importantSYS.SOURCE: The Hacker News• 2026-09-26T17:16:40+05:30

Advanced Attackers Exploit Oracle PeopleSoft Vulnerability to Deploy Web Shells, Bypassing WAFs

#oracle #vulnerability #web security #waf bypass #cyber attack

Attackers are exploiting the critical Oracle PeopleSoft vulnerability CVE-2026-35273 to bypass WAFs and deploy web shells, enabling remote code execution and data theft. The campaign involves URL-encoding techniques to evade detection and targets multiple sectors including education, healthcare, and government.

Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally.

The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution.

The vulnerability was first exploited as a zero-day

Read original article

*** END OF TRANSMISSION ***

> CASCADIA SUBDUCTION ZONE OBSERVED TEARING APART, REVEALING NEW INSIGHTS INTO TECTONIC PLATE TERMINATION > INTERACTIVE DIGITAL AVATAR OF A JOURNALIST CREATED USING AI TECHNOLOGIES > ANALYZING THE BEHAVIORAL EFFECTS OF LLM WATERMARKING ON AI AGENT OPERATIONS > ADVANCED ATTACKERS EXPLOIT ORACLE PEOPLESOFT VULNERABILITY TO DEPLOY WEB SHELLS, BYPASSING WAFS > DEVELOPER ABANDONS GOOGLE PLAY STORE IN FAVOR OF F-DROID FOR CONVERSATIONS APP > ZERO TRUST IMPLEMENTATION FOR AI AGENTS: ADDRESSING VISIBILITY GAPS > PERSONAL REFLECTIONS ON ABANDONING AI IN SOFTWARE DEVELOPMENT > MICROSOFT AND PC MAKERS DISCONTINUE COPILOT+ PC BRANDING INITIATIVE > ELEMENTOR WORDPRESS PLUGIN CSRF VULNERABILITY ENABLES ADMIN ACCOUNT TAKEOVER VIA CRAFTED LINKS > APPLE CARDS: ORIGIN STORY, TECHNICAL HURDLES, AND PROJECT MANAGEMENT CHALLENGES> CASCADIA SUBDUCTION ZONE OBSERVED TEARING APART, REVEALING NEW INSIGHTS INTO TECTONIC PLATE TERMINATION > INTERACTIVE DIGITAL AVATAR OF A JOURNALIST CREATED USING AI TECHNOLOGIES > ANALYZING THE BEHAVIORAL EFFECTS OF LLM WATERMARKING ON AI AGENT OPERATIONS > ADVANCED ATTACKERS EXPLOIT ORACLE PEOPLESOFT VULNERABILITY TO DEPLOY WEB SHELLS, BYPASSING WAFS > DEVELOPER ABANDONS GOOGLE PLAY STORE IN FAVOR OF F-DROID FOR CONVERSATIONS APP > ZERO TRUST IMPLEMENTATION FOR AI AGENTS: ADDRESSING VISIBILITY GAPS > PERSONAL REFLECTIONS ON ABANDONING AI IN SOFTWARE DEVELOPMENT > MICROSOFT AND PC MAKERS DISCONTINUE COPILOT+ PC BRANDING INITIATIVE > ELEMENTOR WORDPRESS PLUGIN CSRF VULNERABILITY ENABLES ADMIN ACCOUNT TAKEOVER VIA CRAFTED LINKS > APPLE CARDS: ORIGIN STORY, TECHNICAL HURDLES, AND PROJECT MANAGEMENT CHALLENGES