[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu4oe8wiBsZc6Qpe6qfoh1rLHh24u8MdsnzbQpbimOmI":3},{"article":4,"iocs":50,"watch_terms":74,"solutions":75,"lesson":175},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"ad05dc9b-6903-4c06-9f65-e20dfc39e89e","Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells","attackers-bypass-wafs-to-exploit-oracle-peoplesoft-flaw-and-deploy-web-shells-124ca5","Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution. The vulnerability was first exploited as a zero-day","Google warns of renewed mass exploitation of a critical Oracle PeopleSoft vulnerability (CVE-2026-35273) by the ShinyHunters-linked threat actor UNC6240. Attackers are bypassing Web Application Firewalls (WAFs) by URL-encoding characters in requests to the Environment Management Hub endpoint, enabling them to deploy web shells, backdoors like SIDEEYE, and gain persistent access using tools like MeshAgent. The campaign targets multiple global sectors, including education, technology, and healthcare.","Attackers exploit Oracle PeopleSoft flaw CVE-2026-35273, bypassing WAFs to deploy web shells and backdoors.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fattackers-bypass-wafs-to-exploit-oracle.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiYN2VWIT2g8mQkV0GeZWzYErKcubb0-baI8J__2nmdElucECc7HrLkdPsR1dz93qjMBI5sr_dL8yPWHf2bwWCBXa3YfutHAeJ-70UCSMuJrHhyOB3RO4OkuDjuw7gxRLXUnK-CeK9jZO0uOJRy-N3w-rV7uZ4t1FnFIWNjEsKtSYQINUvPX31mKzV_5Ert\u002Fs1600\u002Foracle-flaw.jpg","2026-09-26T11:46:40+00:00","2026-09-26T20:00:14.990786+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Oracle PeopleSoft","product",{"name":21,"type":22},"Oracle","vendor",{"name":24,"type":25},"UNC6240","threat_actor",{"name":27,"type":25},"ShinyHunters",{"name":29,"type":19},"PSEMHUB",{"name":31,"type":19},"SIDEEYE","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,59,62,65,68,71],{"type":52,"value":53,"context":54},"cve","CVE-2026-35273","Critical Oracle PeopleSoft vulnerability exploited by attackers.",{"type":56,"value":57,"context":58},"ip","162.219.30.165","C2 server for SIDEEYE backdoor.",{"type":60,"value":31,"context":61},"malware","C++ backdoor deployed by attackers.",{"type":60,"value":63,"context":64},"MeshAgent","Remote access tool used for persistence.",{"type":60,"value":66,"context":67},"Ple64.exe","Trojanized installer for SIDEEYE.",{"type":60,"value":69,"context":70},"x.jsp","JSP web shell for cross-platform command execution.",{"type":60,"value":72,"context":73},"u.jsp","JSP web shell for file uploads and command execution.",[21,18,29],{"controls":76,"vendors":163},[77,105,134],{"slug":78,"name":79,"problem":80,"products":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":78,"product_name":102,"url":103,"description":104},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":135,"name":136,"problem":137,"products":138},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[139,147,155],{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",[164,170],{"slug":165,"name":166,"logo_path":167,"roles":168},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[169],"reported_by",{"slug":171,"name":21,"logo_path":172,"roles":173},"oracle","\u002Fvendor-logos\u002Foracle.png",[174],"affected",{"slug":176,"title":177,"body":178,"framework_refs":179,"framework_notes":191},"waf-bypass-enables-mass-exploitation-of-critical-oracle-peoplesoft-flaw","WAF Bypass Enables Mass Exploitation of Critical Oracle PeopleSoft Flaw","Attackers linked to ShinyHunters (UNC6240) are exploiting CVE-2026-35273 in Oracle PeopleSoft by URL-encoding malicious characters to evade Web Application Firewall detection — a classic bypass technique that highlights the danger of treating WAFs as a primary defense rather than one layer in a defense-in-depth strategy. Once inside, threat actors deploy persistent web shells and backdoors like SIDEEYE, giving them long-term footholds in victim environments across education, healthcare, and technology sectors. The root cause is a failure to apply critical patches promptly on internet-facing enterprise systems, compounded by over-reliance on WAFs as a compensating control. This matters because unpatched ERP platforms like PeopleSoft often hold sensitive HR, financial, and student data, making them high-value targets with catastrophic breach potential.",[180,181,182,183,184,185,186,187,188,189,190],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST IR-4: Incident Handling","NIST CA-8: Penetration Testing","OWASP Top 10: A05 Security Misconfiguration","ITIL: Change and Release Management (Emergency Change Procedure)","GDPR Article 32: Security of Processing (applicable to healthcare\u002Feducation sectors handling EU data)",{}]