Oracle will follow SAP, Microsoft and other software vendors in issuing security patches monthly — but a week later than everyone else.

CSO Online offers insights into cybersecurity, risk management, and IT leadership, providing articles, reports, and expert analysis to help security professionals navigate the evolving threat landscape and protect their organizations from cyber attacks. By exploring CSO Online's curated content, CISOs, security managers, and IT executives can learn about threat intelligence, security frameworks, and incident response strategies for building resilient cybersecurity programs. Whether you're defending against ransomware, phishing attacks, or insider threats, CSO Online offers resources to strengthen your security posture and safeguard your digital assets.

CSO Online

Oracle is shifting from quarterly to monthly security patch releases, introducing Critical Security Patch Updates (CSPUs) starting May 28, 2026. The change is driven by the accelerating pace of AI-enabled vulnerability discovery. Unlike Microsoft, SAP, and Adobe which patch on the second Tuesday of each month, Oracle will patch on the third Tuesday — a week later. Oracle is leveraging OpenAI and Anthropic's Claude Mythos Preview to identify and fix vulnerabilities faster. Quarterly cumulative patches will continue alongside the new monthly cadence. On-premises and third-party hosted customers will need to apply patches manually, while Oracle-managed cloud customers receive automatic updates.

Oracle will patch more often to counter AI cybersecurity threat