> TritonInfoSec News
Home / Oct 29, 2026 / Story
0
#4 The Hacker News general October 28, 2026 at 06:04 UTC

ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

By [email protected] (The Hacker News)

AI Summary

Researchers revealed that the critical Oracle PeopleSoft vulnerability exploited by ShinyHunters since May 2026 is actually three chained flaws — a server-side request forgery (SSRF) reaching an internal management interface via PeopleSoft's trusted loopback address — all patched by Oracle under the single identifier CVE-2026-35273 in June. The ShinyHunters group's months-long exploitation window before patching underscores the risk of chained SSRF attacks on enterprise ERP systems.

Read full article → https://thehackernews.com/2026/10/shinyhunters-exp…

Relevance score: 84.0/100

# More from October 29

  1. 1
    Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns The Hacker News
  2. 2
    Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win The Hacker News
  3. 3
    Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges The Hacker News
  4. 5
    Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch The Hacker News
  5. 6
    Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers The Hacker News
  6. 7
    PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network The Hacker News
  7. 8
    Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass The Hacker News
  8. 9
    Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers The Hacker News
  9. 10
    Chrome and Firefox Updates Patch Over 200 Vulnerabilities SecurityWeek