Recently, several major supermarket chains in and around Belgium and even in Sweden were hacked. The damage was immense; from fridges that turned into heaters instead of cooling—destroying the food inside—to critical applications that had to be shut down for days.

Needless to say, this costs millions upon millions in lost revenue and profit. In the case of the incident affecting Delhaize and Albert Heijn across Belgium and the Netherlands, the estimated loss in revenue ranged between 200 and 250 million euros.

A definitive playbook detailing exactly what happened is not yet available, as the criminal investigation is still ongoing. I certainly wouldn’t want to be the IT manager who has to admit it was caused by default passwords or unpatched systems.

Experts agree that AI plays a massive role in how modern threat actors operate. It also doesn’t help that known security exploits are readily available on the dark web.

As a side note: I am not implying that Oracle systems, databases, or applications were involved in the incidents mentioned above; I use both examples simply to emphasise the mindblowing business costs of security breaches.

My focus here is specifically on Oracle Database, Grid Infrastructure, and Exadata patching. Having previously served as an Oracle Product Manager responsible for Fleet Patching and Provisioning (FPP), Exadata Fleet Update, and Oracle Update Advisor, this is very much my home turf. I will give an overview of the possibilities without going in depth, if you like more in depth posts feel free to reach out.

In June 2026, Anthropic released Mythos to a restricted audience of select companies (including Oracle). It triggered an unprecedented surge in logged CVEs—according to AlphaSignal, a 3.5-fold increase in reported vulnerabilities.

I used Rodrigo Jorge’s excellent oradiff tool to analyse the trend for Oracle Database (excluding OJVM).
In July 2026 there were more than twice the number of regular Security bugs fixed. If you compare April 2026 to October 2026 it is even more spectacular 4.28 times more… it is even much more if you search on “Fix for Bug” as Mike Dietrich pointed out.

“But Philippe, this is only for the Oracle Database, not for other products!” Think again.


II reviewed all Critical Patch Update (CPU) advisory announcements since January 2025 and tracked instances of the phrase “This Critical Patch Update contains”. To be completely scientifically rigorous, one should cross-reference all supported versions listed in the documentation, but even at high level, the trajectory is unmistakable. Since then, Mythos has reached GA and other AI labs have launched powerful models specialised in vulnerability discovery.


Just like the A-Team back in the ’80s, it all starts with a plan (dixit Hannibal Smith). 🙂

In the meantime Mythos went GA and other AI companies released strong new models capable of finding security issues.

A few years ago, although never best practice, you could reasonably get away with updating your Oracle Database estate just twice a year. Many Exadata customers did precisely that due to the friction of application testing and potential downtime for non-RAC-aware applications (yes, unfortunately, they still exist).

Those days are well and truly over. Applying security fixes on a regular basis—likely monthly—is now critical. You simply cannot afford prolonged exposure to publicised CVEs.

Fortunately, Oracle provides Monthly Recommended Patches (MRPs) for 19c and 23ai/26ai Oracle Database and Grid Infrastructure on Linux. An MRP is cumulative, includes regression fixes, and addresses CVEs that cannot wait until the next Release Update (RU). Each RU receives a maximum of six MRPs.

As Mike Dietrich frequently notes and I strongly agree, staying on release n−1 is no longer a viable strategy.

The recommended approach going forward:

  1. Adopt the latest RU as soon as possible and begin validation testing.
  2. When ready to deploy into production (say, a month later), pull in the latest MRP and run focused smoke tests.

Because an MRP contains a relatively small, targeted set of fixes, operational risk remains low while dramatically reducing your attack surface.

Reference: Mike Dietrich’s analysis

What about Exadata?

Starting with Exadata 24.1, you can take advantage of Live Update. It uses Ksplice to apply OS/kernel updates online without rebooting the VM. However, because firmware and underlying hypervisor components still require a restart, an orchestrated rolling reboot every 3 to 6 months remains standard practice. You could potentially combine this with Live Migration of the VMs if all prerequisites are met.

Executing the Deployment

Once your patching cadence and strategy is established, you need to source binaries, roll out new Oracle Homes, and switch versions.

The only sustainable method—and one of my biggest hobbyhorses—is out-of-place patching. Far too many DBAs at conferences still rely on in-place patching. In short, out-of-place patching means deploying a clean target Oracle Home alongside your active one, then in a rolling fashion starting the Database instances from the new homes.

Building gold images used to be a labour-intensive manual chore. (I wrote about the mechanics back during my time as FPP Product Manager: FPP by Example Part 3).

You no longer need to perform those manual steps. Oracle Update Advisor can automatically retrieve the right gold image based on your installed one-offs, merge patches, update preferences, and desired security posture. I strongly recommend adopting (and running regularly) Oracle Update Advisor; it proactively alerts you when fixes for critical vulnerabilities, regressions, or new RUs are released.

Update Advisor integrates seamlessly with tools such as DBCA, AutoUpgrade, and FPP.

Scale Requires Automation

Once binary generation is streamlined, deploying hundreds or thousands of Oracle Homes across an enterprise estate quickly becomes if done by hand. Without robust automation, it is simply impossible.

Oracle has standard tooling available:

  1. On-premises : Fleet Patching and Provisioning (FPP) Included free of charge if you hold Oracle RAC licences (or via the Database Lifecycle Management Pack for single-instance). FPP delivers centralised, out-of-place, image-based patching and upgrades across databases, Grid Infrastructure, and Exadata compute nodes. Crucially, you don’t need to write or maintain any scripting. I know of one customer who patched 1,400 databases across two 2-hour maintenance windows over a single weekend. Note that for single RAC clusters you can also use Local mode, especially from version 26ai onwards. FPP version 26ai also brings full Data Guard patching orchestration, online patch support, support for the new RAC two stage rolling patches feature, and always you to add tags to filter targets and to schedule operations.
  2. Exadata/Exascale in OCI or partner Clouds : Exadata Fleet Update Instead of updating targets one by one, your systems are grouped into collections based on your business needs. You create and attach a maintenance cycle specifying the goal update/upgrade version and even schedule operations. The service executes across the collection automatically. It requires zero custom code, and can be driven via the OCI Console, OCI CLI, or REST APIs. It is completely cloud native and doesn’t need any other installation.

The Bottom Line

There are no longer any valid technical excuses for leaving an Oracle Database estate unpatched.

Patching, of course, is only one slice of the security onion. Security cannot be treated as an afterthought; it must be designed into every tier—application, infrastructure, operating system, and database. Inside the database, that begins with least privilege and role separation. All too often, the human element remains the most vulnerable vector, and modern automated social engineering is far more convincing than many realise.

If you are looking to modernise your Oracle patching lifecycle or architect an automated FPP / Fleet Update framework, I am available on a freelance consultancy basis. Feel free to connect or send me a message on LinkedIn.

On By phil

Leave a Reply

Related Post