Oracle has launched a new monthly patching cadence with its first Critical Security Patch Update (CSPU), addressing 35 CVEs across multiple product lines, 11 of which carry critical severity ratings. The shift from quarterly to monthly patch cycles reflects Oracle’s response to the reality that traditional 90-day windows create unacceptable exposure when vulnerabilities are weaponized within days of disclosure. For enterprises running Oracle infrastructure, this change demands a corresponding adjustment to internal patch management workflows and risk acceptance processes.