NASA’s new dark energy space telescope can also detect killer asteroids
technologyreview.com·3h ago
Cloud & Infrastructure
Google Cloud Blog·Jun 11·5 min read
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
TL;DR
Educational institutions faced a significant security threat due to a critical vulnerability in Oracle PeopleSoft. ShinyHunters exploited CVE-2026-35273, a remote code execution flaw, to compromise systems.
✦ Why It Matters
Engineers must prioritize patching critical vulnerabilities like CVE-2026-35273 to safeguard educational data.
Key Takeaways
- Implement immediate access restrictions to Oracle PeopleSoft endpoints.
- Monitor logs for suspicious activity related to the Environment Management Hub.
- Conduct forensic audits on compromised systems for indicators of compromise.
- Apply all critical security updates for Oracle PeopleSoft without delay.
How It Works
ShinyHunters exploited the CVE-2026-35273 vulnerability to gain remote code execution on Oracle PeopleSoft systems. They set up a staging environment using MeshCentral, allowing them to deploy scripts for lateral movement and data exfiltration.
The attackers used a custom script to automate SSH credential spraying against internal hosts, facilitating unauthorized access and data theft.