> TritonInfoSec News
Home / Sep 27, 2026 / Story
0
#1 The Hacker News general September 26, 2026 at 11:46 UTC

Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

By [email protected] (The Hacker News)

AI Summary

Google is tracking mass exploitation of CVE-2026-35273 (CVSS 9.8), a critical unauthenticated RCE vulnerability in Oracle PeopleSoft, linked to ShinyHunters. The campaign targets multiple sectors globally and involves web shell deployment. Security teams running PeopleSoft should treat this as an active incident-response priority given the critical severity and widespread targeting.

Read full article → https://thehackernews.com/2026/09/attackers-bypass…

Relevance score: 92.0/100

# More from September 27

  1. 2
    ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks BleepingComputer
  2. 3
    SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild The Hacker News
  3. 4
    Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack The Hacker News
  4. 5
    Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise The Hacker News
  5. 6
    Army soldier sentenced for spree of attacks on AT&T, Snowflake and other major companies CyberScoop
  6. 7
    CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks BleepingComputer
  7. 8
    Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials The Hacker News
  8. 9
    Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link The Hacker News
  9. 10
    Roundcube Webmail Vulnerability in Attackers’ Crosshairs SecurityWeek