peoplesoft

Oracle heeft meerdere kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise PeopleTools, inclusief de modules Integration Broker, Data Mover, Configuration Manager, FIN Common Objects, FIN Lease Administration en CC Common Application Objects, specifiek in versies 8.61 tot en met 8.63 en 9.1 tot en met 9.2. De kwetsbaarheden in Oracle PeopleSoft Enterprise PeopleTools en gerelateerde modules stellen een aanvaller in staat om via netwerktoegang, vaak via HTTP of Oracle Net, zonder authenticatie of met lage privileges, het systeem volledig over te nemen of kritieke data te creëren, wijzigen of verwijderen. Sommige kwetsbaarheden vereisen gebruikersinteractie, andere niet. De impact betreft de vertrouwelijkheid, integriteit en beschikbaarheid van het systeem en de data. De kwetsbaarheden omvatten onder meer het omzeilen van authenticatie, privilege-escalatie, en het uitvoeren van ongeautoriseerde acties. Specifieke componenten zoals de Integration Broker en Configuration Manager zijn ook getroffen. De CVSS 3.1 basis scores variëren van 4.4 tot 9.8, waarbij meerdere kwetsbaarheden een hoge score hebben die duidt op een significante impact op de beveiliging van de systemen.

Oracle on Tuesday announced the release of 943 new security patches as part of the August 2026 Critical Security Patch Update (CSPU), its third monthly security rollout. The company’s advisory mentions more than 1,000 unique CVEs across two dozen products, including over 460 vulnerabilities that can be exploited remotely without authentication. The patches for dozens of vulnerabilities address additional security flaws. More than 150 of the security defects are critical-severity bugs, and nearly 90 of them have a CVSS score of 9.8 or higher. Fusion Middleware and Hyperion received the largest number of new security patches this month, at 262 each, including over 100 critical-severity flaws (80 and 27, respectively). Per Oracle’s advisory, the Fusion Middleware update resolves 182 bugs that can be exploited remotely without authentication, while the Hyperion refresh patches 107 such weaknesses. Oracle also released a large number of patches for E-Business Suite (120), Commerce (66), Siebel CRM (50), and Supply Chain (46). Other products that received fixes this month include VM VirtualBox, Analytics, PeopleSoft, Communications, Enterprise Manager, MySQL, Financial Services Applications, Autonomous Health Framework, Application Testing Suite, JD Edwards, Database Server, Java SE, Retail Applications, Essbase, Food and Beverage Applications, Construction and Engineering, and Hospitality Applications. With over 1,000 resolved security defects, the August 2026 CSPU falls slightly behind the July 2026 Critical Patch Update, which included 1,449 security patches that addressed over 1,400 unique CVEs. The high number of patches is likely driven by the use of AI for vulnerability discovery. Oracle announced earlier this year that it was using advanced LLM models to speed up patching. Oracle customers are advised to apply the security updates as soon as possible, as threat actors have been known to exploit vulnerabilities in Oracle products. “Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches,” the company notes. Related: 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw Related: Recent macOS Screen Sharing Vulnerability Exploited in Attacks Related: Hackers Exploiting Unpatched GeoServer Zero-Day Related: Critical VMware vCenter Vulnerability in Attackers’ Crosshairs

The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned. RingCentral is a cloud-based collaboration and communication platform used by over 600,000 businesses for services such as calling, messaging, and voicemail. The company disclosed the incident on July 28, revealing that its systems were compromised following what it described as a "sophisticated social engineering campaign." "We have not seen any new unauthorized activity since taking these remediation efforts. To date, this incident has affected data for a limited portion of RingCentral customers, and we are communicating with affected customers directly," it noted. "If you are not contacted by RingCentral, you are not affected. This incident did not impact the core RingCentral platform, and our services continue to operate without disruption." Although RingCentral has not attributed the breach to a specific threat actor or hacking group and has yet to share further details on the incident, the ShinyHunters extortion gang claimed responsibility on July 27, claiming they had stolen 623GB of data. After the company refused to pay a ransom to have the stolen data destroyed, the cybercrime group leaked a compressed archive containing 280GB worth of files on their dark web leak site. While a RingCentral spokesperson didn't immediately reply when contacted by BleepingComputer to confirm ShinyHunters' claims, Have I Been Pwned confirmed the link after analyzing the leaked data and said on Thursday that it contained records for 1.6 million accounts, including names, email addresses, phone numbers, and physical addresses. "In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters 'pay or leak' extortion campaign," it said. Although RingCentral has yet to share exactly how the threat actors gained access to its systems, ShinyHunters has claimed breaches at hundreds of Salesforce customers over the past year, saying they've stolen over 1.5 billion records in Salesloft Drift and Salesforce Aura campaigns. The extortion group was also linked to security breaches at more than a dozen Snowflake customers, as well as various other third-party integration providers. Most recently, ShinyHunters claimed responsibility for a new series of breaches at over 100 organizations following data-theft attacks that exploited an Oracle PeopleSoft zero-day flaw. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

La rapidità con cui evolvono le minacce informatiche sta costringendo le organizzazioni a ridisegnare le proprie architetture di difesa. Se fino a poco tempo fa l’impiego dell’intelligenza artificiale all’interno delle strutture di monitoraggio della sicurezza rappresentava un’opzione puramente integrativa, i mutamenti dello scenario tecnologico hanno trasformato questa tecnologia in una necessità strutturale. In una approfondita intervista tecnica rilasciata allo specialista Ron Eddings, la Chief Security Evangelist di ExaForce, Aqsa Taylor, ha analizzato i fattori che rallentano l’adozione su larga scala dell’automazione nei centri operativi di sicurezza, tracciando una netta linea di demarcazione tra le vecchie logiche di gestione e i requisiti indispensabili per la difesa moderna. Indice degli argomenti La contrazione del tempo di reazione globale L’urgenza di una trasformazione radicale emerge dagli incidenti che colpiscono le grandi infrastrutture aziendali. I dati recenti evidenziano un forte affinamento delle tecniche di ingegneria sociale. I criminali riescono ormai a superare con facilità i tradizionali perimetri di autenticazione. Il caso Charter Communications Un esempio emblematico è rappresentato dal massiccio attacco subito da Charter Communications. Il gruppo criminale ShinyHunters ha sottratto ben 40 milioni di record di clienti. L’azione è avvenuta dopo il rifiuto dell’azienda di pagare il riscatto richiesto. La dinamica mette in luce la fragilità dei controlli tradizionali. L’intrusione è iniziata con una singola chiamata di vishing, ovvero phishing vocale, verso un dipendente. Attraverso la manipolazione psicologica, l’attaccante ha compromesso l’account Microsoft Entra della vittima. Ha ottenuto così un accesso diretto all’istanza Salesforce aziendale. Il gruppo ha prelevato dati sensibili come nomi, indirizzi, telefoni e ticket di supporto. Vulnerabilità infrastrutturali e zero-day Lo stesso gruppo criminale ha sfruttato una falla non patchata nel sistema Oracle PeopleSoft. Il problema era noto da tempo. Tuttavia, la correzione ufficiale è arrivata soltanto il 10 giugno. Oracle ha valutato questa vulnerabilità con un punteggio di gravità pari a 9.8 su 10. La falla non richiedeva credenziali di login. Bastava soltanto la visibilità a livello di rete. Questa caratteristica ha reso vulnerabili soprattutto le università. Le istituzioni accademiche hanno infatti infrastrutture enormi e accessibili senza autenticazione preliminare. I dati del Microsoft June Patch Tuesday confermano il collasso dei tempi di gestione delle crisi. L’azienda ha rilasciato correzioni per ben 206 vulnerabilità. Tra queste figuravano tre zero-day attivamente sfruttati sul campo. La finestra temporale tra la scoperta di una falla e il suo utilizzo malevolo si è ridotta a pochi secondi. Di fronte a uno stack tecnologico vulnerabile in tempo reale, i modelli difensivi tradizionali mostrano limiti evidenti. I limiti dei sistemi legacy e il ruolo del SOC Il dibattito sull’efficacia dell’automazione ha subito una profonda mutazione nell’ultimo anno. Nel corso del 2025, la quasi totalità degli esperti esprimeva un forte scetticismo. Oltre settanta professionisti consultati da Eddings limitavano l’uso dell’intelligenza artificiale a compiti descrittivi. La tecnologia serviva solo per la sintesi delle informazioni, escludendo l’operatività degli agenti. Il passaggio al modello agentico nel 2026 Lo scenario attuale mostra un’inversione di tendenza radicale. Le organizzazioni stanno dando pieno controllo agli agenti autonomi. Questa scelta è spinta dalla capacità degli avversari di utilizzare l’intelligenza artificiale per offensive coordinate su scala industriale. Durante il confronto, Eddings ha sollevato una questione centrale sul futuro delle architetture di sicurezza: «Cos’è un SOC basato sull’IA nel mondo di oggi? Possiamo fare di più con l’intelligenza artificiale; dovrebbe essere una strategia per l’intero ciclo di vita, non solo per il triage, ma anche per il rilevamento». Il problema della manutenzione manuale Il limite principale delle soluzioni tradizionali risiede nella gestione dei playbook statici all’interno dei sistemi SOAR. Questa attività richiede storicamente l’impiego di personale a tempo pieno. Molti strumenti si limitano a ri-prioritizzare gli alert sopra un SIEM preesistente. In questo modo l’efficacia decade per la mancanza di una comprensione profonda delle relazioni aziendali. Taylor ha chiarito questo specifico aspetto tecnico. L’esperta ha affermato: «Se una piattaforma IA si concentra solo sulla ri-prioritizzazione, dipende dagli eventi che arrivano da SIEM o XDR e spesso le manca il contesto aziendale, le relazioni di identità o le configurazioni». Senza questi dati, l’analista deve inserire manualmente le informazioni mancanti, alimentando il fenomeno del burnout. L’architettura del Knowledge Graph semantico Per superare la frammentazione dei log grezzi, la difesa si orienta verso strutture informative evolute. ExaForce ha recentemente ottenuto un piano di investimenti da 125 milioni di dollari. Queste risorse potenzieranno i team MDR e lo sviluppo del prodotto. L’azienda propone l’adozione di un Knowledge Graph semantico in tempo reale. Correlazione multilivello dei dati L’obiettivo fondamentale è arricchire i segnali grezzi raccolti dall’infrastruttura. Il sistema lega gli eventi a tre livelli informativi distinti: l’identità, la configurazione e il codice. La combinazione tra automazione algoritmica e supervisione umana rappresenta l’asse portante di questa visione. Taylor ha spiegato la necessità di una sinergia tra tecnologia e professionisti: «Crediamo che il modello vincente per il SOC sia una piattaforma SOC agentica supportata dal servizio MDR per la responsabilità umana». Il fattore umano offre la garanzia finale. Consente all’infrastruttura di operare con un livello di accuratezza tale da azzerare i falsi allarmi. L’operatività sul campo degli agenti autonomi L’attività di un SOC moderno si esprime nella capacità di esaminare simultaneamente molteplici dimensioni di una minaccia. Gli agenti software specializzati, chiamati Exobot, eseguono scansioni che superano il semplice riscontro di un indicatore di compromissione. Il sistema analizza l’utente, la gerarchia aziendale, l’accesso ai file e le condivisioni esterne. L’action coordinata di quattro bot consente di ridurre i falsi positivi del 90%. Inoltre, permette di velocizzare le investigazioni del 95%. Angoli ciechi e attacchi alla supply chain Questa granularità si rivela indispensabile di fronte ad attacchi sofisticati. Un caso concreto è la campagna HackerBot Claw condotta sulla piattaforma GitHub. Questa offensiva non si manifesta attraverso i tradizionali log di AWS o CloudTrail. L’attacco agisce direttamente tramite la manipolazione delle Pull Request nei flussi di sviluppo software. Un sistema tradizionale privo di visibilità semantica non rileva l’anomalia. Il concetto di Vibe Hunting e Peer Baselining Una delle innovazioni metodologiche più rilevanti presentate da Taylor prende il nome di Vibe Hunting. Questa tecnica sfrutta un feed di minacce integrato. Non appena esce un articolo su un nuovo attacco, i bot avviano una caccia proattiva automatica. Il sistema incrocia identità, configurazioni e codice per mostrare l’impatto in tempo reale. Il monitoraggio degli ecosistemi SaaS come Slack o Google Workspace beneficia del meccanismo di peer baselining. Gli strumenti tradizionali verificano le anomalie basandosi solo sullo storico del singolo utente. L’analisi agentica confronta invece il comportamento del soggetto con quello del suo gruppo di pari. Questa metodologia permette di identificare minacce interne sofisticate. Un esempio è il caso di un attore malevolo nordcoreano infiltrato come dipendente. Anche se le sue azioni sembrano coerenti con il suo storico individuale, il confronto con le abitudini dei colleghi fa emergere immediatamente le anomalie. La roadmap strategica per l’adozione dell’IA La transizione verso un modello autonomo richiede una pianificazione rigorosa. Bisogna escludere implementazioni affrettate e prive di garanzie. Taylor ha raccomandato un percorso progressivo: «Non puoi passare da zero a “rispondi a tutti i ticket per me”. Devi costruire una strategia: prima verifichi il triage, poi la qualità dei rilevamenti, poi l’investigazione. Solo allora passi alla risposta automatizzata». Le quattro fasi dello sviluppo L’adozione della tecnologia all’interno del SOC deve seguire passaggi sequenziali ordinati. Si parte dalla validazione della precisione nella fase di triage iniziale. Successivamente, si valuta la qualità dei rilevamenti. La terza fase si concentra sull’accelerazione delle investigazioni. Solo dopo aver consolidato la fiducia si passa alla risposta automatizzata. Per i team che vogliono iniziare, l’attività di threat hunting rappresenta il punto di partenza ottimale. Si possono utilizzare inizialmente strumenti aperti come Claude per comprendere il supporto dell’IA. Tuttavia, per un ciclo proattivo continuo, serve una piattaforma live che agisca come agente in tempo reale. Il potenziamento del fattore umano L’evoluzione tecnologica non mira a eliminare il personale specializzato. Taylor ha ricordato una chiara analogia: «L’IA è come internet: non ha eliminato gli insegnanti, ci ha reso più efficienti». L’obiettivo è liberare i difensori dai compiti manuali come la scrittura di regole di rilevamento. I professionisti possono così usare il linguaggio naturale per formulare ipotesi di caccia alle minacce e concentrarsi sulla gestione strategica.

Oracle heeft 84 kwetsbaarheden verholpen in verschillende modules van Oracle PeopleSoft Enterprise, waaronder HCM Talent Acquisition Manager, In-Memory Project Discovery, FIN Expenses, SCM eProcurement, CC Common Application Objects, SCM Order Management, CRM Common Objects en FIN Program Management, allen versie 9.2. Een deel van deze 84 kwetsbaarheden betreft objecten die belangrijk zijn voor andere landen en zijn dus niet relevant voor sytemen in Nederland. De ernstigste kwetsbaarheden, 8 stuks, hebben een hoge score variërend van 9.1 tot 9.9 gekregen en bevinden zich in diverse Oracle PeopleSoft Enterprise componenten. De twee meest ernstige kwetsbaarheden in HCM Talent Acquisition Manager en Project Discovery, met de score van 9.9 maken het mogelijk voor een aanvaller met lage privileges en netwerktoegang via HTTP om het systeem volledig te compromitteren. Hierdoor kan de aanvaller de vertrouwelijkheid, integriteit en beschikbaarheid van de omgeving beïnvloeden. De kwetsbaarheid kan ook impact hebben op andere Oracle-producten buiten de Talent Acquisition Manager module. De kwetsbaarheid in Enterprise FIN Expenses, met de score van 9.4 maakt het mogelijk voor niet-geauthenticeerde externe aanvallers om ongeautoriseerde toegang te verkrijgen tot het systeem. Door misbruik van deze kwetsbaarheid kunnen aanvallers data binnen de applicatie wijzigen of verwijderen. Daarnaast kan de kwetsbaarheid worden gebruikt om een gedeeltelijke denial-of-service (DoS) te veroorzaken. De kwetsbaarheid in SCM eProcurement, met de score 9.3 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om ongeautoriseerde toegang tot het systeem te verkrijgen. Door misbruik van deze kwetsbaarheid kan een aanvaller kritieke gegevens binnen de getroffen applicatie wijzigen. De kwetsbaarheid kan ook invloed hebben op andere gerelateerde Oracle PeopleSoft producten. De kwetsbaarheid in Common Application Objects, met de score 9.1 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om onbevoegd kritieke data te creëren, verwijderen of wijzigen. Dit betreft de Common Application Objects component binnen de PeopleSoft Enterprise suite. Aanvallers kunnen hierdoor gevoelige data manipuleren zonder authenticatie. De kwetsbaarheid in SCM Order Management, met de score 9.1 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om onbevoegd kritieke data te creëren, verwijderen of wijzigen. Dit betreft de Common Application Objects component binnen de PeopleSoft Enterprise suite. Aanvallers kunnen hierdoor gevoelige data manipuleren zonder authenticatie. De kwetsbaarheid in Enterprise CRM Common Objects, met score 9.0 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om onbevoegd kritieke data te creëren, verwijderen of wijzigen. Dit betreft de Common Application Objects component binnen de PeopleSoft Enterprise suite. Aanvallers kunnen hierdoor gevoelige data manipuleren zonder authenticatie. De kwetsbaarheid in Program Management, met score 9.0 maakt het mogelijk voor een aanvaller met beperkte rechten en netwerktoegang, en die gebruikersinteractie vereist, om mogelijk volledige controle over het getroffen systeem te verkrijgen. De kwetsbaarheid beïnvloedt de vertrouwelijkheid, integriteit en beschikbaarheid van het systeem. De overige kwetsbaarheden hebben lagere scores gekregen dan 9. Deze kunnen leiden tot compromittering van vertrouwelijkheid, integriteit en beschikbaarheid van de systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie, terwijl andere dat niet doen. De impact strekt zich uit over meerdere modules binnen de PeopleSoft Enterprise suite en kan ook andere gerelateerde Oracle producten beïnvloeden. De detailinformatie voor deze kwetsbaarheden is niet opgenomen in deze advisory en het NCSC verwijst daarom naar de bijgevoegde referentie.

The Dutch National Police (Politie) says it has found "strong indications" that Dutch hackers have been involved in a February breach at the telecommunications provider Odido. "This includes a telephone conversation that was made with Odido customer service shortly before the hack. In this conversation, a Dutch-speaking man posed as Odido's IT employee. The company was then misled through phishing, after which the data theft took place," the police said in a Thursday press release. "This type of investigation is often complex and takes time, but cybercriminals are also vulnerable and leave traces. Traces have been secured at several times during the investigation into the hack at Odido, which the research team continued to work on," added Stan Duijf, the head of operations at the National Investigation and Interventions Unit. Odido is one of the largest Dutch telecommunications companies, offering mobile, broadband, and television services to millions of customers across the Netherlands. When it disclosed the breach on February 12, the company said the attackers accessed its customer contact system on February 7 and downloaded the personal data of many of its users. It also told local media that the resulting data breach affected 6.2 million customers and that the threat actors reached out to say they had stolen millions of user records. According to the telecom firm, the exposed information varies per customer, and it may include a combination of full name, address and city of residence, mobile number, customer number, email address, IBAN (bank account number), date of birth, and some identification details (passport or driver's license number and validity). However, it added that no call details, location, data, billing data, scans of identity documents, or Mijn Odido passwords were exposed during the incident. While Odido has yet to attribute the incident, the ShinyHunters extortion gang claimed responsibility for the breach on its dark web leak site, releasing an 88GB archive containing over 15 million records, including data the company had already disclosed as exposed in the attack. ShinyHunters has been behind widespread vishing campaigns targeting Okta, Microsoft, and Google single sign-on (SSO) accounts, impersonating IT support staff to trick targets' employees into entering credentials and multi-factor authentication (MFA) codes on phishing sites. After breaching corporate SSO accounts, the threat actors steal data from connected SaaS applications, including Microsoft 365, Google Workspace, Salesforce, SAP, Slack, Zendesk, Dropbox, Adobe, Atlassian, and others. The cybercrime group has been linked to a growing number of breaches involving companies such as Google, Cisco, PornHub, the online dating giant Match Group, the European Commission, Rockstar Games, and the McGraw-Hill edtech giant. They were also behind security breaches at over a dozen Snowflake customers, various other third-party integration providers, and, more recently, a new series of breaches that hit over 100 organizations (including the University of Nottingham) following data-theft attacks exploiting an Oracle PeopleSoft zero-day flaw. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Medical technology giant Medtronic is notifying more than 3.8 million individuals that their personal and medical information was compromised in a recent data breach. The incident occurred in April 2026, when the infamous extortion group ShinyHunters accessed the company’s corporate IT systems. Medtronic confirmed the attack in late April, noting that its products and manufacturing and distribution operations were not affected. ShinyHunters had added the company to its Tor-based leak site on April 17, claiming the theft of over 9 million records of personal information, and terabytes of corporate data. The group has since removed Medtronic from the website, which suggests that the company might have paid a ransom to recover the stolen information. This week, the medical technology titan started sending written notification letters to the affected individuals, confirming that the hackers stole patients’ personal and medical information, including names, contact details, dates of birth, Social Security numbers, and health-related details. “We have no evidence that any of that information was posted publicly or exposed on the internet,” reads a copy of the company’s notification letter (PDF) submitted to the California Attorney General’s Office. Medtronic told the Indiana Attorney General’s Office that 3,834,294 individuals were affected by the incident. The company is providing them with 24 months of free credit monitoring, dark web monitoring, and identity theft restoration services. “Medtronic has implemented additional safeguards and continues to work with third-party cybersecurity experts to identify opportunities to further strengthen the security of its systems. Medtronic has also worked with law enforcement and is notifying relevant regulatory authorities,” the company said. Related: Aflac Japan Data Breach Impacts 4.38 Million Related: Nissan Employee Data Breached in Oracle PeopleSoft Hack Related: More Klue Breach Victims Identified as Hackers Get Hacked

Over 900 Oracle E-Business Suite (EBS) instances have been found exposed online amid ongoing attacks exploiting a critical security flaw. The vulnerability (tracked as CVE-2026-46817) was found in the File Transmission component of EBS's Oracle Payments product and allows malicious actors without privileges and with HTTP network access to take over vulnerable systems through low-complexity attacks. Oracle has patched this flaw with security updates released as part of its May 2026 Critical Security Patch Update and urged customers to patch their systems immediately. While the company has yet to flag this flaw as exploited in attacks, threat intelligence company Defused warned on Monday that threat actors are now actively exploiting it, with the first attempts spotted over the weekend. "CVE-2026-46817 (CVSS 9.8 unauth HTTP takeover in Oracle E-Business) is being exploited. Over the weekend, we observed an actor exploiting the vulnerability on our Oracle E-Business honeypots. This vulnerability has no known previous exploitation and no public POC code exists," Defused noted. Earlier today, internet security watchdog Shadowserver also warned that it tracks around 950 Oracle EBS instances exposed online. However, there is no information regarding how many of these systems have been secured against CVE-2026-46817 attacks. Last month, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also tagged a high-severity Oracle WebLogic Server flaw (CVE-2024-21182) patched two years ago as actively exploited in the wild. Weeks later, Oracle mitigated a critical PeopleSoft Suite zero-day (CVE-2026-35273) that was exploited by the ShinyHunters extortion gang to gain unauthenticated remote code execution between May 27 and June 9 and to steal data from many organizations worldwide, including Nottingham University and the National Association of Insurance Commissioners (NAIC). Most recently, Nissan also warned of a data breach affecting current and former employees following the compromise of its Oracle PeopleSoft instance. Since early August 2025, the Clop extortion gang has exploited another Oracle EBS security flaw (CVE-2025-61882) in zero-day attacks targeting U.S. universities (including Harvard University, the University of Pennsylvania, Dartmouth College, and the University of Phoenix), as well as high-profile victims like Logitech, GlobalLogic, and the Washington Post. CISA has added 44 vulnerabilities across various Oracle products to its catalog of actively exploited flaws since November 2021, 13 of which were also abused by ransomware gangs. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Nissan has disclosed that current and former employees may have had sensitive personal data stolen, including Social Security numbers, banking details and tax records, after attackers exploited a zero-day flaw in Oracle's PeopleSoft software. The carmaker said in a breach notification published on June 26 that Oracle had warned it of a cyber event affecting hundreds of companies, and that Nissan was specifically targeted. It believes the breach affected current and former staff in the US, Canada, Mexico and Brazil and exposed data, including national identification numbers and dependent or beneficiary information. Caught in a Mass PeopleSoft Campaign Nissan described the entry point only as an unknown vulnerability in Oracle PeopleSoft, the enterprise software it uses to run payroll and HR. The flaw, tracked as CVE-2026-35273, is a critical remote code execution bug that attackers exploited as a zero-day. The wider campaign has been linked to the ShinyHunters extortion group, which claimed to have hit more than 100 organizations, mostly universities. Oracle issued an out-of-band advisory and mitigations only after the attacks began. Nissan's filing put the breach on May 27 and June 9, the window in which the campaign ran. Most named victims so far have been universities, making Nissan one of the larger corporate names caught in it. Sensitive Data and a Payroll Lockdown Beyond Social Security and national identification numbers, Nissan said the exposed information could include contact and banking details, financial and tax data plus dependent or beneficiary records. The company said it had secured its systems, was working with Oracle and would offer affected staff free credit or dark web monitoring where available. As a precaution, Nissan has restricted payroll access so that staff must use a network computer or secured VPN to view pay slips or change direct deposit details, and it is adding extra identity checks before processing payroll requests. It urged employees to watch for phishing, change reused passwords and enable multi-factor authentication (MFA). Simon Pamplin, CTO at data security firm Certes, called it "a mass-casualty event across hundreds of unrelated organizations," warning that patching the flaw does nothing for data already taken during the exploitation window. Nissan said its investigation was ongoing and that affected individuals would be contacted directly. Image credit: Luthfi Syahwal / Shutterstock.com

Nissan has disclosed a data breach stemming from the recent zero-day campaign targeting Oracle PeopleSoft customers. According to a data breach notification filed with the California Attorney General, Nissan Americas uses Oracle PeopleSoft to manage employee information, including tax administration, payroll, and other records. The carmaker recently learned that it was one of the targets of the campaign, which exploited a zero-day vulnerability tracked as CVE-2026-35273. While Nissan’s investigation is ongoing, the company believes the attackers may have stolen information belonging to current and former employees in the US, Canada, Mexico and Brazil, including SSNs, banking information, and financial and tax data. The ShinyHunters extortion group is believed to be behind the PeopleSoft campaign, but Nissan is not listed on the cybercriminals’ website at the time of writing. Nissan is regularly targeted by threat actors. Most recently, the Everest ransomware group claimed in April to have stolen Nissan customer data. ShinyHunters allegedly targeted more than 100 organizations in the PeopleSoft campaign, but only a handful of other victims are currently known. The University of Nottingham is widely believed to be a victim of the attack, and the National Association of Insurance Commissioners (NAIC) confirmed last week that it was targeted. On the ShinyHunters website only Illinois Central College and Moody Bible Institute are listed as victims of the PeopleSoft operation. Indeed, the education sector is said to be the most significantly impacted. Related: Nissan Confirms Impact From Red Hat Data Breach Related: More Klue Breach Victims Identified as Hackers Get Hacked Related: Canadian Electricity Provider London Hydro Discloses Data Breach

Nissan is warning that it suffered a data breach affecting current and former employees after threat actors exploited an Oracle PeopleSoft vulnerability in data theft attacks previously linked to the ShinyHunters extortion group. In breach notifications filed with the California Attorney General's Office, Oracle says these data theft attacks impacted hundreds of companies and that Nissan was specifically targeted in the campaign. "Nissan Americas uses Oracle PeopleSoft software to manage employee information, including payroll, tax administration, and other personnel records," reads the breach notification. "Oracle has informed us that there was a cyber event and that the personnel records of hundreds of companies may have been obtained by so-called threat actors. We have since learned that Nissan was specifically targeted in this attack." Nissan says it is still in the early stages of the investigation and has not yet determined the full impact of the breach, but believes attackers accessed personal information that may include employee contact information, banking information, Social Security numbers, Social Insurance Numbers, National Identification Numbers, financial and tax information, and dependent and beneficiary information. The incident is believed to impact current and former Nissan employees in the United States, Canada, Mexico, and Brazil. Nissan says it activated its incident response after learning it had suffered a data breach, engaged external cybersecurity experts, secured affected systems, and is working with Oracle to address the issue. The company says it also took steps to end unauthorized access and prevent further disclosure of employee information and will offer free credit and dark web monitoring services to affected individuals where available. As an additional precaution, Nissan says it is restricting access to employee pay slips and direct deposit changes to company network computers or secured VPN connections while it implements additional identity verification measures before processing payroll requests. The automaker says that employees whose information is ultimately determined to have been exposed will receive additional notifications detailing what data was impacted. Linked to ShinyHunters PeopleSoft zero-day attacks The disclosure is believed to stem from the widespread exploitation of Oracle PeopleSoft servers first reported by BleepingComputer earlier this month. As first reported, threat actors exploited a zero-day vulnerability in Oracle PeopleSoft to breach instances and steal data. The ShinyHunters extortion gang claimed responsibility for the attacks, telling BleepingComputer that over 300 PeopleSoft instances across 100 organizations were breached. Soon after, Oracle disclosed a critical vulnerability in Oracle PeopleSoft PeopleTools, tracked as CVE-2026-35273, and released emergency mitigations. While Oracle has still not publicly confirmed that the flaw was exploited, Mandiant later confirmed that threat actors exploited the Oracle PeopleSoft CVE-2026-35273 vulnerability as a zero-day in data theft attacks between May 27 and June 9. These attacks primarily impacted organizations in the education sector, and Mandiant said it notified over 100 organizations, confirming the information previously shared by ShinyHunters. Since then, ShinyHunters has begun leaking data stolen in these attacks on its data leak site, including for the Nottingham University and the National Association of Insurance Commissioners (NAIC) . The threat actors are a well-known extortion group that commonly targets Salesforce, Snowflake, third-party integration partners, and other cloud SaaS environments for data theft. ShinyHunters recently targeted the education sector in a separate cyberattack on Instructure Canvas, stealing 280 million data records from students, teachers, and staff. Instructure later paid a ransom to prevent the data from being leaked. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The National Association of Insurance Commissioners (NAIC) says the ShinyHunters extortion group stole only publicly available data, outdated logs, and configuration files after breaching its systems by exploiting a zero-day vulnerability in an Oracle PeopleSoft server. NAIC is a U.S. insurance regulatory organization present in all 50 states. The organization identified on June 11 that its PeopleSoft system had been accessed by an unauthorized party and discovered that "an unauthorized third party gained access to a portion of our IT systems." ShinyHunters claimed the attack and leaked the stolen data after the organization refused to pay a ransom. NAIC responded to the threat actor's leak and addressed some of the claims. The organization says that the hackers accessed and, in some cases, stole already publicly available statutory financial reports, credit rating agency data, outdated logs, and configuration information. According to NAIC, the investigation found no evidence of personally identifiable information (PII) or financial data having been exposed and directly disputed the threat actor’s earlier claims that they compromised critical insurance regulatory platforms like SERFF (System for Electronic Rate and Form Filing), OPTins (Online Premium Tax for Insurance), and SBS (State-Based Systems). The incident had operational consequences, with credit rating agencies temporarily suspending data feeds and the NAIC pausing investment designation work, but there are significant discrepancies between the hackers’ claims and the organization’s findings. In an announcement updated on June 25, ShinyHunters claims to hold 3.1 TB of data corresponding to 105,000 files stolen from NAIC's systems: INSData and Vision servers 264,000 insurer regulatory filing PDFs between 2017 and 2024 2,000 customer/order/payment records 45,000 rating agency files AWS infrastructure configs Stored credentials for SERFF, OPTins, and UCAA production environments The hackers also noted in the update that a previous summary of the stolen data was exaggerated due to using AI hallucinations when evaluating the files. However, according to the threat actor, the latest published inventory was validated by a human reviewer and should be considered accurate. NAIC stated that all affected systems have now been remediated and that they are implementing additional defenses to prevent future attacks. ShinyHunter's hacking spree using the zero-day (CVE-2026-35273) in the PeopleSoft enterprise system has allegedly impacted more than 100 organizations. BleepingComputer reported about the threat actor's zero-day attacks before Oracle disclosed the security issue publicly. Both cloud and on-premises Oracle PeopleSoft customer instances were targeted in breaches that left behind extortion demands signed by ShinyHunters. The hackers told us that most of the targeted organizations were in the education sector and had been previously extorted by the threat actor. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Attackers have begun exploiting a critical vulnerability (tracked as CVE-2026-46817) in the Oracle E-Business Suite (EBS) financial application, according to threat intelligence company Defused. This security flaw was found in the File Transmission component of EBS's Oracle Payments product and enables unauthenticated malicious actors with HTTP network access to take over vulnerable systems through low-complexity attacks. Oracle released security updates to address the vulnerability with its May 2026 Critical Security Patch Update and urged customers to patch their systems immediately. "Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches," the company warned at the time. "In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay." While Oracle has yet to flag the CVE-2026-46817 flaw as exploited in the wild, Defused said on Monday that attackers are now actively exploiting it, with the first attempts spotted over the weekend. "CVE-2026-46817 (CVSS 9.8 unauth HTTP takeover in Oracle E-Business) is being exploited. Over the weekend, we observed an actor exploiting the vulnerability on our Oracle E-Business honeypots. This vulnerability has no known previous exploitation and no public POC code exists," it warned. Internet security watchdog group Shadowserver now tracks over 450 Oracle EBS instances exposed online, with nearly 200 in the United States and in Europe. However, there is no information on how many of them have already been secured against these ongoing attacks. The Clop extortion gang exploited another Oracle EBS security flaw (CVE-2025-61882) in zero-day attacks targeting multiple U.S. universities (including Harvard University, the University of Pennsylvania, Dartmouth College, and the University of Phoenix), the Washington Post, Logitech, and GlobalLogic since early August 2025. Earlier this month, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also flagged a high-severity Oracle WebLogic Server flaw (CVE-2024-21182) that was patched two years ago as actively exploited in attacks. Weeks later, the company mitigated a critical PeopleSoft Suite zero-day vulnerability (CVE-2026-35273), which was actively exploited in ShinyHunter data theft attacks and allows unauthenticated remote code execution. Over the last several years, CISA has tagged 44 vulnerabilities across various Oracle products as exploited in the wild, 13 of which were also abused in ransomware attacks. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The National Association of Insurance Commissioners (NAIC) has confirmed it was targeted in the recent hacking campaign that exploited an Oracle PeopleSoft zero-day vulnerability. The PeopleSoft zero-day attacks came to light on June 11, when Oracle published an out-of-band advisory for a vulnerability tracked as CVE-2026-35273, which allows unauthenticated remote code execution. The company did not mention in-the-wild exploitation in its public advisory, but Google and others confirmed seeing attacks. The ShinyHunters cybercrime group appears to be behind the campaign, claiming to have targeted many organizations to steal their data. The US state insurance regulatory body NAIC has come forward to say that it was targeted in the campaign. NAIC is run by state insurance regulators and coordinates policy, develops model laws, and supports oversight across all 50 states. In a security incident notice posted on its website on June 26, NAIC said it learned of unauthorized access to its systems via an Oracle PeopleSoft vulnerability on June 11. An investigation showed that hackers gained access to publicly available statutory financial reporting information, credit rating agency data, and technical information such as outdated logs and configuration data. According to the NAIC, personally identifiable information, as well as payment and financial account information, was not compromised. The organization said state insurance departments’ systems were not impacted, and neither were various regulatory reporting systems, contrary to what the hackers initially claimed. ShinyHunters added NAIC to its leak website on June 18, claiming to have stolen over 105,000 files totaling more than 3.1 TB, including 2.1 million insurer regulatory filing documents. The cybercriminals later shared an update saying that the initial statement was based on “an AI-generated misinterpretation of the underlying data” and that some of the claims regarding the type of data that was compromised were not accurate. The updated statement says only 260,000 insurer regulatory filing documents were stolen and removes references to services that NAIC said were not compromised. The cybercriminals claim to have targeted more than 100 organizations in the Oracle PeopleSoft campaign, but NAIC appears to be the first victim to publicly confirm that its data was compromised. The University of Nottingham is also reportedly a victim of the same operation, but it has not mentioned PeopleSoft in its public disclosure of the incident. Related: Kodak Admits Data Breach After ShinyHunters Hack Claims Related: More Klue Breach Victims Identified as Hackers Get Hacked

SYSTEMS What Nvidia's first Groq 3 LPU benchmarks tell us about its $20B gambleGemma 4 31B performance tests offer a best-case scenario for next-gen dataflow accelerators ON-PREM US datacenters tripled their water footprint in 10 years... and those are figures from the start of the AI boom. It can only be worse now. Silo-ed reporting isn't helping ai and ML AI slop is good for business if you know what you're doingYour irresponsibility is someone else's opportunity SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career Emperor Penguin Linus Torvalds banishes a bug – with a botThe lad himself finds and fixes a tricky one… or does he? FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan

The US National Association of Insurance Commissioners (NAIC) has suffered a security breach that has exposed US citizens’ credit rating data. The breach was detected on June 11 and the non-profit association for the US federal insurance system disclosed it to the public on June 17. In its latest update, posted on June 26, the NAIC confirmed that an unauthorized actor gained access to “a portion” of its environment through the exploitation of a zero-day vulnerability in Oracle PeopleSoft, which NAIC uses for internal financial reporting purposes. The incident was the result of “a broad campaign to exploit a vulnerability in PeopleSoft that was unknown to the developer or software users at the time, which affected multiple organizations,” the NAIC added. NAIC Confirms Data Affected and Unaffected by the Breach Once they entered the NAIC’s PeopleSoft environment, the attacker obtained information needed to gain temporary access to certain data storage areas. They then published some of the data accessed. Based on the NAIC’s preliminary findings, these include: Statutory financial reporting information that was already publicly available through state websites like InsData or resellers Credit rating agency data, including rating determinations of insurer investments “Potentially” additional storage data (e.g. routine technical information, such as outdated logs or configuration information) The NAIC said that some credit rating agencies have paused their data feeds following the incident, leading the association to temporarily suspend assigning designations to insurer investments. “Insurers should monitor [Automated Valuation Service Plus] AVS+ for any updates,” said the NAIC. Users have been notified of critical data that was not compromised by the attacker: Personal information of US insurance system users and employees Payment and financial account information, including credit card or banking information Rating agency investment rationale reports Information on any US state insurance departments’ systems Information linked to the National Insurance Producer Registry (NIPR) or the Teammate software provider Some insurance processes data, such as electronic funds transfer, risk-based capital data, policyholder information, producer data and event registration payment information Additionally, the NAIC denied the attacker’s claims that they gained access to information linked to technology provided by the NAIC, including the System for Electronic Rate and Form Filing (SERFF), Online Premium Tax for Insurance (OPTins), Uniform Certificate Authority Application (UCAA), Enterprise Data Platform (EDP) and Regulatory Data Collection (RDC). “Outside cybersecurity experts confirmed the unauthorized party did not take this information, nor compromised these regulatory reporting systems,” the NAIC stated. NAIC Operations Almost Fully Back to Normal In its update, the NAIC said it “promptly” contained the breach following detection and blocked the attacker’s access to its systems. It also engaged outside counsel and cybersecurity experts, who have helped taking additional steps to strengthen its defenses. “FBI coordination is underway,” the NAIC also noted. Finally, the association confirmed that its operations have returned to normal with the exception of online invoice payment via PeopleSoft, which is still unavailable. “We are meeting with credit rating providers and have provided third-party assurances that our systems are secure and the NAIC designation process can resume,” said the NAIC.

Commercial printing and imaging technologies company Kodak has confirmed suffering a data breach after the ShinyHunters cybercrime group claimed to have stolen information from its systems. Kodak was named on the ShinyHunters website on June 15, with the hackers claiming to have obtained more than 2.2 million records of customer personal information and other corporate data. The hackers threatened to leak the stolen data on June 18 unless the company pays a ransom. Contacted by SecurityWeek, Kodak said it’s conducting an investigation with the aid of external cybersecurity experts and promised to share additional information “as appropriate”. “Kodak recently discovered that an unauthorized third party illegally gained access to a limited amount of company data,” said a spokesperson for Kodak. “Although our investigation is ongoing, we are confident the incident was limited in scope and has been contained and that there is no threat to our systems or operations as a result of the incident,” the spokesperson added. “We have also notified law enforcement and are continuing to support their investigation.” ShinyHunters has been highly active over the past year, conducting massive data theft campaigns targeting widely used enterprise software. In a recent operation, the group reportedly targeted at least 100 organizations by exploiting a zero-day vulnerability in Oracle PeopleSoft. Related: ShinyHunters Claims Council of Europe Hack Related: University of Nottingham Confirms Breach After Hackers Leak Data Related: Hackers Leak DentaQuest Information Impacting 2.6 Million

Oracle heeft kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise PT PeopleTools (versies 8.61 en 8.62) en PeopleSoft Enterprise CS Campus Community en Student Financials (versie 9.2.38). De kwetsbaarheden in Oracle PeopleSoft Enterprise PT PeopleTools versies 8.61 en 8.62 stellen ongeauthenticeerde aanvallers met netwerktoegang via HTTP of HTTPS in staat om authenticatiecontroles te omzeilen, waardoor zij kritieke data kunnen creëren, verwijderen of wijzigen. Sommige kwetsbaarheden maken het mogelijk om volledige systeemcompromittering te bereiken, inclusief het uitvoeren van willekeurige code en het overnemen van het systeem. Daarnaast kunnen aanvallers met hoge privileges en infrastructuurtoegang volledige controle over het systeem verkrijgen. De kwetsbaarheden beïnvloeden de vertrouwelijkheid, integriteit en beschikbaarheid van het systeem. Voor PeopleSoft Enterprise CS Campus Community en Student Financials versie 9.2.38 kunnen aanvallers met lage of hoge privileges en netwerktoegang via HTTP of HTTPS eveneens kritieke data manipuleren of het systeem overnemen. De kwetsbaarheden zijn gerelateerd aan onvoldoende toegangscontrole en beïnvloeden belangrijke componenten van de PeopleSoft-omgeving.

Oracle on Tuesday announced the release of its June 2026 Critical Security Patch Update (CSPU), the second since it began releasing monthly patches. The company still releases its quarterly Critical Patch Updates, but it recently decided to supplement them with monthly patches to address more severe vulnerabilities. The software giant said the latest round of CSPU updates delivers 245 new patches, including for Communications, E-Business Suite, Enterprise Manager, Fusion Middleware, JD Edwards, MySQL, PeopleSoft, Siebel CRM, Supply Chain, Systems, and Virtualization products. [ Read: Oracle’s First Monthly Patches Resolve 77 Vulnerabilities ] Roughly 120 vulnerabilities have been assigned a ‘critical’ severity rating based on CVSS score. According to Oracle, 100 flaws can be exploited remotely without authentication. Of the total number of security holes, more than 100 were patched in Oracle Fusion Middleware, a vast majority rated ‘critical’ or ‘high’ severity. “Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches,” Oracle said in its advisory. “In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches.” However, the company has not mentioned the exploitation of zero-day vulnerabilities. Security firms recently reported seeing the ShinyHunters cybercrime group exploiting an Oracle PeopleSoft flaw tracked as CVE-2026-35273. The attacks reportedly targeted at least 100 organizations, many in the education sector. Oracle has urged users to patch the vulnerability, but its public documentation does not explicitly confirm in-the-wild exploitation. Even the June CSPU advisory mentions CVE-2026-35273, but it does not include any information about active exploitation. Related: Oracle WebLogic Vulnerability Exploited in the Wild Related: Joomla, LiteSpeed Vulnerabilities Exploited in Attacks Related: 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs Related: Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks

iRhythm, a health company specializing in wearable cardiac monitoring technology, has been targeted in a cyberattack that resulted in the theft of information. The data breach was disclosed by iRhythm, known for its Zio wearable ECG monitor, in a Monday filing with the SEC. The company said it detected “unauthorized activity involving data maintained on certain third-party-hosted business applications” on June 8. iRhythm noted that the attack involved social engineering, but the targeted application has not been named. A threat actor contacted the company on June 9, claiming to have stolen sensitive information, including proprietary data and patients’ protected health information. The hackers demanded a ransom to prevent the compromised files from being leaked. iRhythm has been working with external cybersecurity experts to investigate the breach, and it has confirmed that some data has been stolen, but it has not said whether the threat actor’s description of the compromised data is accurate. The medical device vendor is still working on determining how many individuals are affected, as well as what type and how much data was stolen. The company said its products, clinical or medical device systems, manufacturing and distribution operations, patient safety, and financial reporting systems were not impacted. “The incident does not involve the Company’s clinical or medical device systems or connections to customers and the Company does not store or retain individual financial account information or payment card information,” it noted in its SEC filing. No known ransomware or extortion group appears to have taken credit for the attack on iRhythm. It’s unclear whether the company has agreed to pay a ransom or engaged with the hackers. SecurityWeek has reached out to iRhythm for additional information and will update this article if it responds. Related: Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters Related: Cybercrime Group Claims Novo Nordisk Hack Related: French Government Messaging Platform Breached by Mysterious ‘Misere’ Hacker Related: ShinyHunters Claims Council of Europe Hack

DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

Week in review: Exploited Check Point VPN zero-day, Oracle PeopleSoft servers under attack Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: DockSec: Open-source AI-powered Docker security scanner DockSec is an OWASP Incubator Project that combines three container security scanners with a language-model layer for explanation and remediation. Created by Advait Patel, the Python tool runs Trivy, Hadolint, and Docker Scout against a developer’s Dockerfile and image, correlates the findings, returns a 0-100 security score, and proposes line-specific fixes. Treating AI agents like service accounts for federated query security In this interview with Help Net Security, Paras Malhotra, CISO at Starburst, explains how the company handles data governance across federated query environments. Topics include layering Starburst’s access controls above native source permissions, tiering vendor risk across more than 200 partners and connectors, and building audit trails for autonomous agents. NOVA microhypervisor brings AMD DMA isolation to shared AI infrastructure BlueRock has issued the latest open-source release of its NOVA Microhypervisor with DMA remapping support for AMD platforms that have IOMMU hardware virtualization. The capability is enabled by default and extends hardware-level isolation across virtual machines, devices, and memory in shared execution environments. The security in smartphones is helping send them to landfills The WEEE Forum estimated that 5.3 billion mobile phones became electronic waste in 2022. Many of these devices still function. The average smartphone stays in use for about three years, and owners often replace handsets that retain enough computing power for other jobs. A team at the Université Libre de Bruxelles examined a barrier to giving those devices a second life. Every set of AI guardrails can be broken by the right prompt AI companies use guardrails to block harmful outputs such as deepfakes, malware, and instructions for biological weapons or illicit drugs. A new mathematical proof by Apostol Vassilev, a senior scientist at NIST, suggests those protections have inherent limits. For any finite set of guardrails, there exists a prompt that can bypass them if discovered. NOVA microhypervisor brings AMD DMA isolation to shared AI infrastructure BlueRock has issued the latest open-source release of its NOVA Microhypervisor with DMA remapping support for AMD platforms that have IOMMU hardware virtualization. The capability is enabled by default and extends hardware-level isolation across virtual machines, devices, and memory in shared execution environments. The security in smartphones is helping send them to landfills Billions of working smartphones reach the end of their service lives each year and move into drawers, recycling streams, and waste piles. The WEEE Forum estimated that 5.3 billion mobile phones became electronic waste in 2022. Many of these devices still function. The average smartphone stays in use for about three years, and owners often replace handsets that retain enough computing power for other jobs. A team at the Université Libre de Bruxelles examined a barrier to giving those devices a second life. Every set of AI guardrails can be broken by the right prompt Companies that build AI systems wrap them in guardrails meant to block harmful output, including deepfakes, malware, and instructions for making biological weapons or illicit drugs. When a user prompts the system for such content, the guardrails are designed to flag the request and refuse. A new mathematical proof sets a limit on how secure those guardrails can ever be. CISA orders federal agencies to “patch smarter” The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a Binding Operational Directive that will change how the US federal government approaches vulnerability management. How to use NIST and ISO frameworks to govern AI agents Security leaders no longer need convincing that AI agents introduce risk. What’s missing is how to govern them once they move into production and begin operating autonomously across enterprise environments. CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318) A vulnerability (CVE-2026-28318) that can be exploited to crash SolarWinds Serv-U file transfer servers is being leveraged by attackers in the wild, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Friday. The agency has ordered US federal civilian agencies to address it by June 19, 2026, either by implementing a patch or implementing mitigations. Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751) A Qilin ransomware affiliate is believed to be exploiting CVE-2026-50751, an authentication bypass vulnerability in Check Point VPN Remote Access and Mobile Access, the company announced on Monday. Check Point Remote Access VPN enables and secures connections between corporate networks and remote or mobile devices. LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271) A command injection vulnerability (CVE-2026-42271) in BerryAI’s LiteLLM open-source AI gateway is being exploited by attackers, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed by adding the flaw to its Known Exploited Vulnerabilities catalog on Monday. Record Microsoft Patch Tuesday, fresh zero-day Microsoft marked its largest-ever Patch Tuesday this month, by shipping fixes for nearly 200 vulnerabilities. Within hours, “Nightmare Eclipse”, the researcher behind weeks of escalating Windows exploit releases, dropped a proof-of-concept exploit for a new zero-day: “RoguePlanet”, which abuses a race condition in Windows Defender to spawn a command shell running with SYSTEM-level privileges. Critical Ivanti Sentry flaw allows root-level remote code execution (CVE-2026-10520) Ivanti has patched two critical vulnerabilities (CVE-2026-10520 and CVE-2026-10523) in Ivanti Sentry and has urged customers to implement the fix right away. Though the vulnerabilities are not known to be actively exploited, security researchers have already released technical details about the former, which may be used by attackers to craft a working exploit. Oracle PeopleSoft servers under attack, Oracle pushes out-of-band security alert A zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft PeopleTools is being exploited in the wild, Charles Carmakal, CTO at cybersecurity firm Mandiant, part of Google Cloud, warned today. The architecture of subtraction: Why it’s time to erase the roads, not just map the traffic AI-assisted vulnerability discovery and exploit development are making patching increasingly inadequate as a primary defense. Advanced AI models can shrink the time from vulnerability discovery to exploitation from months to hours, while organizations struggle to patch systems as quickly as new flaws are identified. Product showcase: Staying ahead of the threat horizon with Aunoo Aunoo is an open strategic intelligence platform that uses AI agents to monitor intelligence sources, including for cybersecurity, to compile a daily briefing and alert on defined criteria. Each source is checked for credibility and quality before it is included. The platform runs in any browser and can send its findings via Slack, Discord, Teams, email or using the internal chat. When attacks spread too far: Lessons from real cyber attack case studies In this Help Net Security video, Michael Adjei, Director, Systems Engineering at Illumio, explains three real world cyber attacks and what went wrong during detection. Cyber resilience metrics that drive action In this Help Net Security video, Pete Bowers, COO at NormCyber, explains how organizations can build a cyber resilience metrics program that supports better decisions. He questions common ways of measuring resilience, such as risk registers, tool scores, and annual tests, and points out their limits. GitHub Copilot app launches as desktop home for AI coding agents GitHub introduced the Copilot app, a desktop application built for working with AI coding agents, at Microsoft Build 2026. The release expands GitHub’s Copilot product line beyond editor integrations and command-line tools into a dedicated workspace for directing several agents at once. Cybercriminals create 19,000 FIFA-themed domains ahead of 2026 World Cup The 2026 FIFA World Cup will bring millions of visitors and an estimated 6 billion spectators to a tournament spread across 16 host cities in the United States, Canada and Mexico. In a new report, Intel 471 describes the 2026 FIFA World Cup as “the largest and most complex cyberattack surface in sporting history.” Hackers used Meta’s AI support system to hijack over 20,000 Instagram accounts Meta has revealed that attackers hijacked 20,225 Instagram accounts by exploiting a flaw in the company’s AI-assisted account recovery system. According to the company, a vulnerability in High Touch Support (HTS) allowed unauthorized parties to perform password resets on Instagram accounts. Microsoft changes how Defender for Endpoint EDR updates are delivered on Windows Microsoft will distribute Defender for Endpoint EDR updates through Microsoft Update, enabling EDR security improvements to be released independently of monthly Windows operating system updates. The rollout started for Windows 10 devices in late May 2026 and will expand to Windows 11 and other supported Windows versions later this year. Microsoft expects deployment to be completed by fall 2026. Meta claims NSO Group still targets WhatsApp users despite court order Meta claims it disrupted spear-phishing attempts linked to NSO Group and is asking a US federal court to hold the spyware vendor in contempt for allegedly violating an injunction that bars it from targeting WhatsApp and its users. Mythos Preview can weaponize N-day vulnerabilities in hours Mythos Preview can develop working exploits from newly disclosed software vulnerabilities in hours, cutting down a process that has historically taken days or weeks, according to Anthropic. Google patches Chrome zero-day exploited in the wild (CVE-2026-11645) Google has fixed 74 vulnerabilities in Chrome, including a high-severity zero-day (CVE-2026-11645) that has been exploited in the wild. The fix has been shipped in Chrome 149.0.7827.102/.103 for Windows and macOS and Chrome 149.0.7827.102 for Linux, with the update rolling out to users over the coming days and weeks. French government messaging platform breached through account hijacking French authorities are investigating a compromise of Tchap, the government’s secure messaging platform, after hackers hijacked a user account and gained access to public chat rooms. Anthropic’s Claude Fable 5 is out for public use, with safeguards for high-risk requests Days after publishing research on how advanced AI systems could amplify cyber operations in the wrong hands, Anthropic released Claude Fable 5, a Mythos-class model for general use. The company said Mythos-class models possess advanced cybersecurity and research biology capabilities that can provide information and guidance beyond what is typically available through conventional online sources. New Browser-in-the-Browser phishing uses fake login popups to steal Microsoft 365 credentials A new Browser-in-the-Browser (BitB) phishing campaign is targeting Microsoft 365 users with fake login popups designed to closely mimic legitimate browser authentication windows, according to Palo Alto Networks Unit 42. Identity theft is turning into a chain reaction for victims For a growing number of victims, identity theft no longer ends with a fraudulent charge or a compromised account. More than one in four people who contacted the Identity Theft Resource Center during the reporting period were dealing with multiple identity-related incidents, according to the organization’s 2026 Trends in Identity Report. X Square Robot open sources its robot-free data collection framework Companies building robots for physical work spend large amounts of time and money operating machines by hand to gather training examples. Each session with a physical robot produces a small number of demonstrations per day, which slows the growth of datasets used to train embodied AI. Human demonstrators offer a cheaper source of data, and X Square Robot has put a system for this approach into public release. Making the cloud prove it followed your privacy wishes Companies that store personal data in cloud key-value databases should handle deletion requests by running the operation and confirming the job is complete. The people making those requests and the regulators overseeing them have had limited means to confirm the data is gone or that the record of its removal is genuine. GDPRuler, a middleware system from researchers at the Technical University of Munich and the University of Lisbon, sits between an application and an unmodified key-value database and enforces privacy rules as data passes through it. 9 out of 10 people can no longer distinguish real from AI-generated content Online fraud is becoming harder to distinguish from legitimate activity as AI-generated messages, voices, photos, reviews, and identities become more convincing. Nearly nine in ten adults say they can no longer tell what is real from AI-generated content, according to the latest Malwarebytes survey. The share increased from 66% in 2025 to 85% in 2026. FBI seizes 13 websites linked to alleged Chinese intelligence-gathering effort Federal authorities have seized 13 internet domains allegedly used to target current and former U.S. government employees and military personnel with access to classified and sensitive information. 52% of direct-to-IP threats are missing from intelligence feeds Security tools are good at inspecting websites, domains, URLs, and files, so attackers are moving lower in the stack and communicating directly with IP addresses, where visibility is limited. According to Palo Alto Networks’ report, this creates a visibility gap that allows malicious traffic to blend into normal internet activity and evade detection. Google Colab CLI opens runtimes to Claude Code and Codex Google released the Google Colab Command-Line Interface, a tool that connects local terminals to remote Colab runtimes. The CLI provides an execution platform for developers and AI agents, letting users provision compute, run local Python scripts on remote runtimes, and retrieve artifacts back to local machines. OpenAI is locking down parts of ChatGPT to reduce data theft risks OpenAI has started rolling out Lockdown Mode for ChatGPT, an optional security setting that restricts access to external resources and several product capabilities. It is available for personal accounts, including Free, Go, Plus, and Pro plans, as well as self-serve ChatGPT Business accounts. Samsung just made Galaxy phones more secure in One UI 9 beta Samsung’s One UI 9 beta integrates Lockdown mode into the power menu. This is the screen that contains Power off, Restart, and emergency options. Opening it initiates Lockdown mode, disabling biometric authentication. The security questions around Chinese AI coding models in U.S. software Software developers across the United States are using AI models built in China to write, debug, and review code, drawn by prices below those of American alternatives. These models carry risks for the security of American software, according to a report from Booz Allen Hamilton, which tested how the models respond when the user appears to work for the U.S. government. Malware ships with bugs that defenders could use against it Static analysis tools have spent years scanning legitimate software for security bugs before it goes out the door. The same scanners work on malware, and malware carries a steady supply of its own bugs. Researchers ran four of these tools across 658 leaked malware projects and found that close to 90 percent contained at least one recognized software weakness. Apple expands what parents can block, approve, and limit Apple has previewed a set of new child safety features coming to iPhone, iPad, and the Mac later this year, expanding parental controls with tools that help families manage app access, web browsing, communication, and screen time. Apple Intelligence can now replace weak passwords without user intervention Apple’s next generation of Apple Intelligence, the company’s personal intelligence system, expands its capabilities and introduces new security features in Passwords. With the new update, Passwords can automatically replace weak or compromised passwords. Scams now operate like real businesses with budgets and targets Social media has overtaken email as a primary attack vector, showing changes in how people consume information and interact online, according to Bitdefender’s Global Scam Intelligence Report 2026. Fraud campaigns use advertisements, sponsored content, impersonation pages, and direct messages to reach users. Apple extends Private Cloud Compute to third-party data centers Apple is bringing its Private Cloud Compute (PCC) platform to Google Cloud, expanding the infrastructure behind Apple Intelligence to third-party data centers. Introduced in 2024, PCC provides cloud-based processing for AI workloads that exceed the capabilities of on-device models while maintaining Apple’s security and privacy guarantees. Building reusable workflows with custom agents in Copilot CLI Developers spend much of their working time in the terminal, generating commands, debugging issues, and running scripts close to their systems. Repeated terminal work tends to pile up small steps such as re-running the same commands, re-explaining context, and translating logs into a form a team can act on. Custom agents in GitHub Copilot CLI address these patterns by turning repeated tasks into reusable workflows. Organizations can’t see much of their mobile AI activity Organizations have limited visibility into AI activity on mobile devices despite security leaders expressing confidence in their AI governance, according to Lookout’s “Solving for the Mobile AI Blind Spot: Executive Confidence Meets Technical Reality” report. Prompt injection still drives most agentic AI security failures in production A backdoor sat on PyPI for three hours in March 2026. Nearly 47,000 downloads occurred during the window. The compromised package, LiteLLM, serves as the language-model gateway for CrewAI, DSPy, Microsoft GraphRAG, and dozens of other AI agent frameworks. Anyone pulling an update during that window pulled in an autonomous attack bot named hackerbot-claw along with it. Threat actors are recruiting the people who hold cloud logins Companies keep most of their data and applications in cloud platforms that anyone can reach with the right login. That setup turns each employee holding those credentials into a security variable, and members of the cybercrime underground have built methods to reach those people. Intel 471 tracked this activity into 2026 and sorted insider risk into three categories that cloud-reliant organizations contend with. Fake Spotify Premium tutorials on TikTok and Instagram Reels spread malware Cybercriminals are using TikTok and Instagram Reels videos to spread Vidar, an infostealer malware, through fake downloads for popular paid software, according to ReversingLabs. The researchers uncovered two campaigns behind the activity, each using a different approach to draw in viewers before sending them to external download sites. Google sues China-based scammers over Gemini AI abuse Google has filed a lawsuit against Outsider Enterprise, a China-based cybercrime network for using AI tools, including Gemini, to build phishing websites and scam infrastructure. Cybercriminals are moving away from mass phishing campaigns Phishing activity declined by roughly 20% in both 2024 and 2025, according to research from Zscaler’s ThreatLabz team. The drop followed years of growth that pushed phishing activity above 2 billion hits in 2023. Authorities dismantle crypto laundering service that moved €336 million for cybercriminals An international law enforcement operation has dismantled a cryptocurrency laundering service linked to ransomware groups and other cybercriminals that processed more than €336 million in illicit funds. Cybersecurity jobs available right now: June 9, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: June 12, 2026 Here’s a look at the most interesting products from the past week, featuring releases from AISLE, Drata, Elastic, Filigran, IDnow, and Ridge Security.

The US Cybersecurity and Infrastructure Security Agency (CISA) flagged a recently patched Ivanti Sentry vulnerability as exploited, but Ivanti says the activity was observed only on honeypots. Tracked as CVE-2026-10520 (CVSS score of 10/10), the security defect is described as an OS command injection issue that could be exploited remotely, without authentication, to execute arbitrary code with root privileges. Ivanti rolled out patches for the flaw on June 10, saying it has no evidence of in-the-wild exploitation. Ivanti Sentry versions 10.5.2, 10.6.2, and 10.7.1 contain the fixes. On Thursday, CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to address it within three days, in line with BOD 26-04 guidance to prioritize patching based on risk. “This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors,” CISA notes. Ivanti has updated its advisory to reflect the CVE’s addition to CISA’s KEV list, but pointed out that it was based on “attempted exploitation of honeypots”. “It is important for customers to know that exploitation of CVE-2026-10520 requires access to the management port (8443). Management interfaces should never be exposed to the internet, though honeypots often have misconfigurations to identify malicious behavior,” Ivanti says. The company also underlines that, despite the vulnerability’s CVSS score, the risk it poses is significantly decreased based on deployment and configuration. Ivanti’s note, which is mirrored in CISA’s KEV entry, explains that the vulnerable APIs are protected by mTLS for EPMM-managed Sentry appliances, and that unmanaged Sentry instances cannot be used in production, “as the management is what pushes the configuration for device connectivity and authentication”. For Neurons for MDM-managed Sentry appliances, the company recommends restricting internet access to the vulnerable API, regardless of deployment. Related: Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters Related: Alert Fatigue Is Becoming a Security Threat of Its Own Related: Splunk, Palo Alto Networks Patch Severe Vulnerabilities

Oracle heeft een kwetsbaarheid verholpen in Oracle PeopleSoft Enterprise PeopleTools versies 8.61 en 8.62. De kwetsbaarheid maakt het mogelijk voor ongeauthenticeerde aanvallers om het systeem op afstand via HTTP te misbruiken. Hierdoor kan remote code execution plaatsvinden, wat kan leiden tot volledige overname van het systeem. De kwetsbaarheid treft Oracle PeopleSoft Enterprise PeopleTools en is met name misbruikbaar wanneer de PeopleSoft Environment Management Hub (PSEMHUB) vanaf het internet bereikbaar is. Het is gebruikelijk om dergelijke beheercomponenten uitsluitend via interne netwerken of een VPN toegankelijk te maken. Google CTI laat weten dat deze kwetsbaarheid al zeker sinds 27 mei als zeroday is misbruikt.

Google has confirmed that a PeopleSoft vulnerability mitigated by Oracle this week has been exploited by ShinyHunters as a zero-day to steal data from organizations. Oracle has released an out-of-band advisory and security alert for CVE-2026-35273, a critical unauthenticated remote code execution vulnerability impacting PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, as well as PeopleSoft Enterprise Applications. The software giant has released mitigations, but patches do not appear to be available. PeopleSoft is an ERP software suite used by many large organizations to manage a wide range of business functions, including HR, payroll, finance, supply chain, and campus operations. While the solution is used across many industries, the ShinyHunters campaign exploiting CVE-2026-35273 appears to have focused on the education sector. The University of Nottingham in the UK is the first confirmed victim. Mandiant and Google Threat Intelligence Group (GTIG) reported observing activity associated with the exploitation of the PeopleSoft zero-day between May 27 and June 9. The attacks have been attributed to ShinyHunters, which Google tracks as UNC6240. Google’s researchers notified more than 100 global organizations of potential exposure, the majority of which are based in the US, with 68% in the higher education sector. The tech giant said some of the targets blocked the attack, but others had their systems compromised and data stolen. ShinyHunters claims to have targeted roughly 300 PeopleSoft instances belonging to 100 organizations. “The attacker staging environments hosted customized MeshCentral agents masquerading as legitimate cloud endpoints, which they used to run administrative command queries and deploy a custom lateral movement and defacement script, [victim_abbreviation]_fanout.sh,” Mandiant and GTIG explained. “This campaign directly correlates with subsequent data leaks of stolen organization data published on the ShinyHunters Data Leak Site (DLS) on June 9, 2026.” Google has shared remediation and hardening recommendations, as well as technical details on the attacks and indicators of compromise (IoCs). Oracle has not responded to SecurityWeek’s inquiry regarding exploitation. TrendAI (Trend Micro’s enterprise business), whose researchers have been credited by Oracle for reporting CVE-2026-35273, told SecurityWeek that it’s currently seeing limited exploitation of the vulnerability, but its investigation is ongoing. Related: CISA Directs Federal Agencies to Prioritize Security Patches Based on Risk Related: Hackers Exploit Langflow Vulnerability for Remote Code Execution

The ShinyHunters extortion crew exploited an unpatched flaw in Oracle PeopleSoft to break into enterprise systems, steal data, and demand payment to keep it private. The campaign hit universities hardest. Google's Mandiant attributes it to the group it tracks as UNC6240, and dates the activity between May 27 and June 9. Oracle did not publish its advisory until June 10, so the bug was a zero-day the entire time. The flaw, CVE-2026-35273, is a remote code execution bug in PeopleSoft Enterprise PeopleTools rated 9.8 out of 10. It needs no login and no user interaction, just network access over HTTP, to take over the server. If you run PeopleSoft with the Environment Management Hub reachable from outside, that is your exposure, and the immediate move is to lock those endpoints down. The vulnerability sits in the Updates Environment Management component, the piece behind the Environment Management Hub (PSEMHUB). Oracle lists PeopleTools 8.61 and 8.62 as affected and says earlier, unsupported versions are probably vulnerable too. It credits researchers from TrendAI Zero Day Initiative and TrendAI Research for the report. Mandiant CTO Charles Carmakal confirmed the bug is being exploited in the wild; Oracle has not said whether it has seen exploitation. Its advisory points to a patch availability document behind a support login, and whether a full fix is broadly available is unclear. For now, the guidance centers on mitigation. The operational detail became public because the attackers left their own gear exposed. Researcher @nahamike01 publicly flagged the open directories. Mandiant then triaged five sequential IP addresses running Python's SimpleHTTP server on port 8888. Those servers exposed the staging files: a shared .bash_history, custom MeshCentral remote-management agents disguised as Microsoft Azure binaries, and a lateral-movement script. The agents called home to a command-and-control server at azurenetfiles.net, a domain picked to look like Azure NetApp Files. The script, named [victim]_fanout.sh, spreads over SSH by spraying a hardcoded list of usernames and passwords against internal hosts pulled from /etc/hosts, then drops a marker file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT into PeopleSoft directories. The command history shows the data compressed with zstd and an outbound SSH connection to the server hosting the public mirror of the ShinyHunters leak site. Mandiant notified more than 100 organizations whose IP addresses matched vulnerable endpoints. Sixty-eight percent were in higher education, most of them in the United States. Some blocked the activity; others were compromised and had data posted to the leak site. The University of Nottingham is one of the first confirmed victims. Have I Been Pwned has counted about 455,000 unique email addresses in the leaked set, covering current students and alumni, with names, addresses, phone numbers, passport numbers, and details on ethnicity and disabilities. The university has confirmed the breach. Oracle's guidance is to disable the Environment Management Hub service on multi-server setups, or remove the PSEMHUB application outright on single-server setups. If you cannot do either, block external access to /PSEMHUB/* (especially /PSEMHUB/hub) and /PSIGW/HttpListeningConnector at the perimeter. Mandiant warns that WAF body-inspection rules alone are not enough, since they can be bypassed. Restricting these endpoints does not break normal user sessions. Then hunt for signs of an existing compromise: WebLogic access logs showing external POST requests to /PSEMHUB/hub or /PSIGW/HttpListeningConnector. Unexpected .jsp files under the PSEMHUB.war web application directory, or odd folders named logs, persistantstorage, or scratchpad under the PSEMHUB paths. Recently changed .xml files under the web doc root's envmetadata/data/environment, which can be abused for XMLDecoder persistence that fires on the next restart. Outbound SMB traffic on port 445 from PeopleSoft hosts to external destinations, which the exploit chain may use to capture machine-account NetNTLM hashes. Apply Oracle's update for your PeopleTools version once you confirm it is available in My Oracle Support. ShinyHunters says victim outreach has only just started, and it has not posted most of the organizations it claims, so more names are likely. The method is the bigger tell. ShinyHunters has lately leaned on vishing, stolen tokens, and weak access controls to steal data from SaaS and education platforms, from Salesforce customers to Canvas. A server-side zero-day in on-premises ERP software is a step up from that, aimed at the same data-rich targets. The open question is whether this was a one-off borrowed zero-day or the start of ShinyHunters moving into ERP exploitation.

Oracle is warning about a critical PeopleSoft Suite zero-day vulnerability tracked as CVE-2026-35273 that allows unauthenticated remote code execution, with the flaw actively exploited in ShinyHunter data theft attacks. The flaw is within Oracle PeopleSoft PeopleTools and has a CVSS base score of 9.8. "This Security Alert addresses vulnerability CVE-2026-35273 in Oracle PeopleSoft PeopleTools. Oracle PeopleSoft Enterprise Applications customers may also be affected by this vulnerability," reads a new Oracle advisory. "This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution." Oracle has confirmed that the zero-day vulnerability affects PeopleSoft Enterprise PeopleTools, versions 8.61 and 8.62, and has released emergency mitigations to address the flaw, with a patch coming soon. Zero-day exploited in ShinyHunter data theft attacks While Oracle has not stated that this vulnerability is actively exploited, its disclosure comes after BleepingComputer first reported that the ShinyHunters extortion gang was exploiting a PeopleSoft zero-day vulnerability to breach instances and steal data. BleepingComputer has since learned that this is the zero-day exploited in the attacks. On Tuesday, BleepingComputer learned that Oracle PeopleSoft was targeted in a wave of data theft attacks that left ransom notes purportedly from the ShinyHunters extortion gang. ShinyHunters is a well-known threat actor that commonly breaches cloud SaaS instances, CRMs, and enterprise platforms that host large volumes of corporate data. After gaining access to an instance, they will download the data and demand a ransom to prevent its public leak. The group has been linked to numerous high-profile attacks targeting SnowFlake, Salesforce, and third-party integration providers over the past year. ShinyHunters confirmed to BleepingComputer that they are behind these attacks, claiming to use a "gadget chain" of old and zero-day flaws to breach PeopleSoft instances. Using this flaw, the threat actor allegedly stole data from 300 instances for over 100 organizations. Cybersecurity researcher "Michael R" found several exposed online directories containing attack-related tooling and shared the following IP addresses used in the attacks. 142.11.200[.]186 142.11.200[.]187 142.11.200[.]188 142.11.200[.]189 142.11.200[.]190 108.174.202[.]99 176.120.22[.]24 Targeting the education sector Mandiant released a report confirming that threat actors exploited the Oracle PeopleSoft CVE-2026-35273 vulnerability as a zero-day, primarily targeting organizations in the education sector. "Upon becoming aware of active scanning and exploitation, we initiated notifications to over 100 global organizations whose IP addresses correlated with potentially vulnerable endpoints," Mandiant reported. "Most of these organizations were based in the United States, and 68 percent operated within the higher education sector." Mandiant's report also shared additional technical details about the attacks, saying the threat actors used the exposed staging servers to host HTTP services and utilized custom MeshCentral remote management agents to communicate with attacker-controlled infrastructure masquerading as Microsoft Azure services. The researchers said the threat actors conducted reconnaissance on compromised instances, mapped PeopleSoft and WebLogic configurations, and used scripts to laterally move across internal systems using stolen or hardcoded credentials. Mandiant also said the attackers compressed exfiltrated data and ultimately connected to a server at 176.120.22.24, which is associated with the public ShinyHunters data leak site, helping link the activity to the extortion group. As part of its guidance, Mandiant advised organizations to restrict access to vulnerable PeopleSoft endpoints, review logs for suspicious requests targeting /PSEMHUB/ and /PSIGW/HttpListeningConnector, and inspect servers for signs of compromise, including: Unexpected .jsp webshell files in WebLogic application directories Unauthorized files or binaries staged in PSEMHUB transaction folders Suspicious directories such as logs, persistantstorage, or scratchpad Recently modified XML files that could be used to maintain persistence or trigger remote code execution after a restart ShinyHunters recently targeted the education sector in a massive cyberattack on Instructure Canvas that allowed them to steal 280 million data records for students, teachers, and staff. Instructure later paid a ransom to prevent the leaking of the stolen data. BleepingComputer has reached out to Oracle with questions about the vulnerability and the attacks but has not received a response. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

Oracle on Thursday released an out-of-band advisory addressing a PeopleSoft vulnerability that can be exploited by an unauthenticated attacker for remote code execution. The security alert comes amid reports that the notorious ShinyHunters hacker group has been targeting organizations that use PeopleSoft. PeopleSoft is an integrated enterprise resource planning (ERP) software suite widely used by large organizations for managing core business functions, including HR, payroll, finance, supply chain, and campus operations. The newly disclosed vulnerability is tracked as CVE-2026-35273, and Oracle says it’s a critical issue that affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. PeopleSoft Enterprise Applications users could also be impacted. It appears that only mitigations have been released by Oracle rather than a full patch. Oracle has not said whether CVE-2026-35273 has been exploited in the wild as a zero-day, but noted in its advisory, “We consider implementation of the recommended mitigations to be a high-priority risk reduction measure and strongly recommend immediate action to address the identified exposure.” Bleeping Computer and TechCrunch learned from hackers claiming to be affiliated with the ShinyHunters group that they targeted 300 PeopleSoft instances belonging to more than 100 organizations. The hackers claimed to have chained old and zero-day vulnerabilities to gain access to data stored in the targeted PeopleSoft environments. The attacks appear to have been confirmed by a researcher, and Mandiant CTO Charles Carmakal has warned about zero-day exploitation. It’s not surprising that ShinyHunters would target software widely used by major enterprises to steal data that could later be used to extort victims. The cybercriminals previously targeted Salesforce customers in a massive data-theft campaign. Bleeping Computer reported that the education sector was hit the hardest, and the University of Nottingham is one of the victims. The university has confirmed that it suffered a significant data breach. While Oracle’s advisory does not mention exploitation, it’s not uncommon for the company to omit confirming in-the-wild attacks in its public documentation. SecurityWeek reached out to Oracle for comment, but the company has not responded by the time of writing. TrendAI researchers have been credited by Oracle for reporting the vulnerability. Dustin Childs, Head of Threat Awareness at TrendAI’s Zero Day Initiative, told SecurityWeek, “Currently, we’re seeing limited exploitation, but our investigation is ongoing.” The news comes shortly after CISA warned of a 2024 Oracle WebLogic vulnerability being exploited in the wild. *updated with comments from Dustin Childs Related: Microsoft Patches Exploited Exchange Server Vulnerability Related: Oracle’s First Monthly Patches Resolve 77 Vulnerabilities Related: Oracle EBS Hack: Only 4 Corporate Giants Still Silent on Potential Impact

Oracle PeopleSoft servers under attack, Oracle pushes out-of-band security alert A zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft PeopleTools is being exploited in the wild, Charles Carmakal, CTO at cybersecurity firm Mandiant, part of Google Cloud, warned today. The warning comes a day after Oracle published an out-of-band security alert about the flaw, which is remotely exploitable without authentication, may result in remote code execution, and affects PeopleSoft PeopleTools versions 8.61 and 8.62 (and possibly earlier, unsupported ones as well). Oracle credited researchers with TrendAI Zero Day Initiative and TrendAI Research for reporting the vulnerability. The security alert links to a “patch availability document”, but it is unclear whether a patch is currently available, as the document is accessible only to customers with a support account. Help Net Security has reached out to Oracle for confirmation on whether CVE-2026-35273 is being actively exploited, but we’ve yet to receive a reply. ShinyHunters targeting PeopleSoft instances Oracle’s alert was published on the same day that Bleeping Computer reported ShinyHunters’ claims that they’ve been breaching Oracle PeopleSoft servers and have stolen data from 100+ organizations. According to the extortion group’s claims, the targeted organizations are mostly educational institutions, and their PeopleSoft instances – whether on-premises or in the cloud – were breached “using a ‘gadget chain’ of old and zero-day vulnerabilities.” Among the victims is apparently the University of Nottingham, which confirmed it has suffered a cybersecurity incident and that it has notified affected students and alumni directly. ShinyHunters claimed that breach and leaked tens of gigabytes of stolen data, including personal data and academic records of nearly half a million current and former students. A threat researcher seemingly confirmed ShinyHunters’ ongoing targeting of PeopleSoft instances, after discovering exposed directories containing tools used in these attacks. “At the /pay_or_leak endpoint, is stolen data from 20+ organizations, many named and others from 02 Jun and 04 Jun not yet named. Inside the same bash history log is a purpose-built shell script (uon_fanout.sh) which spreads defacement markers across PeopleSoft infrastructure,” the researcher noted. “The code shows the attackers are very familiar with PeopleSoft; extracting creds from psappsrv.cfg (app server config), mapping all connected nodes, and identifying web/app/batch tiers.” The researcher also posted a list of IPs and domains related to the attacks, which can be used by PeopleSoft admins and defenders to check for signs of compromise. UPDATE (June 11, 2026, 05:15 p.m. ET): Mandiant and Google Threat Intelligence Group have confirmed that ShinyHunters (i.e., UNC6240) have been targeting Oracle PeopleSoft application infrastructure between May 27, 2026 and June 9, 2026, and the activity “is consistent” with the exploitation of CVE-2026-35273. “The exploitation of this vulnerability directly aligns with the observed targeting of Environment Management Hub (PSEMHUB) endpoints. Because this activity predates Oracle’s June 10, 2026 advisory, the vulnerability was exploited as a zero-day,” they said, and revealed that they notified over 100 global organizations with potentially vulnerable endpoints. “While several organizations successfully blocked the activity or remediated the vulnerabilities, others experienced compromise, resulting in stolen data being published on the ShinyHunters [data leaks site],” the researchers shared. They detailed the actions performed and tools used by the attackers, and provided remediation and hardening advice. Though there’s still no mention of a patch for CVE-2026-35273, there are mitigations PeopleSoft admins can implement to minimize the risk of exploitation. They can disable the Environment Management Hub (EMHub) Service in Multi-Server configurations, remove the PSEMHUB application in Single-Server configurations or, if they cannot disable the EMHub Service, they can block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the network perimeter or firewall level. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Rilevata vulnerabilità in Oracle Alert AL02/260611/CSIRT-ITA Sintesi Rilevata una nuova vulnerabilità con gravità “critica” nel prodotto Oracle PeopleSoft Enterprise PeopleTools, piattaforma utilizzata per lo sviluppo e l’esecuzione delle applicazioni PeopleSoft. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi interessati. Tipologia Remote Code Execution Prodotti e/o versioni affette Oracle PeopleSoft Enterprise PeopleTools versione 8.61 versione 8.62 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti.

Oracle PeopleSoft servers are being targeted in ongoing data theft attacks by the ShinyHunters extortion gang, which claims to have stolen data from over 100 organizations. PeopleSoft is an enterprise business software suite used by large organizations to manage business operations such as human resources, payroll, finance, supply chain management, procurement, and student administration. Yesterday, BleepingComputer learned of widespread data theft attacks targeting both cloud and on-premises Oracle PeopleSoft customer instances.These customers were receiving extortion demands that were signed by the ShinyHunters extortion gang. Today, the threat actor confirmed to BleepingComputer that they were behind the attacks, claiming to have stolen data from 300 instances across more than 100 organizations. ShinyHunters says they are using a "gadget chain" of old and zero-day vulnerabilities to conduct the attacks. However, they state that their attack is not working on all systems and believe that exploitation success may depend on how an instance is configured. BleepingComputer contacted Oracle this morning to ask whether it is aware of an Oracle PeopleSoft zero-day being exploited in data theft attacks, but had not received a reply at this time. According to the threat actor, most of the organizations impacted by these attacks are in the education sector, with many previously extorted by the threat actor. They claim their initial goal was to breach an FBI portal running PeopleSoft to "publish a statement and set the record straight on some misinsformation that has been spreading." However, they said their attack was not successful, and they were unable to gain access to the instance. The threat actor told BleepingComputer that Nottingham University is a victim of these attacks, and that its data has already been published on the ShinyHunters data leak site. The University also released a statement today, acknowledging that it suffered a cybersecurity incident. While Oracle has not publicly disclosed any information about these attacks, cybersecurity researcher "Michael R" found several exposed online directories containing tooling related to this attack. "ShinyHunters, (or a group impersonating them) exposed several directories revealing ongoing targeting of PeopleSoft (Enterprise Resource Planning software) environments," the researcher posted. "Also visible were staging materials, including MeshCentral agents, and a defacement and credential spray script." The researcher shared the following IP addresses as IOCs related to these attacks: 142.11.200[.]186 142.11.200[.]187 142.11.200[.]188 142.11.200[.]189 142.11.200[.]190 108.174.202[.]99 176.120.22[.]24 Some of these IP addresses used a TLS certificate that has a common name of "azurenetfiles[.]net," which is a domain previously linked to the ShinyHunters extortion gang. Five of the servers exposed a .bash_history file that gave some insight into the attacks, including a shell script designed to create a ransom note named "README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT" on an internal PeopleSoft server after it is breached. The script parses the /etc/hosts to identify PeopleSoft-related systems and attempts to connect to them over SSH using common PeopleSoft and Oracle administrative accounts such as 'psoft', 'oracle', and 'linuxadm'. If password authentication fails, the script attempts to use SSH key-based authentication as a fallback. Once connected, the script drops the ransom note into directories associated with PeopleSoft web and application servers. If you are running Oracle PeopleSoft, it is strongly advised that you analyze logs for any connections from the above IP addresses to determine whether you were targeted in these attacks. If these IOCs are found, organizations should immediately begin incident response, investigate whether their PeopleSoft instance was compromised, and consider temporarily removing affected servers from internet access until the environment can be secured and reviewed. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Oracle heeft kwetsbaarheden verholpen in Oracle PeopleSoft. De kwetsbaarheden stellen ongeauthenticeerde aanvallers in staat om toegang te krijgen tot gevoelige gegevens en deze te wijzigen. Daarbij kunnen de kwetsbaarheden leiden tot een denial-of-service van de betreffende producten.

Wynn Resorts has confirmed that a hacker stole employee data from its systems after the company was listed on the ShinyHunters extortion gang's data leak site. In a statement shared today, the company said it activated its incident response procedures and launched an investigation, with assistance from external cybersecurity experts, after discovering the breach. "We have learned that an unauthorized third party acquired certain employee data," reads a statement shared with BleepingComputer. "Upon discovery, we immediately activated our incident response protocols and launched a thorough investigation with the help of external cybersecurity experts." While Wynn has not stated whether it paid a ransom to prevent the data leak, the company said the attackers confirmed the stolen data had been deleted. In past extortion cases, threat actors have typically only claimed data was deleted after reaching an agreement with a victim. "The unauthorized third party has stated that the stolen data has been deleted. We are monitoring and to date have not seen any evidence that the data has been published or otherwise misused," the statement continued. The company added that the incident did not impact guest operations or its physical properties, which remain fully operational, and that it is offering complimentary credit monitoring and identity protection services to employees. ShinyHunters leak site listing This statement comes after Wynn Resorts appeared on the ShinyHunters data leak site on Thursday. In the threat actors' post, the group claimed it had stolen "PII (SSNs, etc) and employee data" and warned the company to make contact before February 23, 2026, or the data would be published. "Over 800k records containing PII(SSNs, etc) and employee data have been compromised," reads the now-deleted post on ShinyHunters data leak site. "This is a final warning to reach out by 23 Feb 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headling." Shortly after, the Wynn entry was removed from the site, a move that often occurs when negotiations are underway or claims are disputed. Wynn Resorts did not answer questions about whether a ransom was paid or how many people were affected. Similarly, ShinyHunters told BleepingComputer that they had no comment on whether they received a payment. However, the threat actors did previously claim to have stolen the data from the company's Oracle PeopleSoft environment. ShinyHunters is a data extortion group known for breaching organizations and threatening to publish stolen data unless a ransom is paid. The group has previously claimed responsibility for multiple high-profile data theft incidents and has operated across various underground forums and extortion portals over the years. Last year, ShinyHunters conducted a widespread campaign to steal Salesforce data, targeting numerous companies through social engineering and stolen third-party OAuth tokens. In recent weeks, ShinyHunters has claimed responsibility for a wave of other security breaches, including Panera Bread, Betterment, SoundCloud, Canada Goose, PornHub, and online dating giant Match Group. Some of the victims were compromised through voice phishing (vishing) attacks targeting single sign-on (SSO) accounts at Google, Microsoft, and Okta, where the threat actors posed as IT support staff to trick employees into entering credentials and multi-factor authentication (MFA) codes on phishing sites. As BleepingComputer first reported, the ShinyHunters group more recently adopted device code vishing to obtain Microsoft Entra authentication tokens. After stealing their targets' credentials and auth codes, the threat actors hijack the victims' SSO accounts to steal data from connected SaaS applications such as Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, Dropbox, and many others. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Oracle heeft kwetsbaarheden verholpen in Oracle PeopleSoft. De kwetsbaarheden stellen ongeauthenticeerde aanvallers in staat om toegang te krijgen tot gevoelige gegevens en deze te wijzigen. Dit kan leiden tot ongeautoriseerde toegang en aanpassingen aan kritieke data, met CVSS-scores variërend van 5.4 tot 10.0, wat wijst op een gematigd tot significant risico voor de vertrouwelijkheid en integriteit van de gegevens.

Oracle heeft kwetsbaarheden verholpen in Oracle PeopleSoft (Specifiek voor versies 8.60, 8.61, 8.62 en 9.2). De kwetsbaarheden in Oracle PeopleSoft stellen aanvallers in staat om ongeautoriseerde toegang te verkrijgen tot gevoelige gegevens en kunnen leiden tot gegevensmanipulatie. Dit omvat kwetsbaarheden die het mogelijk maken voor zowel laag- als hooggeprivilegieerde aanvallers om via HTTP toegang te krijgen tot kritieke data, met een CVSS-score variërend van 4.3 tot 7.5, wat wijst op aanzienlijke risico's voor de vertrouwelijkheid en integriteit van de gegevens. De kwetsbaarheden zijn te vinden in verschillende componenten zoals OpenSearch Dashboards, PeopleTools, en IT Asset Management.

Oracle on Tuesday released 374 new security patches as part of its October 2025 Critical Patch Update (CPU), including over 230 fixes for vulnerabilities that are remotely exploitable without authentication. There appear to be roughly 260 unique CVEs in Oracle’s October 2025 CPU advisory, including a dozen critical-severity flaws. The October CPU was rolled out roughly a week after Oracle released patches for an E-Business Suite defect allowing access to sensitive data, and two weeks after the company warned of a zero-day in the product that was exploited by an extortion group. This month, Oracle Communications received the largest number of security patches, at 73, including 47 for vulnerabilities that can be exploited by remote, unauthenticated attackers. Oracle rolled out 64 new security patches for Communications Applications, including 46 for remotely exploitable flaws, and 33 new security patches for Financial Services Applications, 29 of which address remotely exploitable, unauthenticated bugs. The company also announced a large number of new security patches for Fusion Middleware (20 new – 17 for issues that are remotely exploitable without authentication), Retail Applications (18 – 14), MySQL (18 – 7), PeopleSoft (18 – 7), and Systems (16 – 3). Several products received over half a dozen new security patches each, including E-Business Suite (9 new – 6 remotely exploitable), Commerce (9 – 2), Virtualization (9 – 0), Siebel CRM (8 – 8), JD Edwards (8 – 6), Analytics (8 – 5), Insurance Applications (8 – 5), Construction and Engineering (7 – 7), and Hyperion (7 – 4). Other Oracle products that received patches this month include Database Server (6 – 2), GoldenGate (6 -2), Java SE (5 – 5), Hospitality Applications (5 – 3), Essbase (4 – 2), HealthCare Applications (3 – 3), Utilities Applications (3 – 2), Enterprise Manager (3 – 2), Health Sciences Applications (3 – 1), Supply Chain (1 – 1), Graph Server and Client (1 – 0), and REST Data Services (1 – 0). Additional flaws and non-exploitable bugs were resolved in many of these products. For several other products, Oracle did not release new security patches, but patched non-exploitable third-party CVEs in them. On Tuesday, Oracle also announced five new security patches for the Solaris Operating System, including three for vulnerabilities that are remotely exploitable without authentication. *the number of unique CVEs has been updated Related: CISA Confirms Exploitation of Latest Oracle EBS Vulnerability Related: Oracle Patches 200 Vulnerabilities With July 2025 CPU Related: ConnectWise Patches Critical Flaw in Automate RMM Tool Related: Adobe Patches Critical Vulnerability in Connect Collaboration Suite