The October 2012 Patch Set Update (PSU) and Critical Patch Update (CPU) for Oracle products were released yesterday, 16-Oct-2012. The Availability Document, which lists the patches to get for different products, is My Oracle Support note 1477727.1.
A couple of interesting things this quarter. Critical Patch Updates are being renamed Security Patch Updates, or SPUs. The release schedule is the same, as is the content. MOS note 1430923.1, "New Patch Nomenclature for Oracle Products", describes the change.
The PSU/CPU also includes patches for the SHA-1 hashing algorithm to address two vulnerabilities. There are special notes about how to apply patches this quarter because of these. Always read the README, and don't assume that you know how to do this quarter's patch just because you've done them before.
The PSUs for 126.96.36.199 (starting with 188.8.131.52.7) and 184.108.40.206 (starting with 220.127.116.11.2) now use the new Composite Patch format, which makes overlay patches to previous updates less troublesome. MOS note 1376691.1 describes the new format and its advantages.
The January 2013 PSU/CPU will be the final ones for Database 18.104.22.168, Oracle Fusion Middleware 22.214.171.124.0, and Oracle Fusion Middleware 126.96.36.199.0 for Portal, Forms, Reports, and Discoverer (PFRD).