# Oracle says AI helps it find about 3,000 flaws a quarter

More flaws found faster means more patches, more often, for every organisation that runs Oracle software.

The Assurance Desk, news. Published 27 October 2026.

Oracle now uses AI to find flaws in its own products, an executive told reporters before Oracle AI World on 26 October 2026. Computer Weekly reports the rate is around 3,000 every quarter ([computerweekly.com, AI World: AI vulnerability surge brings change for Oracle’s cyber practice, Computer Weekly](https://www.computerweekly.com/news/366652684/AI-World-AI-vulnerability-surge-brings-change-for-Oracles-cyber-practice) and [oracle.com, Oracle Announces Deep Trust AI Architecture to Help Enterprises Innovate with Confidence](https://www.oracle.com/news/announcement/ai-world-oracle-announces-deep-trust-ai-architecture-to-help-enterprises-innovate-with-confidence-2026-10-26/), checked 27 October 2026).

## AI models find, check and fix the flaws

Gary Miller, Oracle's executive vice-president of customer success, said Oracle joined the Glasswing AI security programme earlier this year. Since then it has used AI to find flaws in its cloud and on-premise products ([computerweekly.com, AI World: AI vulnerability surge brings change for Oracle’s cyber practice, Computer Weekly](https://www.computerweekly.com/news/366652684/AI-World-AI-vulnerability-surge-brings-change-for-Oracles-cyber-practice), checked 27 October 2026).

Miller said one AI model finds a vulnerability, another checks that it is real, and other models code and test the fix. Not every flaw comes from AI. The total includes some that people found and the models missed ([computerweekly.com, AI World: AI vulnerability surge brings change for Oracle’s cyber practice, Computer Weekly](https://www.computerweekly.com/news/366652684/AI-World-AI-vulnerability-surge-brings-change-for-Oracles-cyber-practice), checked 27 October 2026).

Miller said attackers also use AI models and work together, so they find flaws quickly. Miller expects more one-off patches that everybody has to put out, like PHP's ([computerweekly.com, AI World: AI vulnerability surge brings change for Oracle’s cyber practice, Computer Weekly](https://www.computerweekly.com/news/366652684/AI-World-AI-vulnerability-surge-brings-change-for-Oracles-cyber-practice), checked 27 October 2026).

## More patches arrive, more often

Miller said Oracle released about eight real-time patches in the past seven days alone ([computerweekly.com, AI World: AI vulnerability surge brings change for Oracle’s cyber practice, Computer Weekly](https://www.computerweekly.com/news/366652684/AI-World-AI-vulnerability-surge-brings-change-for-Oracles-cyber-practice), checked 27 October 2026).

Oracle's October 2026 Critical Patch Update came out on 20 October 2026, with 1,295 new security patches. Its list of urgent Security Alerts shows three alerts last updated on 21, 24 and 26 October 2026 ([oracle.com, Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins](https://www.oracle.com/security-alerts/) and [oracle.com, Oracle Critical Patch Update Advisory, October 2026](https://www.oracle.com/security-alerts/cpuoct2026.html), checked 27 October 2026).

Since 28 May 2026, Oracle has also released smaller Critical Security Patch Updates between its quarterly updates. The next are due on 17 November 2026 and 15 December 2026 ([oracle.com, Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins](https://www.oracle.com/security-alerts/), checked 27 October 2026).

**Oracle's recent and next patch dates**

- 20 October 2026, Global: October Critical Patch Update, with 1,295 new security patches.
- 21, 24 and 26 October 2026, Global: Three Security Alerts last updated.
- 17 November 2026, Global: Next Critical Security Patch Update due.
- 15 December 2026, Global: The Critical Security Patch Update after that.
- 19 January 2027, Global: Next quarterly Critical Patch Update due.

Dates from Oracle's security alerts page and its October 2026 advisory. Security Alert dates are the date each alert was last updated.

Source: oracle.com, Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins, https://www.oracle.com/security-alerts/ (checked 27 October 2026); oracle.com, Oracle Critical Patch Update Advisory, October 2026, https://www.oracle.com/security-alerts/cpuoct2026.html (checked 27 October 2026)

## Customers get a list of what to patch, and free tools

Miller said Oracle ran OpenAI's Codex against its whole installed base. Within two days, every customer had a list of its software, patch versions and the fixes to apply. In many cases, customers did not know everything they had ([computerweekly.com, AI World: AI vulnerability surge brings change for Oracle’s cyber practice, Computer Weekly](https://www.computerweekly.com/news/366652684/AI-World-AI-vulnerability-surge-brings-change-for-Oracles-cyber-practice), checked 27 October 2026).

Oracle says it is providing security and patching tools free or highly discounted until the end of February 2027. Its Database Lifecycle Management Pack and Exadata Management Pack are free for upgrading and patching until 28 February 2027 ([oracle.com, Free and discounted security and patching tools](https://www.oracle.com/database/free/tools/) and [oracle.com, Oracle Announces Deep Trust AI Architecture to Help Enterprises Innovate with Confidence](https://www.oracle.com/news/announcement/ai-world-oracle-announces-deep-trust-ai-architecture-to-help-enterprises-innovate-with-confidence-2026-10-26/), checked 27 October 2026).

Computer Weekly reports that Oracle will also help customers who want extra safeguards to build digital twins of their Oracle environments. They can then test patches before production ([computerweekly.com, AI World: AI vulnerability surge brings change for Oracle’s cyber practice, Computer Weekly](https://www.computerweekly.com/news/366652684/AI-World-AI-vulnerability-surge-brings-change-for-Oracles-cyber-practice), checked 27 October 2026).

## What it means for organisations that run Oracle software

Oracle says some attacks succeed because customers had not applied available patches. It strongly recommends staying on supported versions and patching without delay ([oracle.com, Oracle Critical Patch Update Advisory, October 2026](https://www.oracle.com/security-alerts/cpuoct2026.html), checked 27 October 2026).

In the UK, the NCSC's guidance starts with a policy to update by default, as soon as possible and ideally automatically. It says organisations should know what systems and software they have. A decision not to update is a senior-level risk decision ([NCSC, Vulnerability management, Guidance](https://www.ncsc.gov.uk/collection/vulnerability-management/guidance), checked 27 October 2026).

Miller said the change will take time, and that defenders have to work together as a community against attackers ([computerweekly.com, AI World: AI vulnerability surge brings change for Oracle’s cyber practice, Computer Weekly](https://www.computerweekly.com/news/366652684/AI-World-AI-vulnerability-surge-brings-change-for-Oracles-cyber-practice), checked 27 October 2026).

## Read next

- [Cyber security: the section](https://theassurancedesk.com/cyber-security)
- [Who patches your website: you, your web agency or your host?](https://theassurancedesk.com/guides/who-patches-your-website)
- [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check)
- [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident)

## Sources

- computerweekly.com, AI World: AI vulnerability surge brings change for Oracle’s cyber practice, Computer Weekly: https://www.computerweekly.com/news/366652684/AI-World-AI-vulnerability-surge-brings-change-for-Oracles-cyber-practice (checked 27 October 2026)
- oracle.com, Oracle Announces Deep Trust AI Architecture to Help Enterprises Innovate with Confidence: https://www.oracle.com/news/announcement/ai-world-oracle-announces-deep-trust-ai-architecture-to-help-enterprises-innovate-with-confidence-2026-10-26/ (checked 27 October 2026)
- oracle.com, Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins: https://www.oracle.com/security-alerts/ (checked 27 October 2026)
- oracle.com, Oracle Critical Patch Update Advisory, October 2026: https://www.oracle.com/security-alerts/cpuoct2026.html (checked 27 October 2026)
- oracle.com, Free and discounted security and patching tools: https://www.oracle.com/database/free/tools/ (checked 27 October 2026)
- NCSC, Vulnerability management, Guidance: https://www.ncsc.gov.uk/collection/vulnerability-management/guidance (checked 27 October 2026)

This is an independent editorial guide, not legal advice.

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.