Daily Briefing

ShinyHunters bypasses WAF filtering to resume mass exploitation of Oracle PeopleSoft

By The IT Security Desk

Good morning. The Hacker News reports that Google is warning of renewed mass exploitation of CVE-2026-35273 in Oracle PeopleSoft, which The Hacker News states carries a CVSS score of 9.8 and can result in unauthenticated exploitation. BleepingComputer reports that the ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that were mitigating the flaw, allowing the threat actors to resume widespread exploitation of vulnerable servers. The Hacker News reports the ShinyHunters-linked activity involves deploying web shells. If you run PeopleSoft, the takeaway from both outlets is that a WAF rule alone is being bypassed, so don't rely on filtering — hunt for web shells on exposed servers.

The Record reports that Frank Balonis, CISO at Kiteworks, told Recorded Future News the company "received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems for customers," and that Kiteworks is urging customers to stop using the platform. If Kiteworks is in your estate, that vendor instruction is the action.

On supply chain, BleepingComputer reports that two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week while still pointing to malicious code. Review any workflows that pin those Actions.

Read the full briefing →