Patch 28364007 incorrectly identified as Combo of OJVM Component 11.2.0.4.181016 DB PSU + DB SPU 11.
The above is actually in the README.html for the download p28689160_112040_Linux-x86-64.zip. I fully expected to see a readme for 28689160 which included both of the latest OJVM and PSU patches.
When I performed a simple search for 28364007, it came up as Patch 28364007 - Oracle Database Security Patch Update 11.2.0.4.181016 (CPUOct2018)
I believe the true COMBO patch needs to be updated. I realize it is a convenience combining of both OJVM and PSU patches, but needs to be fixed.