We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Oracle says AI helps it find about 3,000 flaws a quarter

More flaws found faster means more patches, more often, for every organisation that runs Oracle software.

Oracle now uses AI to find flaws in its own products, an executive told reporters before Oracle AI World on 26 October 2026. Computer Weekly reports the rate is around 3,000 every quarter.

AI models find, check and fix the flaws

Gary Miller, Oracle's executive vice-president of customer success, said Oracle joined the Glasswing AI security programme earlier this year. Since then it has used AI to find flaws in its cloud and on-premise products.

Miller said one AI model finds a vulnerability, another checks that it is real, and other models code and test the fix. Not every flaw comes from AI. The total includes some that people found and the models missed.

Miller said attackers also use AI models and work together, so they find flaws quickly. Miller expects more one-off patches that everybody has to put out, like PHP's.

More patches arrive, more often

Miller said Oracle released about eight real-time patches in the past seven days alone.

Oracle's October 2026 Critical Patch Update came out on 20 October 2026, with 1,295 new security patches. Its list of urgent Security Alerts shows three alerts last updated on 21, 24 and 26 October 2026.

Since 28 May 2026, Oracle has also released smaller Critical Security Patch Updates between its quarterly updates. The next are due on 17 November 2026 and 15 December 2026.

Oracle's recent and next patch dates

  1. 20 October 2026Global October Critical Patch Update, with 1,295 new security patches.
  2. 21, 24 and 26 October 2026Global Three Security Alerts last updated.
  3. 17 November 2026Global Next Critical Security Patch Update due.
  4. 15 December 2026Global The Critical Security Patch Update after that.
  5. 19 January 2027Global Next quarterly Critical Patch Update due.
Dates from Oracle's security alerts page and its October 2026 advisory. Security Alert dates are the date each alert was last updated.

Customers get a list of what to patch, and free tools

Miller said Oracle ran OpenAI's Codex against its whole installed base. Within two days, every customer had a list of its software, patch versions and the fixes to apply. In many cases, customers did not know everything they had.

Oracle says it is providing security and patching tools free or highly discounted until the end of February 2027. Its Database Lifecycle Management Pack and Exadata Management Pack are free for upgrading and patching until 28 February 2027.

Computer Weekly reports that Oracle will also help customers who want extra safeguards to build digital twins of their Oracle environments. They can then test patches before production.

What it means for organisations that run Oracle software

Oracle says some attacks succeed because customers had not applied available patches. It strongly recommends staying on supported versions and patching without delay.

In the UK, the NCSC's guidance starts with a policy to update by default, as soon as possible and ideally automatically. It says organisations should know what systems and software they have. A decision not to update is a senior-level risk decision.

Miller said the change will take time, and that defenders have to work together as a community against attackers.

Read next

Sources

  1. oracle.com, Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins, checked 27 October 2026
  2. oracle.com, Oracle Critical Patch Update Advisory, October 2026, checked 27 October 2026
  3. computerweekly.com, AI World: AI vulnerability surge brings change for Oracle’s cyber practice, Computer Weekly, checked 27 October 2026
  4. oracle.com, Oracle Announces Deep Trust AI Architecture to Help Enterprises Innovate with Confidence, checked 27 October 2026
  5. oracle.com, Free and discounted security and patching tools, checked 27 October 2026
  6. NCSC, Vulnerability management, Guidance, checked 27 October 2026

This is an independent editorial guide, not legal advice.