Observed Signal · Jul 8, 2026 · Technical Release · Source: DEV Community · Impact: 4/5 · Sentiment: Positive
Oracle Patching Changes in 2026: RU, MRP, CSPU
This technical explainer clarifies Oracle Database patching terminology and the 2026 cadence changes. Oracle's recommended quarterly Release Update (RU) remains the primary, cumulative proactive bundle to install; Release Update Revisions (RUR) were deprecated and discontinued after January 2023 and should no longer be used. Monthly Recommended Patches (MRP) provide monthly cumulative top-ups between RUs for 19c on Linux x86‑64. Beginning May 28, 2026, Oracle introduced monthly Critical Security Patch Updates (CSPUs) delivered on the third Tuesday of each month to provide faster, security‑focused fixes; quarterly RUs roll up CSPUs. Applying an RU requires two stages — binary patching (OPatch / OPatchAuto, preferably out‑of‑place) then SQL application (datapatch) — and verification in DBA_REGISTRY_SQLPATCH. High‑availability architectures (RAC rolling, Data Guard standby‑first) let teams minimize user impact during patching.
Oracle's introduction of monthly CSPUs and clarification of the RU/MRP/RUR model materially changes database security and patching cadence for large enterprise estates, affecting operations, compliance and downtime planning across infrastructure teams.
Track Oracle Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Oracle introduced monthly Critical Security Patch Updates (CSPUs) starting May 28, 2026, delivered on the third Tuesday of each month.
- Release Update Revisions (RUR) were deprecated and discontinued after January 2023; the RUR track no longer advances (third version digit sits at zero).
- Release Updates (RUs) are the recommended, cumulative quarterly proactive bundles (security + regression + optimizer/functional fixes), shipped on the third Tuesday of January, April, July and October.
- Monthly Recommended Patches (MRP) replaced RUR for providing monthly cumulative recommended patches between RUs (available for 19c on Linux x86‑64) and began with RU 19.17 in October 2022.
- Applying an RU is a two‑stage process: OPatch (binary/out‑of‑place patching) followed by datapatch (SQL changes applied to the running database); datapatch results are recorded in DBA_REGISTRY_SQLPATCH and must show status = SUCCESS.
Connected Companies & Entities
1 Entity mapped“Oracle added a monthly security cadence on top of the quarterly one. Beginning May 28, 2026, Oracle added a monthly security release called ...”
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Puppetlabs April 2026 Module Releases
Puppetlabs published eight module releases in April 2026 focused on event-forwarding improvements and security/compliance updates. Notable coordinated changes include support for an orchestrator_plan event type across pe_event_forwarding and splunk_hec, new filtering and indexing options for Splunk HEC, and security fixes in the Comply and Comply Admin modules that update gorm.io to address CVE-2026-33815 and CVE-2026-33816. Other releases included cd4peadm 5.15.0 (CSRF protections, webhook and session timeout options, 20 CVEs addressed), lvm 4.0.1 (udev race-condition fix and AIX boolean formatting correction), peadm 3.37.0 (support for PE 2025.10.0), and sce_linux 2.6.1 (fstab parsing and rsyslog handling fixes).
AI and Patch Tuesday Reveal New Security Risks
A July 14 Patch Tuesday from Microsoft delivered a record volume of fixes (~570 CVEs), including two zero-days actively exploited before patches (CVE-2026-56155 and CVE-2026-56164). The article explains triage steps and stresses cross-checking CISA's KEV list. It also highlights emergent attack surfaces from agentic coding tools: Wiz's GhostApproval and the AI Now Institute's Friendly Fire demonstrate how coding agents can be tricked into writing to sensitive paths or executing injected repo code. Separately, China's NVD flagged multiple Anthropic Claude Code releases for suspicious telemetry; Anthropic says anti-distillation logic was removed in a later build. Finally, an NSA-led advisory (AA26-194A) warns that Russian-linked actors continue to exploit known, already-patched device CVEs and bad configurations, underscoring that rapid patching, least privilege, egress visibility, and secure configuration remain critical defenses.
Higher Rates Split Market; AI Stocks Have Advantage: Cramer
Jim Cramer says that rising borrowing costs are splitting the stock market into two camps: credit-sensitive sectors facing pressure and AI-related firms that remain largely insulated. He highlights strong demand for AI growth, citing SpaceX's potential $40 billion borrowing to buy Nvidia chips for data centers, which he expects to get attractive terms despite its BBB rating. In contrast, Skydance's bonds fell after its acquisition of Warner Bros. Discovery, reflecting challenges in traditional media. Cramer argues that AI data center stocks are less affected by Treasury yields because their future growth prospects are considered extremely bright.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.