Oracle PeopleSoft: How to Patch ShinyHunters Zero-Day Flaws

Executive Summary

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.

Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address by default, opening the door to remote code execution without a login.

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.

Organizations operating affected infrastructure face acute operational exposure across external perimeters and hybrid identity environments. Security leadership and Incident Response (IR) teams must urgently audit asset inventories, deploy compensating controls, and execute the hunting runbooks detailed below to detect unauthorized ingress.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.

CVE-2026-35273 affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, carries a CVSS score of 9.8, and lets an unauthenticated attacker take over the server over the network. Oracle released its fix in an out-of-band security alert on June 10. The flaw is on CISA's Known Exploited Vulnerabilities catalog.

Adversary Ingress & Lateral Traversal Pipeline

The intrusion methodology demonstrates disciplined compartmentalization, chaining initial perimeter exploitation with stealthy living-off-the-land (LotL) execution to maintain persistent footholds while blinding telemetry sensors:

[ Threat Ingress Infrastructure ]
         │
         │ 1. Zero-Day / N-Day Exploitation (CVE-2026-35273)
         ▼
[ Compromised Edge Device / Application Daemon ]
         │
         │ 2. Memory-Resident Execution / Ephemeral Reverse Tunnel
         ▼
[ Encrypted Relay Channel ] ──> Living-Off-the-Land (LotL) Command Execution
         │
         │ 3. Internal Network Enumeration & Credential Harvesting
         ▼
[ Strategic Reconnaissance / Target Exfiltration ]

By leveraging temporary configuration files, dynamic port forwarding, and anti-forensic log suppression, adversaries eliminate traditional disk-based artifacts, evading standard signature-based endpoint detection mechanisms.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Campaign Attribution

Attributed to ShinyHunters, a notorious cybercrime syndicate specializing in large-scale data extortion, cloud credential theft, and enterprise SaaS compromises. The group frequently weaponizes newly disclosed zero-day or N-day vulnerabilities within hours of public disclosure to exfiltrate massive corporate databases.

---

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

Step 1: Apply Authoritative Vendor Patches

Review official vendor security bulletins and deploy released security hotfixes across all production and staging environments immediately.

Step 2: Enforce Strict Least-Privilege Daemon Permissions

Configure application service accounts to execute with minimal operating system privileges, preventing arbitrary command escalation in the event of worker compromise.

Step 3: Implement Parameter and Content-Type Boundary Validation

Enforce strict payload validation and boundary checks at the web application firewall (WAF) layer to drop malformed input sequences.

2. Network & Perimeter Defenses

• Restrict administrative ingress to dedicated, non-routable management subnets requiring hardware MFA.
• Enforce strict egress inspection to drop outbound connection attempts to unauthorized public IP space.

3. Endpoint Detection & Hunting Query

Sigma Rule: Suspicious Child Process Execution

title: Suspicious Child Process Under Core Service
id: d7f1a3e9-0b42-4f91-8812-inc-108
status: experimental
description: Detects abnormal shell spawning from application processes indicative of command injection or RCE.
references:
  - https://cybernewsai.com
author: CyberNewsAI Threat Research Team
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nginx'
      - '/apache2'
      - '/httpd'
      - '/node'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.execution
  - attack.t1203

Microsoft Sentinel Hunting Query (KQL)

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("httpd.exe", "w3wp.exe", "nginx.exe", "node.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "curl.exe", "whoami.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

---