Getting the Band Ready Before the Tour: PeopleTools 8.63

Now Playing: “Roll with the Changes” — REO Speedwagon

The audience may only see opening night, but the band and crew started preparing weeks, or even months, before the first song.

The equipment gets tested. The stage gets built. Everyone learns the new setlist. And when opening night finally arrives, the goal is to be ready enough to roll with the changes.

That seems like a pretty good description of what has been happening in the PeopleSoft world lately.

On October 20, 2026, Oracle officially released PeopleTools 8.63 for on-premises installation, beginning with version 8.63.04.

For those of us who have been watching the announcements, reviewing certifications, preparing environments, and wondering when the release would arrive, it was exciting news.

But there was one little complication.

October 20 was also Oracle’s quarterly Critical Patch Update.

So while many PeopleSoft Administrators were excited to finally get their hands on 8.63, the more immediate reaction was probably something like:

“That’s great! Now let me finish patching these servers first.”

Welcome to life as a PeopleSoft Administrator.

We Knew the Tour Was Coming

I’ve been looking forward to PeopleTools 8.63 for quite some time.

Oracle had already made the release available on Oracle Cloud Infrastructure, and announcements about its new capabilities had been circulating for months.

There was plenty to look forward to, including new SAML 2.0 authentication capabilities, search improvements, and AI-related development tools.

Meanwhile, other changes were starting to take shape.

Oracle announced the transition from the familiar Infrastructure DPK to the new Middleware DPK. Enablement patches appeared for PeopleTools 8.61 and 8.62. New documentation and training became available, and October was identified as the transition point.

It certainly started to feel like everything was coming together for the October CPU cycle.

And that’s exactly when PeopleTools 8.63 arrived for on-premises customers.

Looking back, the timing wasn’t really that unusual. PeopleTools 8.62 became available on Oracle Cloud Infrastructure in April 2025, followed by 8.63 in July 2026, about 15 months later. The on-premises releases followed a similar interval.

But when you’re waiting for new functionality that could solve real problems in your environments, even 15 months can feel a lot longer.

One thing that made me smile was the initial on-premises version number: 8.63.04.

Years ago, especially during the PeopleTools 8.4x and 8.5x releases, we used to joke about waiting until the .04 patch level before adopting a new major release.

Now we’re here, with 8.63 becoming available on-premises at .04.

I still remember working with PeopleTools 8.20 and moving into the 8.4x generation. These days, we’re talking about smaller increments, but each upgrade still involves plenty of work.

Security Patching Doesn’t Wait for Opening Night

The October CPU brought another substantial collection of security fixes.

According to Oracle’s October 2026 Critical Patch Update, the release includes 1,295 new security patches across its product families.

For PeopleSoft alone, Oracle reported 109 new security patches, with 41 vulnerabilities potentially exploitable remotely without authentication.

Those numbers are difficult to ignore.

In the environments I help manage, October meant updating Java, WebLogic, Tuxedo, the associated OPatch utilities, and Oracle Database Client software. I recently completed that work on one of our Linux servers and confirmed that everything was running properly again.

And then, of course, there were more servers waiting.

Why include Oracle Database Client and OPatch?

Because securing a PeopleSoft environment involves more than updating WebLogic or Java. The database client libraries and the patching utilities have their own maintenance requirements. Each release needs review to determine which components need attention.

This October’s CPU even identified two vulnerabilities affecting Oracle Client-only installations, including an OpenSSL issue rated CVSS 9.8, reinforcing why these components deserve attention alongside the rest of the PeopleSoft stack.

Our team was so focused on October patching that we even canceled one of our regular technical meetings. Everyone had work to finish.

From conversations with other administrators, it was clear that we weren’t alone.

And just when we thought we had our October patching plans figured out, Oracle released an additional Java Security Alert, CVE-2026-91403, on October 21.

Another critical vulnerability, another reason to review the environment and determine what additional remediation may be needed.

The push to shorten the time between Oracle releasing security updates and organizations applying them has become an increasingly important part of PeopleSoft administration.

For some teams, that means patching Non-Production almost immediately after release and moving to Production within the same week, assuming testing and approvals are completed.

And there is a very practical reason for prioritizing that work.

An exciting new PeopleTools release does not eliminate the responsibility to secure the environment you’re running today.

That is why I’m not rushing directly into a Production upgrade to 8.63.

First, finish the October CPU and address any additional security advisories. Make sure the existing environments are healthy. Then start preparing for the next generation.

The Stage Has Changed

One of the first things I review with any major PeopleTools release is the certification information.

What operating systems are supported? What database versions? What about WebLogic, Java, and Tuxedo?

PeopleTools 8.63 introduces some important platform considerations.

On Linux, the certification information identifies Oracle Linux 9 and Red Hat Enterprise Linux 9. It also lists Windows Server 2022 and 2025, along with SQL Server 2022 and 2025.

And yes, Oracle Database 19c is still part of the certification picture. That familiar major version number has been around for quite some time, even as its patches and release updates continue to evolve.

For organizations running older operating systems or database versions, a PeopleTools upgrade may also require an operating system or database upgrade.

The middleware component families may look familiar, but that doesn’t mean every existing environment is ready for the new release.

This is one reason I’ve been preparing an Oracle Linux 9 environment in advance.

I’d much rather discover a platform or configuration problem in a lab than encounter it halfway through a planned PeopleTools upgrade.

And certifications are only part of the story.

PeopleSoft environments rarely exist in isolation. Authentication systems, integrations, reporting tools, database connections, Process Schedulers, and other dependencies must keep working.

I’ve recently been involved with older PeopleSoft environments where integrating newer authentication requirements has required additional configuration and troubleshooting.

Those environments may still serve an important business purpose, even though they run older PeopleTools releases.

In one case, work that initially appeared to be about authentication uncovered another dependency: a process needed to run in an environment that hadn’t previously required a Process Scheduler.

It’s a good reminder that one change can lead to another.

The new SAML 2.0 capabilities in PeopleTools 8.63 are particularly interesting for organizations working with modern identity providers and single sign-on.

But implementing them still requires planning, configuration, and testing.

A new PeopleTools feature may simplify a problem, but it doesn’t automatically remove all the dependencies around it.

New Equipment: The Middleware DPK

Another big change this fall is Oracle’s transition from the Infrastructure DPK to the Middleware DPK.

The name change is only part of the story.

Oracle now provides a Middleware DPK Builder that can retrieve the applicable middleware security patches and assemble a package when administrators need it.

For PeopleTools 8.61 and 8.62, Oracle released enablement patches ahead of the October CPU. PeopleTools 8.63 includes the functionality directly.

I’ve spent time installing, configuring, and testing this new process, and there is one capability I particularly appreciate.

The Builder can retrieve updates for Java, WebLogic, Tuxedo, Oracle Database Client, and associated OPatch components.

Think about the usual routine.

A new security release arrives. You visit My Oracle Support, identify the latest Java patch, locate the correct WebLogic Stack Patch Bundle, look for Tuxedo updates, check OPatch requirements, and verify which Oracle Client patches apply.

Then you have to make sure you’ve downloaded the correct versions for the environment.

With the Middleware DPK Builder, much of that package identification and retrieval process can be handled together.

That’s a significant improvement.

I also learned that there’s an important distinction between downloading a Middleware DPK already packaged by Oracle and using the Builder to create a package yourself.

During my October testing, some Oracle-hosted Middleware DPK packages I examined still had component versions from September listed in their manifests.

That reinforced the need to inspect the contents rather than assume a downloaded package includes every update released that day.

The Builder offers the flexibility to retrieve newer available patches without waiting for a prebuilt package.

Of course, the new process also brings some adjustments.

The files and formats aren’t necessarily the same ones I previously downloaded individually from My Oracle Support. I’ve developed scripts around those existing files, and I’m not particularly anxious to rewrite every script in the middle of a busy CPU cycle.

For now, I’m evaluating where the new process fits into my existing automation.

I can continue using familiar installation methods while learning how to take advantage of the Builder.

That is part of rolling with the changes, too.

Learning a New Way to Build the Environment

Another change I’ve been exploring is containerized PeopleSoft Update Images.

For years, I’ve been comfortable deploying traditional Native OS PUM environments.

I know the process, understand the configuration, and have my routines for installing and configuring supporting components such as OpenSearch.

It’s familiar, predictable, and works well.

But Oracle is also delivering PUM images as containers, with the database, midtier, and search components packaged for container-based deployment.

So with Campus Solutions PUM 39, I spent time learning that process.

That meant working through the Podman configuration, container definitions, deployment files, networking, storage, and the various components needed to bring the environment together.

It also meant troubleshooting, documenting the setup, and making sure I understood what I had built.

What I originally thought might be a relatively straightforward learning exercise turned into several weeks of exploration.

At times, I wondered whether I should have simply installed the Native OS version and moved on.

But that would have missed the point.

I already knew how to deploy the Native OS image.

The value was in learning something I didn’t already know.

The same has been true with Middleware DPK.

Routine monthly security patching doesn’t necessarily wear me down the way it once might have. With established processes and automation, the work has become more familiar.

Learning an entirely new deployment method, however, requires a different investment.

You read the documentation. You build the environment. Something doesn’t work. You troubleshoot it, find the answer, and document what you learned.

Then you try to make the process repeatable.

I don’t believe every PeopleSoft Administrator has the opportunity to spend weeks exploring every new technology as soon as it becomes available.

There is simply too much day-to-day work to accomplish.

But I do believe there’s value in deliberately making time to learn.

That preparation can pay off later when a customer is ready for an upgrade or when a new deployment approach becomes necessary.

And the knowledge becomes even more valuable when you can share what you’ve learned with the rest of your team.

Rehearsal Comes Before Opening Night

So what am I planning to do first with PeopleTools 8.63?

I want to upgrade something.

Actually, I want to upgrade a couple of things.

My first goal is to take a lab environment running PeopleTools 8.61 and work through the upgrade to 8.63.

Then I’d like to repeat the exercise with an 8.62 environment.

A PUM DEMO database may provide a convenient starting point.

I’m interested in seeing how the upgrade process behaves, what configuration differences appear, and whether anything unexpected comes up.

After that, I want to sign in, explore the new functionality, and begin understanding which features may be useful for the environments I support.

The SAML capabilities are high on my list.

So are the changes to the supporting tools and deployment processes.

There are plenty of Oracle release notes, videos, documentation, and feature summaries available, and those are valuable resources.

But installing the software yourself and seeing how it behaves still feels different.

That’s how I learn best.

And it’s how I develop confidence before recommending a new release for a customer environment.

A band doesn’t perform an entirely new setlist without rehearsal.

The same principle applies to a PeopleTools upgrade.

You prepare the environment, work through the upgrade, test the applications, validate the integrations, document the results, and make sure there is a recovery plan.

Only then does Production become part of the conversation.

Being ready for a new PeopleTools release and being ready to upgrade Production are two very different things.

Ready to Roll with the Changes

PeopleTools 8.63 has finally arrived for on-premises customers, and I’m genuinely excited about it.

Not just because there are new features to explore, but because it represents another step forward for a platform I’ve been working with for more than two decades.

The technology keeps changing. The delivery methods evolve. Security requirements grow. The tools we use to build and maintain environments keep improving.

And occasionally, just when you think you’ve mastered a process, Oracle introduces a new way to do it.

That’s not necessarily a bad thing.

It gives us another opportunity to learn, improve our processes, and prepare for what’s coming next.

For me, the past several weeks have been about building that foundation.

Oracle Linux 9. Containerized PUM images. Middleware DPK. New certifications. October CPU patching.

And now, PeopleTools 8.63.

A new PeopleTools release doesn’t begin with the upgrade. It begins with everything you do before the upgrade.

The stage is being set. The equipment has been checked. The crew is getting ready.

And when it’s finally time to take PeopleTools 8.63 into Production, I want to know we’ve done everything we can to be ready.

After all, if you’re going on tour, you might as well be ready to roll with the changes.

Now, let’s get back to rehearsal.

Mike’s October will sound familiar to a lot of PeopleSoft teams: a quarterly CPU, an out-of-band Java Security Alert, and a major PeopleTools release, all in the same week. NRC’s Enterprise Solutions Group built Rapid Patch Response so security patching keeps moving while your team prepares for what’s next, with ongoing, coordinated patch management across PeopleSoft, WebLogic, Oracle, and Linux.

— Mike Engel

We invite you to connect with Mike Engel via email or LinkedIn.