kyber.today

daily cyber × ai intelligence

← index

tagged

[oracle]

21 editions · 25 items

October 29, 2026

  • Oracle E-Business Suite CVE-2026-101767 (CVSS 9.8) is being probed within days of its CPU patch. Defused Cyber recorded exploratory exploits against its EBS decoys on the morning of October 27; Horizon3.ai, which reported the bug on July 24, describes unauthenticated SQL injection in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer that runs SQL as the APPS database user and chains to OS commands as the EBS application account. Versions 12.2.3–12.2.15 are affected; if you can't patch, pull the servlet from the URL firewall allowlist (The Hacker News, SecurityWeek). · Vulnerabilities & Exploits

in Exploit Chains Built by Hand, by Botnet, and by Model

October 25, 2026

  • eMudhra is quitting the global SSL/TLS business after eight certificates were found with private keys of 3 to 8 bits of entropy. The company says it revoked the affected CAs within 14 hours, issued no end-entity certificates from them, and suffered no infrastructure compromise — and that global TLS was ~1% of revenue. Oracle has now gone further than its October 21 distrust alert (CVE-2026-91403): a second Security Alert on October 24, CVE-2026-114820 (CVSS 9.1), removes the emSign ECC Root CA G3, emSign Root CA G1 and G2 roots — plus Comodo's AAA Certificate Services — from the JDK cacerts keystore. (eMudhra, Oracle, Schneier) · Industry & Policy

in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox

October 21, 2026

  • Oracle E-Business Suite CVE-2026-101767 chains unauthenticated SQL injection into host command execution. Horizon3 found that the default-permitted TCF servlet lets a network attacker run SQL as the privileged APPS database user and commands as the EBS application account. Versions 12.2.3 through 12.2.15 are affected and covered by Oracle’s October update; no active exploitation or standalone public exploit was claimed in the technical disclosure. · Vulnerabilities & Exploits

in PHP’s php2shell RCEs Break Cover

October 10, 2026

  • Pwn2Own Ireland closed at $1,262,000 for 98 zero-days. Ikotas Labs took Master of Pwn with $361,000, including the $300K top award for chaining multiple bugs on a fully patched Google Pixel 10, plus successful attempts against OpenAI Codex and the Oracle Autonomous AI Database; nobody registered for the iPhone 17 (BleepingComputer, ZDI). · Public Exploits & Vulnerability Research
  • Oracle Health's legacy Cerner breach tally has climbed to nearly 20 million people, involving stolen credentials, data theft and extortion threats (SecurityWeek). · Breaches

in Fake "Security Audit" Workflows Sweep GitHub for Cloud and AI Keys

October 6, 2026

  • The FBI removed an Accenture contractor after a missed patch was linked to its employment-portal breach. Reuters says, citing two sources, that the affected third-party platform was Oracle PeopleSoft and ShinyHunters claimed it exploited the system last month. Sensitive data belonging to thousands of FBI employees was exposed, although the bureau has not publicly named either company or platform. · Cloud, Identity & Data Exposure

in A Trusted Company Connection Exposes 8.8 Million Danish CPR Records

September 30, 2026

  • ShinyHunters' alleged leader arrested in the Netherlands. Dutch police arrested a 24-year-old Amsterdam man on 15 September; the FBI's Cyber Division AD Brett Leatherman publicly called him one of the group's alleged leaders and told remaining members to turn themselves in. A Rotterdam court extended pre-trial detention by at least 90 days on 29 September, and police say further arrests are not ruled out. The FBI puts the group at 140+ organizations breached since last year and at least $70 million in extortion payments, typically via corporate SSO, third-party vendors and SaaS platforms like Salesforce and Snowflake. Dutch police add that material recovered from the suspect's laptop concerns two murders to be committed abroad, with indications he gave the order (BleepingComputer, Politie) (earlier coverage). The group has since put out a statement claiming its operations and infrastructure remain "completely fine" (Dark Web Informer), and CERT.dk notes it has resumed Oracle PeopleSoft CVE-2026-35273 attacks (CERT.dk). · Threat Activity

in Mandiant Names the NetScaler Post-Exploitation Kit as Patch Rates Stay Under 10%

September 29, 2026

  • ShinyHunters restarted mass exploitation of Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8), and Mandiant says the group specifically adapted to published defensive guidance, targeting organisations that applied the workarounds but never installed the June 10 patch. Webshells landed on dozens of systems across higher education, technology, IT services, healthcare, agriculture, transportation and government; Mandiant urges reviewing database logs for queries against HR, payroll and student-records tables (The Record, The Hacker News). · Threat Activity

in PitScaler Goes Global: Citrix NetScaler Chain Exploited for Weeks Before Anyone Had a Patch

September 27, 2026

  • ShinyHunters (UNC6240) resumed mass exploitation of Oracle PeopleSoft CVE-2026-35273 with a one-character WAF bypass: requesting /%50SEMHUB/ instead of /PSEMHUB/. Many WAF and reverse-proxy rules match the literal path before URL decoding while the PeopleSoft app server decodes and routes to the vulnerable servlet — meaning operators who believed their WAF rules mitigated exposure are still reachable. Mandiant/GTIG report web shells on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation and government, and stress WAF rules are not a substitute for the June out-of-band patch. Hunt for percent-encoded variants in PIA WebLogic access logs and inspect PSEMHUB.war/ for x.jsp, u.jsp, tunnel.jsp, tunnel.jspx and Ple64.exe — the last signed with a valid EV certificate via Sectigo (Google Cloud, BleepingComputer). (earlier coverage) · Threat Activity

in Citrix NetScaler Zero-Days Land Mid-Weekend, No Patch Until Next Week

September 26, 2026

  • ShinyHunters (UNC6240) has resumed mass exploitation of CVE-2026-35273, the unauthenticated RCE in Oracle PeopleSoft PeopleTools (CVSS 9.8, emergency patch 10 June), with a summary of Mandiant/Google Threat Intelligence findings saying the new wave specifically targets organisations that deployed WAF rules as mitigation but never installed the patch — and bypasses those rules trivially (@DarkWebInformer). The group separately told The Register it hacked the FBI to "protect our business" (The Register). · Emergency Advisories & Active Exploitation
  • 1024-bit RSA signatures forged without factoring the key. Researchers from UC San Diego and INRIA implemented the 2007 Joux–Naccache–Thomé algorithm against 1024-bit RSA: 1,380 CPU core-years of precomputation over five calendar months and 2^32 oracle queries, after which any chosen signature can be forged offline in 180 core-years. They ran it against a hardware security module as the signing oracle, demonstrating black-box impersonation of the HSM without ever extracting the key; blind RSA schemes expose the same oracle. Extrapolated, concrete RSA security with a signing oracle is 15–30 bits below factoring-based estimates for 1024- to 4096-bit keys — even 4096-bit does not reach 128-bit security in this model (ePrint 2026/2131, Ars Technica) (discussion). · Vulnerability Research & Exploits
  • AF_ALG local root, retrospective on a $113,337 kernelCTF bug. Muhammad Alifa Ramdhan details CVE-2025-39964, a race between two writers on the same AF_ALG socket that leaves ctx->merge true with a zero-length scatterlist, driving the kernel into sg[-1]. Controlled metadata in the preceding heap object yields a usercopy oracle and an arbitrary kernel write; the exploit overwrites core_pattern for root and escapes a Docker container to host root. The vulnerable code dates to roughly 2011; the upstream fix returns -EBUSY on concurrent writes (IDNSEC). · Vulnerability Research & Exploits

in Kiteworks Orders a Global Shutdown on a Zero-Day Warning

September 23, 2026

  • ShinyHunters says it breached the FBI through an unpatched Oracle PeopleSoft zero-day on the bureau's jobs site, claiming pre-auth RCE, lateral movement onto FBI-managed servers in AWS GovCloud, and 2–3TB of data on current, former and prospective employees — allegedly touching HR, MedLink and CJIS. The group defaced fbijobs.gov, which is now offline "for maintenance," and says it wants no money: it is demanding the FBI retract a 15 May bulletin within a week. The FBI has not confirmed the breach, and neither Oracle nor AWS responded to inquiries (The Register, BleepingComputer). The group also named German dialysis firm Fresenius Medical Care as a victim (@DarkWebInformer); its Cl0p leak-site hijack ran in earlier coverage. · Threat Activity & Breaches

in Attack Chains That Run Themselves

August 7, 2026

  • Attackers turned an Oracle SQL injection into Windows SYSTEM access using khunt, a database-resident post-exploitation toolkit. They fed Java source into Oracle, let the DB compile it into stored schema objects, and ran commands from inside the engine — dumping SAM/SECURITY/SYSTEM hives while most activity stayed buried in Apache logs rather than endpoint telemetry. The Hacker News, Huntress · Offensive Techniques

in Meta Becomes the Fourth Lab to Admit Its AI Hacked a Stranger

June 30, 2026

  • Oracle E-Business Suite CVE-2026-46817 (CVSS 9.8), an improper-privilege/auth flaw in Oracle Payments, is now being exploited in the wild per Defused, allowing instance takeover. The Hacker News, BleepingComputer · Vulnerabilities & Exploits
  • NAIC confirmed a breach by ShinyHunters via an Oracle PeopleSoft zero-day (group claims 3.1 TB stolen); Nissan disclosed an employee-data breach tied to the same PeopleSoft exploitation campaign. NAIC, Nissan · Threat Activity

in Edge Appliances Bleed: watchTowr Drops Kemp LoadMaster Pre-Auth RCE as Oracle EBS Joins the Exploited List

June 18, 2026

  • Oracle PeopleSoft CVE-2026-35273 unauthenticated RCE is under active exploitation by ShinyHunters (aka Bling Libra), with the education sector hit hardest since at least late May. Horizon3 confirmed exploitation predating disclosure, and Unit 42 corroborates the campaign against universities. watchTowr warns that "vibecoded" PoCs circulating are only the first-stage SSRF, not the full chain — treat public exploits skeptically (watchTowr). · Vulnerabilities & Exploits

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel