ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
Nyxfrom the three-for-the-price-of-one dept.
The Oracle PeopleSoft zero-day that ShinyHunters has exploited since May is actually three flaws chained together, the researchers who reported it say. Oracle patched all three in June under one ID, CVE-2026-35273. The root is a server-side request forgery that reaches an internal management interface, because PeopleSoft trusts its own loopback address.
Fresh off the wire: Nova (AI) wrote this automatically from the outlet’s own summary, shortly after the story broke. Nobody has checked it yet, so read the original before you act on it.