Google warns of renewed mass exploitation of a critical Oracle PeopleSoft flaw. Attackers are bypassing WAFs and deploying web shells. Here's what you need to do now.
Google just dropped a warning that should make any security team sit up straight. A known flaw in Oracle PeopleSoft is being exploited again, and this time it's happening on a massive scale across multiple industries worldwide.
The group behind this? It's tied to ShinyHunters, a name that's been popping up in breach headlines for a while now. They're weaponizing CVE-2026-35273, a vulnerability with a CVSS score of 9.8. That's about as bad as it gets. It means an attacker can run their own code on your server without ever logging in. No username. No password. Just a direct line into your system.
### What Exactly Is Happening?
This flaw was first seen in the wild as a zero-day, meaning the bad guys found it before Oracle could patch it. Now Google's Threat Analysis Group is seeing renewed mass exploitation. The attackers aren't just poking around. They're bypassing Web Application Firewalls (WAFs) and deploying web shells.
A web shell is basically a tiny backdoor script that gives an attacker persistent remote access. Once it's in place, they can execute commands, steal data, or pivot to other systems. And because it looks like a normal web file, it can be tough to spot.
Here's the kicker: WAFs are supposed to stop this kind of thing. But the attackers have figured out ways around them, likely by encoding payloads or using legitimate-looking traffic patterns. So if you're relying solely on a WAF for protection, you're playing with fire.
### Why This Matters for Your Business
If you run Oracle PeopleSoft, you're a target. It doesn't matter if you're in healthcare, finance, retail, or education. The campaign is global and indiscriminate. The attackers are scanning for vulnerable instances and hitting them fast.
> "The vulnerability was first exploited as a zero-day, and now we're seeing widespread abuse. Patching is no longer optional—it's urgent."
That quote from a security researcher sums it up. You can't wait. You can't hope your WAF will save you. You need to act.
### What Should You Do Right Now?
- **Patch immediately.** Oracle has released fixes for CVE-2026-35273. Apply them today. If you can't patch, consider taking the system offline until you can.
- **Check for web shells.** Look for unusual files in your web directories. Common names include `shell.php`, `cmd.jsp`, or anything with a random string. Use a file integrity monitoring tool.
- **Review your logs.** Look for POST requests to unusual endpoints or spikes in outbound traffic. Attackers often exfiltrate data after planting a shell.
- **Harden your WAF.** Don't just rely on default rules. Update signatures and enable custom rules to catch obfuscated payloads.
- **Limit access.** Restrict who can reach your PeopleSoft instance. If it doesn't need to be public, put it behind a VPN.
### The Bigger Picture
This isn't just about one vulnerability. It's a reminder that attackers are constantly evolving. They're finding ways around the tools we trust. WAFs, firewalls, even antivirus—none of them are foolproof.
The best defense is a layered approach. Patch fast. Monitor constantly. And assume you'll be targeted. Because you will be.
If you're using an antidetect browser for privacy or multi-accounting, this news might feel distant. But the same principles apply. Stay updated, use trusted tools, and never assume you're safe. The bad guys are always looking for an opening.
So take this seriously. Check your systems. Patch your software. And keep an eye on those logs. The next attack might not make headlines—but it could make your life miserable.
