thehackernews.com
Oct 28, 2026
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
AI-summarised brief · reviewed before publication
Oracle PeopleSoft suffered a critical vulnerability that ShinyHunters exploited from May 27 to June 9, later expanding to multiple sectors. The flaw is actually a chain of three vulnerabilities, all fixed under CVE‑2026‑35273, involving a server‑side request forgery that bypasses internal trust checks. The SSRF in the Integration Gateway allows attackers to target the internal admin interface, enabling remote code execution without authentication. Oracle released the patch on June 10, but attackers had already used the zero‑day against universities and other industries.
💡 Why It Matters
- · The breach exposed a fundamental design flaw in PeopleSoft’s default trust settings, undermining presumed network perimeter defenses and enabling attackers to bypass web‑application firewalls.
- · It underscores the need for rigorous validation of internal interfaces and proactive patch management.
