Attackers probe patched Oracle EBS bug; PeopleSoft zero-day is three flaws
ShinyHunters used CVE-2026-35273 for theft and extortion; ZDI says Oracle bundled three PeopleSoft bugs under one CVE.
82
Product
PeopleSoft
- Mentions · 7d2
- Mentions · 30d14
- All mentions23
- First seenSep 12, 2026
- Last mentioned4d ago
Timeline
23 articles · newest firstShinyHunters mass-exploits PeopleSoft SSRF-to-RCE bug CVE-2026-35273
A gateway request forgery can satisfy localhost trust checks and reach a file-write path to code execution.
84
Oracle October 2026 CPU patches 1,295 flaws across dozens of products
Tenable counts 1,209 unique CVEs, including 95 critical, and Oracle has not flagged them as exploited.
64
Oracle October 2026 CPU lists flaws across dozens of products
The October 20 notice names JD Edwards, MySQL, Java SE, WebLogic, PeopleSoft and many other lines, without CVE details.
48
September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
ShinyHunters arrest number three: a Canadian ransomware negotiator
FBI arrested Canadian negotiator Edward Dubrovsky on extortion charges in its ShinyHunters crackdown, the third recent detention.
67
FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack
FBI arrested an unnamed Canadian in Pennsylvania as another ShinyHunters suspect in the jobs-portal breach.
75
Another ShinyHunters suspect arrested
Authorities arrested a teenage ShinyHunters suspect in Jordan, the second member detained after a Dutch arrest.
74
FBI removes contractor working with its PeopleSoft system after data breach, says report
FBI removed an Accenture contractor after unpatched PeopleSoft exposed employee data, which ShinyHunters claimed.
78
FBI Blames Contractor’s Missed Patch for ShinyHunters Breach
The FBI removed an Accenture contractor after an unpatched Oracle PeopleSoft system let ShinyHunters expose employee records.
84
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach
The FBI removed an Accenture contractor after a missed PeopleSoft patch let ShinyHunters steal thousands of employees' data.
84
Despite ShinyHunters arrests after FBI jobs data breach, enterprises still have no answers about PeopleSoft risks
PeopleSoft customers lack vendor guidance as ShinyHunters claims a second zero-day after the confirmed FBI breach.
80
ShinyHunters’ exploitation of a new PeopleSoft zero-day hole threatens to change enterprise risk dynamics
ShinyHunters claims a new PeopleSoft pre-auth RCE zero-day used to breach the FBI, which confirmed the intrusion.
80
ShinyHunters hacker reportedly detained in Jordan, aiding FBI
Jordan reportedly detained ShinyHunters suspect Saif al-Din Khader, who is helping the FBI find other members.
67
Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation
Dutch police arrested a 24-year-old Amsterdam suspect, identified as Pepijn van der Stap, in the ShinyHunters investigation.
66
ShinyHunters exploiting workarounds for Oracle PeopleSoft bug, Mandiant warns
Mandiant says ShinyHunters is again exploiting unpatched Oracle PeopleSoft flaw CVE-2026-35273, including after workarounds.
85
FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day
FBI job portals stay offline after ShinyHunters claimed a PeopleSoft zero-day breach of personnel data.
88
Oracle PeopleSoft Servers Targeted Again as ShinyHunters Expands Extortion Operations
ShinyHunters-linked UNC6240 is mass-exploiting Oracle PeopleSoft CVE-2026-35273, bypassing WAF path filters for extortion.
84
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
ShinyHunters is mass-exploiting Oracle PeopleSoft CVE-2026-35273, bypassing WAF rules to plant web shells.
85
ShinyHunters Claims FBI Hack Via PeopleSoft Zero Day
ShinyHunters claims FBI breach via PeopleSoft zero-day, alleging theft of data on 5000 employees.
85
‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees
ShinyHunters claims a PeopleSoft zero-day breach exposing personal data on FBI employees and applicants.
86
Oracle Patches 800+ Vulnerabilities in September 2026 Security Update
Oracle's September 2026 Critical Patch Update fixes 800+ vulnerabilities, including over 100 critical flaws and 240+ remotely exploitable without authentication.
55
Beyond the Perimeter: Building Resilience Against Cloud and SaaS Supply-Chain Attacks
ShinyHunters exploited an Oracle PeopleSoft zero-day to steal data and extort roughly 100 organizations, including the Council of Europe, for up to $2.3M.
78
Related CVEs
by mentions- CVE-2026-3527397%9.8Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
- CVE-2021-44228100%10.0JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
- CVE-2026-543022%10.0Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways
- CVE-2019-0708100%9.8Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
- CVE-2022-22965100%9.8Unauthenticated RCE in VMware Spring Framework (Spring4Shell) - JDK 9+ Tomcat WARs
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-7136290%9.1Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento)
- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2026-58704<1%8.8Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation
- CVE-2026-4871070%6.5HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710)
Appears with
- Oraclevendor · 23
- ShinyHuntersthreat actor · 19
- FBIvictim · 14
- FBIorganization · 10
- Mandiantorganization · 9
- Oracleorganization · 6
- Accentureorganization · 5
- AWS GovCloudproduct · 4
- Scattered Lapsus$ Huntersthreat actor · 3
- Googlevendor · 3
- Environment Management Hubproduct · 3
- UNC6240threat actor · 2
- Instructurevictim · 2
- Amazon Web Servicesvendor · 2
- Lapsus$threat actor · 2
- Google Threat Intelligence Grouporganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.