Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble
Attackers are probing a critical Oracle E-Business Suite vulnerability that can allow unauthenticated remote code execution, even though Oracle issued a patch earlier this month. Separately, researchers say the PeopleSoft zero-day exploited by ShinyHunters comprises three vulnerabilities that can be combined to reach remote code execution.
The EBS flaw, CVE-2026-101767, affects the Thin Client Framework servlet and could expose application data such as financial, payroll, HR and procurement records. ShinyHunters claimed it had breached more than 100 organisations through the PeopleSoft issue, and Mandiant later reported web shells on dozens of systems across sectors including education, healthcare and government. Researchers are coordinating with Oracle to assign separate identifiers to the three PeopleSoft bugs; patching may not remove attackers already present on compromised systems.
In short
- Attackers are probing a patched Oracle EBS flaw.
- Researchers say the PeopleSoft zero-day combines three vulnerabilities.
- Existing web shells may remain after patching.
Explained simply
Oracle E-Business Suite and PeopleSoft are business software used by organisations to manage tasks such as finance, payroll, human resources and procurement. Because these systems hold sensitive records and support everyday operations, weaknesses in them can affect both data and services.
A software vulnerability is a flaw attackers may use to gain access or control; a zero-day is a flaw being exploited before a fix is available. ShinyHunters is a group that claims to break into organisations and steal data, while Mandiant is a cybersecurity company that investigates incidents.
The reports concern separate security problems in Oracle products. A software patch can fix a known flaw, but organisations may also need to check for signs of earlier intrusions, since installing a fix does not necessarily remove an attacker who is already inside.