UpTrajectory Review
Oracle is shifting to a monthly patching schedule for its software, including ERP and database systems, in response to the rapid emergence of AI-driven vulnerabilities. This move aligns with practices from other major vendors like Microsoft and SAP, but Oracle's schedule is distinct, with patches set to be released on the third Tuesday of each month, starting in May. This change aims to provide quicker fixes for critical vulnerabilities, allowing businesses to address urgent security issues without delay.
For small business owners using Oracle's software, this new patching frequency is significant. It means more timely updates to protect against emerging threats, particularly as AI continues to evolve and potentially expose new vulnerabilities. However, operators should remain vigilant about the implications of AI in cybersecurity, as the landscape is rapidly changing. While Oracle's proactive approach is commendable, businesses must also ensure they have the resources to implement these updates effectively and monitor their systems for any new vulnerabilities.
Takeaway: Stay proactive about implementing Oracle's monthly patches to safeguard your business against emerging AI-driven vulnerabilities.
From the original item — InfoWorld:
Oracle plans to issue security patches for its ERP, database, and other software on a monthly cycle, rather than quarterly, to respond to the increased pace of AI-enabled software vulnerability discovery.
Other software vendors, notably Microsoft, SAP, and Adobe, already release patches on a monthly beat, always on the second Tuesday of each month.
Oracle, though, is taking an off-beat approach: It will release the first of its monthly Critical Security Patch Updates (CSPUs) on May 28, the fourth Thursday, and after that, it will release its patches on the third Tuesday of each month — a week after the other vendors — with the next batches arriving on June 16, July 21, and August 18, it said earlier this week.
The new CSPUs “provide targeted fixes for critical vulnerabilities in a smaller, more focused format, allowing customers to address high-priority issues without waiting for the next quarterly release,” Oracle said.
It will issue a cumulative Critical Patch Update each quarter, so on the same schedule as before. The first one this year came in January.
Oracle initially announced the switch to a monthly patching schedule last week, but did not provide the dates.
The new patching rhythm will primarily interest customers running Oracle applications on premises or in their own or third-party hosting environments. For customers using the software in an Oracle-managed cloud, Oracle applies the patches automatically automatically.
Oracle is using artificial intelligence to identify and fix the vulnerabilities faster than before. It said it has access to OpenAI’s latest models through that company’s Trusted Access for Cyber program, and to Anthropic’s Claude Mythos Preview.
Mythos has contributed greatly to concerns that AI will uncover thousands of zero-day flaws in software, but as of mid-April, only one vulnerability report had been tied directly to it.
This article first appeared on CSO.