â This Weekâs Focus
The October cycle closed this week. Oracleâs first Middleware DPK shipped, and attackers were already probing a different October fix. The exposure now is the gap between âavailableâ and âapplied.â
Oracle released the first Middleware DPK at the start of the week, about a week after the October 20 CPU. On October 27, one week after the same CPU, a threat intelligence firm reported scanning against a critical E-Business Suite flaw from that release. And Shadowserverâs honeypots were still logging attempts against Juneâs PeopleSoft flaw as late as October 28.
Meanwhile, at Oracle AI World, the agent announcements were mostly about who an agent runs as.
Letâs get into it.
𧰠The First Middleware DPK Is Out
đ First Middleware DPK is Available (Oracle / Dan Iverson) https://blogs.oracle.com/peoplesoft/first-middleware-dpk-is-available
October 30. Oracle released the first PeopleSoft Middleware DPK âat the beginning of this week.â It marks the move away from the Infrastructure DPK, and customers now need the Middleware DPK for middleware CPUs. Between Patch Tuesday and the release, Oracle says there were three Java patch releases, and each one forced Oracle to rebuild and re-validate the package. Oracle also released a PRP for Cloud Manager Image 22 that enables the Middleware DPK in Cloud Manager and supports applying the enablement patch to managed environments.
My read: Last week I couldnât find a public post confirming Oracleâs October zip. Now there is one. Oracleâs own example makes the case for the Builder: three Java rebuilds in about a week is three reasons your window might not wait for Oracleâs package. Whichever path you take, Oracle says the same thing I would: test the DPK in your environment before it touches production. If you run Cloud Manager, the Image 22 PRP goes on this weekâs list.
đ The Clock Started Before Most Windows Opened
đ Hackers now scanning systems for recently-patched Oracle flaw (BleepingComputer) https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/
October 28. CVE-2026-101767 is a critical, unauthenticated flaw in the E-Business Suite Application Object Library, fixed in the October 20 CPU. Defused said its EBS decoys recorded âexploratory exploitsâ on October 27, describing it as a SQL injection in the Thin Client Framework servlet that chains to remote code execution. Oracle had not tagged it as exploited at publication. Shadowserver tracks 670+ internet-exposed EBS instances. BleepingComputer counts 46 Oracle bugs added to CISAâs exploited list since November 2021, 13 of them used in ransomware.
đ KEV entry: CVE-2026-35273 (GCVE, Shadowserver honeypot data) https://db.gcve.eu/known-exploited-vulnerabilities-catalog/29e1d8ee-0f6a-4921-8082-ea90842b66d8
The June PeopleTools flaw, the one ShinyHunters exploited as a zero-day and then again with a WAF bypass in September, still shows up in Shadowserverâs honeypot feed. Last seen: October 28. CISA added it to KEV on June 12 with a June 15 due date for federal agencies.
My read: This is an EBS flaw, so why is it in a PeopleSoft digest? Because the timeline applies to you. One week from fix to scanning is the planning number Iâd use for any unauthenticated, internet-reachable row in a CPU. And Juneâs flaw keeps getting tested months later, so âweâll get to it next quarterâ is still being tried against real hosts. Thursdayâs Q&A is about what that means for your patch SLA.
đ¸ PeopleSoft Expenses Gets a Delete Control
đ Preview of Upcoming PeopleSoft Expenses Enhancements (Oracle / Joe Willever) https://blogs.oracle.com/peoplesoft/preview-of-upcoming-peoplesoft-expenses-enhancements
October 29, planned for an upcoming release. Multi-stop mileage on one expense line, standard routes with locked mileage, a Notify Employee button for proxies, and a new installation option for who can delete Wallet entries loaded from corporate card feeds: All Users (the default, current behavior), Expenses Admin, or No Delete.
My read: The mileage changes will get the attention. The Wallet option is the one your auditors will ask about. If card charges can disappear before they land on an expense report, thatâs a control gap, and the default keeps the old behavior. Put the setting on the agenda for whoever owns Expenses security.
đ¤ Agents in ERP
This week: the vendors agreed that an agent needs its own identity and its own limits.
At Oracle AI World on October 26, Oracle said its new Fusion Companion works âwithin established identity, permissions, policies, and approval controls.â The same day, Oracleâs Deep Trust AI Architecture announcement made a sharper point: when access rules live only in application code, agents that reach data directly, âsuch as through an MCP server or natural language to SQL,â may bypass them. IBM made Agent Identity generally available the same day, and on October 27 it described pairing it with HashiCorp Vault for least-privilege credentials and âreal-time revocation.â
None of that is PeopleSoft. The PeopleTools 8.63 MCP server connects AI tools to PeopleSoft APIs, though, so the same question applies: when an agent calls PeopleSoft, does it run as a named user with a role you can audit, or as a shared integration ID? Wednesday on LinkedIn, the Agents in ERP post takes that question apart.
đ https://www.oracle.com/news/announcement/ai-world-oracle-announces-deep-trust-ai-architecture-to-help-enterprises-innovate-with-confidence-2026-10-26/ đ https://newsroom.ibm.com/2026-10-27-ibm-introduces-identity-and-control-for-ai-agents,-securing-frontier-intelligence-for-the-enterprise
đŹ Aaronâs Take
Octoberâs patches are out, packaged and being scanned. This week is about closing the gap.
Pick your Middleware DPK path in writing. Oracleâs package or the Builder, with the date youâll apply it to production and who tests it first.
Apply the Cloud Manager Image 22 PRP if Cloud Manager runs your environments. Itâs what enables the Middleware DPK there.
Check exposure while you wait. Anything from the October rows that is unauthenticated and reachable from the internet should already have a patch date. And if Juneâs PSEMHUB fix isnât confirmed on every PIA host, that comes first.
Ask the agent identity question before anyone turns on the 8.63 MCP server. Which user ID it runs as, which roles that ID holds, and who can disable it.
Thursdayâs Q&A: Attackers probed an October CPU flaw within a week. How fast do we actually need to patch PeopleSoft now? Got a PeopleSoft question of your own? Reply to this email.
đ Join the Community
Subscribe to PeopleSoft Cloud at peoplesoftcloud.com for the Monday Digest and the Thursday Q&A. No vendor spin, just what changed and what to do about it.
â Monday: what moved in the PeopleSoft, Oracle and ERP world, with a read on why it matters â Thursday: one real PeopleSoft question, answered straight â Written by a practitioner who still has to make the change window