[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9tMhzQX9FA2tGjKKRCWBDHaB8SXBOyCYlLw_jvaJ3sc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"e133f449-7b71-4584-8401-da32a6f1866f","shinyhunters-exploits-unpatched-oracle-peoplesoft-to-breach-100-organizations","56f5dca8-b026-48f1-8fbf-9dc09bac7d30","ShinyHunters Exploits Unpatched Oracle PeopleSoft to Breach 100+ Organizations","The ShinyHunters group (UNC6240) successfully exploited CVE-2026-35273 in Oracle PeopleSoft by using URL encoding to bypass web application firewall rules, demonstrating that WAFs alone are not a reliable substitute for timely patching. Once inside, attackers established deep persistence through web shells, custom backdoors, and tunneling tools, making remediation significantly more complex and costly. This campaign highlights the critical danger of leaving internet-facing enterprise applications unpatched, particularly when threat actors are actively researching WAF bypass techniques to circumvent compensating controls. Over 100 organizations across multiple sectors were affected, underscoring that widely deployed enterprise software like PeopleSoft represents a high-value, high-impact target for financially motivated threat groups.","**Immediate actions:**\n- Apply Oracle's official patch for CVE-2026-35273 to all PeopleSoft instances immediately, prioritizing internet-facing deployments.\n- Audit all PeopleSoft Environment Management Hub endpoints and restrict external access to only trusted, necessary IP ranges.\n- Scan web servers and application tiers for indicators of compromise including web shells, SideEye, Neo-reGeorg, and MeshCentral artifacts.\n\n**Long-term improvements:**\n- Establish a formal emergency patching SLA (e.g., 24–72 hours) for critical vulnerabilities affecting internet-exposed enterprise applications.\n- Maintain a continuously updated inventory of all internet-facing assets and their associated software versions to accelerate vulnerability impact assessments.\n- Implement network segmentation to isolate PeopleSoft application and database tiers from the broader corporate network, limiting lateral movement opportunities.\n\n**Detection measures:**\n- Configure WAF and SIEM rules to detect URL-encoded bypass patterns (e.g., '%50' substitutions) targeting known vulnerable endpoints.\n- Deploy behavioral monitoring on application servers to alert on anomalous processes, outbound tunneling connections, and unexpected administrative tool execution.\n- Enable centralized logging of all PeopleSoft application activity and correlate logs against threat intelligence feeds for known ShinyHunters TTPs.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST IR-4: Incident Handling","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1505.003: Web Shell","MITRE ATT&CK T1572: Protocol Tunneling","OWASP Top 10 A06:2021 – Vulnerable and Outdated Components","GDPR Article 32: Security of Processing (for EU-based affected organizations)",{},"published","2026-09-28T19:22:43.637929+00:00","2026-09-28T19:22:43.303+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.securityweek.com\u002Fgoogle-warns-of-shinyhunters-fresh-oracle-peoplesoft-campaign\u002F","google-warns-of-shinyhunters-fresh-oracle-peoplesoft-campaign-3ba40d","Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":46,"name":47,"slug":48,"description":49,"color":50},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[53,56,60],{"slug":36,"name":54,"problem":55},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":57,"name":58,"problem":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":61,"name":62,"problem":63},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them."]