is the useful part: Oracle ships the socket; you own the LLM, the agent UI, the tool definitions, and which APIs can write. OCI GA was July 29, 2026; on-premises still “to follow” — confirm on the Information Portal before you promise a date.
🔗 AI won’t kill ERP—it will kill ERP customization (AlixPartners / Brian Kalms et al.) https://www.alixpartners.com/insights/102o4ky/ai-wont-kill-erpit-will-kill-erp-customization/
October 8, 2026. Board framing: the question is not whether AI replaces ERP; it is which parts of the enterprise need certainty (deterministic record) and which need judgment (probabilistic reasoning). AI collapses the cost of judgment, not the cost of truth — and amplifies whatever record you feed it. What dies is heavy workflow customization and tightly coupled integration, not the governed ledger. Immediate capital-allocation ask: which committed customization spend is now exposed, and what to stop or defer toward data, governance, and integration foundations.
My read: Same decision in two dialects. Tomei says start read-only and add write tools one at a time with logging. AlixPartners says stop funding bespoke workflow the agent layer will obsolete. Both refuse the “AI replaces the core” slogan. If your 8.63 plan is a demo and not a tool-definition and write-rights policy, you bought a socket with no plug standards.
🧭 Nine Days, Two Calendars, One Team
🔗 PeopleSoft Patching is a Team Sport (New Resources / Mike Engel) https://newresources.com/peoplesoft-on-the-record-patching-is-a-team-sport/
~October 5, 2026. Engel’s point lands harder against the Middleware DPK changeover: applying the patch is often not the expensive part — the regression window is. Monthly cadence asks the same functional owners to show up almost every month. On Middleware DPK: beginning with the October 2026 CPU cycle, 8.61/8.62 need the prerequisite patch; 8.63 already includes support; Builder covers Java, WebLogic, Tuxedo, Oracle Database Client, and OPatch. Flip side: “If you can create the Middleware DPK on Day 1 but your testing process, approvals, documentation, and people are not ready until Day 10, the technology was never the only constraint.”
🔗 Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins (Oracle) https://www.oracle.com/security-alerts/
Next quarterly cumulative CPU: Tuesday, October 20, 2026. Pre-release announcement publishes the Thursday before — October 15. Next CSPUs after that: November 17 and December 15. September CSPU still listed at Rev 1 (15 September 2026). CVE-2026-35273 Security Alert still Rev 1 (10 June 2026).
🔗 PeopleSoft RECONNECT Dive Deep 2026 (Quest Oracle Community) https://questoraclecommunity.org/events/conferences/peoplesoft-reconnect-dive-deep/
Virtual, October 19–22, 2026. Advance registration ends October 16. Stated scale: 1600+ attendees, 120+ organizations, 35+ Oracle speakers, 150+ sessions. Hot topics include PeopleTools 8.63, AI / Natural Language Assistant, compliance and security, OCI, and lifecycle management. Oracle speakers on the bill include Sasank Vemana and Dan Iverson — useful if your Middleware DPK and MCP questions are still open.
🔗 Sessions to Attend at RECONNECT Dive Deep 2026 (MIPRO / Halie Smith) https://miproconsulting.com/sessions-to-attend-at-reconnect-dive-deep-2026-virtual/
October 5, 2026. Two concrete sessions worth parking on the agenda: Notification Composer in FSCM on 8.62 (Wed Oct 21, 5:00pm ET, P-053225) and Customization Insights in FSCM — delivered in 8.62, enhanced in 8.63 (Thu Oct 22, 12:45pm ET, P-053255). Customization Insights is the board-facing inventory question dressed as a dashboard.
My read: RECONNECT and the cumulative CPU collide again. Name who watches roadmap sessions and who owns CPU triage before October 15, when the pre-release lands and the calendar gets loud. Engel’s Day-1 / Day-10 gap is the honest metric for whether Builder helps you or just exposes the bottleneck.
💬 Aaron’s Take
The leadership decision this week is narrow: does your October CPU path still exist, and who owns making it real before the advisory drops?
Confirm Middleware DPK readiness in writing this week. On 8.61.23 / 8.62.13 or earlier (Windows/Linux): download 40124711 or 40124744, apply in non-prod, and run one
--apply_mw_cpurehearsal before October 15. On 8.63 / 8.61.24+ / 8.62.14+: confirm Builder and the new apply flag are in the runbook. Kill every script that still calls--apply_infra_cpu.Write the Solaris / AIX exception now. There is no Middleware DPK replacement on those platforms. If that is your production path, the board deserves a dated plan for how October middleware CPUs land — not a blank stare on the 20th.
Decide Builder vs Oracle-built zip before CPU Tuesday. Builder is for shops that must move on Day 1. Oracle-built is for shops that can wait a few days for a validated package. Either choice needs named functional testers and a regression window, or Day-1 access just moves the queue.
Split RECONNECT week before it splits you. Advance reg ends October 16. Pre-release is October 15. CPU is October 20. Name the roadmap watcher and the CPU triage owner separately. While you are at it: keep PSEMHUB and Integration Broker off the public internet, and do not let an unfenced “second zero-day” claim substitute for Dickson’s short list.
Oracle changed the package. The shops that miss October will not miss it because the advisory was hard to read. They will miss it because the delivery path was still last quarter’s.
🌐 Join the Community
Subscribe to PeopleSoft Cloud for the Monday Digest — no vendor spin, just what changed and what to do about it.
✅ Monday: what moved in the PeopleSoft, Oracle and ERP world, with a read on why it matters ✅ Written by a practitioner who still has to make the change window