â This Weekâs Focus
Tomorrowâs CPU carries 109 PeopleSoft patches. The number that matters is how many of them have a named owner who can prove theyâre running in production.
Oracleâs pre-release announcement went up Thursday. The October Critical Patch Update lands Tuesday, October 20: 1,283 new security patches across Oracle, 109 for PeopleSoft, 41 of those remotely exploitable without authentication, and a PeopleSoft CVSS ceiling of 9.8. Itâs also the first quarterly CPU delivered through the Middleware DPK instead of the Infrastructure DPK. And it lands in the middle of RECONNECT week.
None of that is hard to read. The hard part is the sentence nobody wants to say out loud in the CAB: who, by name, applies each layer of this, and how do we know it happened? If a partner, a host, or a contractor sits between you and your servers, that answer is shorter than you think.
Letâs get into it.
đ The October CPU, by the Numbers
đ Oracle Critical Patch Update Pre-Release Announcement â October 2026 (Oracle) https://www.oracle.com/security-alerts/cpuoct2026.html
Published Thursday, October 15, for release Tuesday, October 20. 1,283 new security patches overall. PeopleSoft: 109 new patches, 41 remotely exploitable without authentication, highest CVSS v3.1 base score 9.8. Affected: PeopleTools 8.61â8.63, plus 9.2 HCM Human Resources, Global Payroll Switzerland, FIN Cash Management, SCM Purchasing, Strategic Sourcing and Manufacturing, Common Application Objects, and several 9.1 FIN Brazil/Argentina products. Fusion Middleware: 196 patches, 132 unauthenticated, ceiling 10.0, with WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 on the affected list. Java SE: 55 patches (49 unauthenticated, ceiling 7.5), including 8u503, 11.0.32.1, 17.0.20.1 and 21.0.12.1. Database: 13 patches, 3 unauthenticated. Oracleâs caveat: pre-release details âmay change before publication.â
đ Oracle Critical Patch Update Advisory â July 2026 (Oracle) https://www.oracle.com/security-alerts/cpujul2026.html
For comparison, the July advisory (now at Rev 7) lists 1,448 new patches overall and 84 for PeopleSoft, 45 of them remotely exploitable without authentication. So October is smaller across Oracle and 25 patches bigger for PeopleSoft.
đ Critical Patch Updates, Security Alerts and Bulletins (Oracle) https://www.oracle.com/security-alerts/
Next quarterly CPUs: January 19, 2027, then April 20 and July 20, 2027. The monthly CSPUs continue in between, with the next two on November 17 and December 15.
My read: Donât sort 109 rows by CVSS and call it triage. Sort the 41 unauthenticated rows by what answers from the internet in your shop: PIA, the Integration Broker gateway, anything that should have been PSEMHUB and wasnât removed. Then look at the middleware. WebLogic and Java are on the list, and in October they arrive through the Middleware DPK, either Oracleâs zip âshortly afterâ the CPU or one you build yourself. If your team hasnât rehearsed --apply_mw_cpu in non-prod yet, thatâs tomorrowâs first problem, not Wednesdayâs.
đ§ Who Patches What
đ Oracleâs monthly patch cycle: Run classic apps securely and add AI now (DXC Technology / Gert Vermeyen) https://dxc.com/insights/knowledge-base/blogs/oracle-monthly-patching-classic-apps-ai
October 14, 2026. A partnerâs view, so read the sales pitch past it, but the framing is right. Oracle has issued monthly CSPUs since May 28. Four patch events a year became twelve, and the September update alone carried 673 new patches. The line every CIO should underline: Oracle patches the cloud services it manages. âEverything else is yours, including classic applications hosted on Oracle Cloud Infrastructure (OCI).â DXC names three weak points: proof (quarterly reporting canât show whatâs outstanding), downtime (twelve events donât fit four negotiated windows), and people (if the two or three people who validate each patch spend a week per round, twelve rounds eat nearly a quarter of their year). It closes with three questions. Which parts of our estate does Oracle patch, and which fall to us? Could we prove today that no critical fix is outstanding? Who validates each patch, and what happens when they leave?
đ Modernizing PeopleSoft on Oracle AI Database@AWS and with Amazon FSx for NetApp ONTAP (Apps Associates) https://appsassociates.com/blog/modernizing-peoplesoft-on-oracle-ai-databaseaws-and-with-amazon-fsx-for-netapp-ontap-fsxn/
October 15, 2026. Another partner piece, with a reference architecture for running PeopleSoft on Exadata inside AWS data centers: a Data Guard standby in a second availability zone (synchronous) and a second region (asynchronous), and a shared FSxN filesystem for PS_APP_HOME and PS_CUST_HOME. The run-state details are the useful part. Take a storage snapshot before every patch or PUM update so rollback takes minutes, and use instant clones to stand up a fresh copy of production for a regression cycle. On licensing, the authors say BYOL maps one processor license to two OCPUs and that Oracle allows a 100-day window of concurrent on-prem and cloud licensing during migration. Confirm both with your Oracle rep before you put them in a business case. And note how the post describes PeopleSoft: customers ârun on their own infrastructure, apply their own patches.â
My read: Two partners and two different pitches, but the same fact underneath. Moving the servers doesnât move the patch. Hosting on OCI, moving to AWS, or signing a managed-services contract changes who touches the keyboard. It doesnât change who answers to the board when a fix that shipped never reached production. Write the split down per layer: application and PeopleTools, middleware, database, OS. Then ask each owner for evidence, not status.
đ¤ Governance Is the Product Now
đ Vendors fortify AI in ERP to assure buyers, deter frontier AI rivals (TechTarget / David Essex) https://www.techtarget.com/it-strategy/news/366651906/Vendors-fortify-AI-in-ERP-to-assure-buyers-deter-frontier-AI-rivals
October 12, 2026. A roundup of SAP Connect, Infor Velocity Week, and Oracleâs late-September Fusion Claw launch (25 agentic applications with built-in governance). Four trends: AI user experiences are mostly built; AI is reviving customization inside SaaS ERP; ERP vendors now compete with hyperscalers and frontier model makers more than with each other; and vendors want to prove agents are safe. Joshua Greenbaum (Enterprise Applications Consulting) calls the customization trend a risk, a âreversion to bad habits,â and says the new AI ERP experience âremains aspirational.â Diginomicaâs Jon Reed: âWhat SAP is more concerned about is becoming an API call for someone elseâs AI.â Inforâs new release routes agents through a governance, risk and compliance layer.
My read: PeopleSoft shops have seen this movie. Every agent somebody builds on top of the system of record is a customization with a different name. On PeopleTools 8.63 the MCP server is Oracleâs socket, and the tool definitions, write rights and logging are yours. Track agents the way you track mods: in an inventory, with a named owner and a retirement plan. Oracleâs Customization Insights session this week (below) is the right room to start that conversation.
đď¸ RECONNECT Week Meets CPU Week
đ RECONNECT Dive Deep 2026: PeopleSoft Technology Sessions of Interest (Oracle / Sasank Vemana) https://blogs.oracle.com/peoplesoft/reconnect-dive-deep-2026-peoplesoft-technology-sessions-of-interest
October 10, 2026. Oracleâs PeopleTools picks for the virtual conference, October 19â22 (times Eastern). The ones that line up with this weekâs patch work:
P-053372 PeopleTools Update and Roadmap, Mon Oct 19, 12:00 PM.
P-053348 Securing PeopleSoft REST APIs with OAuth 2.0 and Exploring Webhooks, Mon Oct 19, 4:45 PM.
P-053369 Securing your PeopleSoft Applications, Tue Oct 20, 3:45 PM. Thatâs CPU day.
P-053367 PUM on Containers, Tue Oct 20, 5:00 PM.
P-053370 PeopleTools Platforms Update, Wed Oct 21, 11:30 AM.
P-053378 Exploring Security Enhancements in PeopleTools 8.63, Wed Oct 21, 2:00 PM.
P-053368 Get the Most from Customization Insights, Wed Oct 21, 3:45 PM.
P-053349 PeopleSoft Log Analyzer, Thu Oct 22, 12:45 PM.
P-053371 Q&A with the PeopleTools Product Strategy Team, Thu Oct 22, 3:15 PM.
đ RECONNECT Dive Deep: PeopleSoft HCM, Learning, and HR HelpDesk Sessions (Oracle / Russell Broom) https://blogs.oracle.com/peoplesoft/reconnect-dive-deep-peoplesoft-hcm-learning-and-hr-helpdesk-sessions
October 16, 2026. The HCM roadmap is P-053382, Mon Oct 19 at 3:00 PM ET, and the HCM Product Strategy Q&A is P-053388, Thu Oct 22 at 3:15 PM ET. Payroll and benefits teams should note P-053386 (SECURE 2.0 Section 603 and IRS Section 530a accounts, Tue Oct 20, 11:30 AM ET). Those are the same people you need for CPU regression testing that day.
đ PeopleSoft RECONNECT Dive Deep 2026 (Quest Oracle Community) https://questoraclecommunity.org/events/conferences/peoplesoft-reconnect-dive-deep/
Virtual, October 19â22. Five tracks: PeopleTools & Technology, HCM, FSCM, Campus Solutions, and Expand to Cloud. Hot topics include PeopleTools 8.63, AI and the Natural Language Assistant, Compliance & Security, and Lifecycle Management.
đ Oracle AI World 2026 (Oracle) https://www.oracle.com/ai-world/
October 25â28, Las Vegas, with a free online pass. Itâs mostly OCI, AI Database and Fusion content. Worth watching the keynotes for what Oracle says about agents on its classic applications, if it says anything.
My read: Your payroll SMEs are double-booked Tuesday: CPU regression testing in the morning, a SECURE 2.0 session at 11:30 ET. Decide today which one wins and tell them. Same for your platform team on Tuesday afternoon. Watch the security session live, or apply the CPU to non-prod. Pick one on purpose.
đŹ Aaronâs Take
The leadership decision this week isnât whether to patch. Itâs whether you can name who applies each layer and show the proof by Friday.
Name the triage owner before Tuesdayâs advisory posts. Give them one job: rank the 41 unauthenticated PeopleSoft rows by whatâs reachable from outside, and have a short list in front of you Wednesday morning.
Lock the middleware path today. Oracle-built Middleware DPK zip, or your own from the Builder? Either is defensible. Not deciding isnât. If you wait for Oracleâs zip, your security lead signs the exposure window with an end date.
Write the who-patches-what table for every environment. One table, with rows for application and PeopleTools, middleware, database and OS, and columns for who applies it, who approves it and who verifies it. If a partner or host owns a row, put their name in it, and ask for versions read from the running servers, not a ticket marked done.
Split RECONNECT from the CPU on purpose. Assign the sessions above to specific people, and keep your regression testers off the conference on Tuesday unless youâve moved the test window.
Oracle shipped the fixes on schedule. Whether they reach production comes down to whether every layer has an owner.
Thursdayâs Q&A: A partner runs your PeopleSoft and misses a patch. Whose problem is it, and what proof should you be asking for? Got a PeopleSoft question of your own? Reply to this email.
đ Join the Community
Subscribe to PeopleSoft Cloud at peoplesoftcloud.com for the Monday Digest and the Thursday Q&A. No vendor spin, just what changed and what to do about it.
â Monday: what moved in the PeopleSoft, Oracle and ERP world, with a read on why it matters â Thursday: one real PeopleSoft question, answered straight â Written by a practitioner who still has to make the change window