Oracle Speeds Up Security Updates as AI Accelerates Vulnerability Discovery

Generative AI is changing how quickly software vulnerabilities are discovered and patched. Oracle previously issued Critical Patch Updates (CPUs) mainly on a quarterly basis, potentially leaving customers with self-managed systems waiting until the next quarter for fixes. Oracle said it has used Anthropic's Claude and OpenAI models to identify weaknesses in its products, while the new monthly update cycle will shorten exposure to critical vulnerabilities.

Oracle announced a new monthly Critical Security Patch Update (CSPU) on April 29, 2026, and issued the first update on May 28. It included 35 patches addressing 77 vulnerabilities across five products, including 42 weaknesses resolved through related fixes. Another monthly update followed on June 16, with future releases generally scheduled for the third Tuesday of each month. The quarterly CPU cycle will continue and incorporate previously issued fixes.