🚨 ShinyHunters resumes mass exploitation of critical Oracle PeopleSoft flaw using simple WAF bypass. Mandiant and Google Threat Intelligence Group have identified renewed mass exploitation of CVE-2026-35273 by UNC6240, also known as ShinyHunters. ⠀ The critical vulnerability allows unauthenticated remote code execution in Oracle PeopleSoft PeopleTools and carries a CVSS score of 9.8. Oracle released an emergency patch on June 10. ⠀ The new campaign targets organizations that attempted to mitigate the flaw using web application firewall rules but did not install the patch. ShinyHunters bypassed rules blocking the vulnerable /PSEMHUB/ endpoint by encoding a single character and sending requests to /%50SEMHUB/. ⠀ Google says web shells were deployed on dozens of systems worldwide across: • Higher education • Technology • IT services • Healthcare • Agriculture • Transportation • Government ⠀ The actors deployed web shells, the SIDEEYE backdoor, Neo-reGeorg tunneling tools and MeshAgent for persistent remote access. Around one-quarter of the observed commands executed with root or SYSTEM privileges. ⠀ Organizations running PeopleSoft should patch immediately, disable or remove the Environment Management Hub where possible and investigate encoded variants of /PSEMHUB/ in access logs. WAF rules alone are not sufficient.

🚨 🇺🇸 Former U.S. soldier "kiberphant0m" sentenced to 70 months for telecom hacking and extortion Cameron John Wagenius, 22, has been sentenced to 5 years and 10 months in federal prison and ordered to pay $294,978 in restitution. ⠀ The Justice Department says Wagenius and his co-conspirators targeted at least 10 organizations and attempted to extort at least $1 million. The activity occurred while he was serving on active duty in the U.S. Army. ⠀ Investigators say the group obtained network credentials using several methods, including a tool called SSH Brute that Wagenius helped develop. They coordinated through Telegram and threatened to publish stolen datasets on BreachForums and XSS. ⠀ In November 2024, Wagenius posted confidential call records belonging to a government official and relatives of another former official, then threatened further disclosures unless a ransom was paid. The records contained call details, not the contents of conversations. ⠀ Some stolen data was also sold and used in other fraud, including SIM-swapping.

🚨 🇺🇸 Kentucky man sentenced to 13 years and 4 months for distributing child sexual abuse material Jacob Murphy, 27, of Harrodsburg, received a 160-month federal prison sentence on September 23. ⠀ The investigation began after Kik reported an account sharing child sexual abuse material in January 2025. Investigators traced the account to Murphy and found additional evidence on his cellphone. ⠀ Murphy admitted knowingly distributing the material, according to the Justice Department.

🚨 Roundcube SQL injection flaw actively exploited months after patches were released The Canadian Centre for Cyber Security has warned that CVE-2026-48842, a high-severity vulnerability in Roundcube Webmail, is being exploited in the wild. ⠀ Roundcube is an open-source webmail application that lets people access email through a browser. The flaw affects its virtuser_query plugin and allows SQL injection before authentication. ⠀ Key details: • CVSS score: 8.1 • No attacker credentials required • No user interaction required • Affects Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1 ⠀ Roundcube released the original fixes on May 24, 2026. Canada added the exploitation warning to its advisory on September 21, citing open-source reporting. The advisory does not identify the attackers, victims or scale of exploitation. ⠀ Administrators should update affected installations promptly. Newer security releases, 1.6.19 and 1.7.4, also address additional vulnerabilities.