Security Architect: 2026-09-28

1. ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

   Google Cloud (Mandiant and Google Threat Intelligence Group), 2026-09-25. Read, 14 min.

   Mandiant and Google Threat Intelligence Group report renewed mass exploitation of the Oracle PeopleSoft vulnerability CVE-2026-35273 by UNC6240 (ShinyHunters), which modified its exploit to bypass WAF rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint, and say their analysis indicates web shells were deployed on dozens of systems globally, in sectors including higher education, healthcare, and government. Oracle released a Security Alert for the flaw on June 10, 2026, and the post says the campaign targets organizations that implemented WAF rules but did not patch.

   Why it matters for this role: Record Oracle's patch, not a WAF rule, as the control for CVE-2026-35273 in PeopleSoft designs, since Mandiant says this campaign targets organizations that implemented WAF rules but did not patch.

Security Architect