🚨 ACTIVE EXPLOITATION
- ShinyHunters bypasses WAFs to exploit Oracle PeopleSoft flaw and deploy web shells
ShinyHunters has renewed mass exploitation of Oracle PeopleSoft systems, bypassing WAF protections to deploy web shells and backdoors.- Targets organizations running Oracle PeopleSoft, including technology, IT services, healthcare, agriculture, transport, and government sectors, putting HR, payroll, and operational data at risk.
- Exploits CVE-2026-35273, a critical PeopleSoft flaw previously used as a zero-day against universities, linked by Google Cloud to UNC6240 (ShinyHunters).
- Bypasses WAFs by percent-encoding one character in the request path (/%50SEMHUB/), which proxies inspect literally but the PeopleSoft server decodes before routing.
- Sends POST requests with serialized Java objects to probe exploitability, then deploys JSP web shells (x.jsp, u.jsp) or executes commands in memory.
- On Windows servers, delivers the SIDEEYE backdoor via a trojanized installer (Ple64.exe), and uses Neo-reGeorg tunnels and MeshCentral for persistence and lateral movement; IOCs include IPs 5.199.162.157, 104.219.234.138, 162.219.30.165 and domain winmanage-me.network.
Sources 📄 Source: cloud.google.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
💥 BREACHES & INCIDENTS
- Dutch Police Arrest 'Reformed' Hacker in ShinyHunters Investigation
Dutch police have arrested convicted cybercriminal Pepijn van der Stap on suspicion of aiding ShinyHunters data thefts and extortions.- Dutch authorities arrested 23-year-old Pepijn van der Stap (hacker alias 'Umbreon'), previously convicted in 2023 for data thefts and extortions earning €1.5–2.7 million, on or around September 16, 2026.
- Van der Stap worked as a software engineer at cybersecurity startup Hadrian and volunteered at DIVD while secretly extorting victims on RaidForums and Breached; he was released from prison in December 2025 and worked at Neo Security.
- ShinyHunters confirmed the suspect in a Dutch police-released audio clip — a February 2026 social engineering call against telecom Odido — is a member, and vowed support for him.
- Days after the arrest, ShinyHunters breached the FBI jobs site apply.fbijobs.gov, stealing Social Security numbers, job titles, and sensitive psychiatric/medical files on more than 5,000 officials.
- The group exploited the Oracle PeopleSoft flaw CVE-2026-35273 as a zero-day starting in June, and used a URL-encoding trick to bypass Mandiant's suggested web application firewall rules.
🔓 CVEs & KEV
CVE-2026-93538 — SUSE Rancher — CVSS 7.1 — Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster label...
CVE-2026-93540 — SUSE Rancher — CVSS 6.5 — Fleet applies namespace labels and annotations without the bundle's service a...
CVE-2026-93537 — SUSE Rancher — CVSS 6.5 — Path traversal in Fleet Helm valuesFiles allows disclosure of files outside t...
🕵️ RESEARCH & DEEP DIVES
Microsoft details NeedyMantis post-compromise malware used in targeted intrusions
Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family used in targeted intrusions.- NeedyMantis has targeted telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors.
- The malware is deployed after attackers already have access, to maintain long-term access and support follow-on operations; activity dates back to at least October 2025.
- Microsoft observed at least one operator, Storm-3069, tied to the DAEMON Tools supply chain compromise; activity aligns with China-based threat actors.
- NeedyMantis uses multiple C++ and x64 shellcode loaders, custom encrypted archives, and a custom executable format with modular components to evade analysis.
- It is delivered via DLL sideloading masquerading as legitimate software like Poedit, curl, Vim, and TightVNC, or fake Microsoft Office, Broadcom, Intel, and NVIDIA DLLs; Impacket has been used for hands-on-keyboard deployment.
80,000+ organizations had AI logins stolen, from shadow AI to LLMjacking
SOCRadar found infostealer logs exposing AI account credentials and sessions tied to over 80,000 corporate domains.- SOCRadar's AI Identity Exposure Report analyzed over one million infostealer records tied to AI services across 80,000+ corporate domains, narrowing to 482 major enterprises with 5,434 stealer-log records and 1,500 corporate email addresses.
- 68% of the 482 enterprises are billion-dollar organizations across 36 countries and eight sectors, concentrated in North America; 295 surfaced in the last 90 days.
- ChatGPT/OpenAI sessions dominate, appearing for 358 of 482 companies carrying roughly 90% of records; Zapier, Notion, Hugging Face, Replit, Lovable, and ElevenLabs trail behind.
- Stolen AI sessions expose conversation history containing source code, customer records, and contracts; session cookies bypass MFA, and stolen API keys enable LLMjacking — billing victims or being resold underground.
- Technology firms lead exposure at 144 companies and 40% of records; agent/automation exposure concentrates in healthcare, financial services, and technology.
Blackhatsect0r-linked crew's AI-powered attack machine exposed via open server
ThreatMon researchers found the Blackhatsect0r/DXQRTXX crew's automated attack infrastructure exposed online, revealing credentials, source code, and target lists.- A criminal crew linked to Blackhatsect0r and DXQRTXX built an automated system to find weaknesses across the internet, including French government targets.
- The exposed server revealed 16,415 credential records, roughly 498,000 target URLs including 449 French government subdomains, source code, chat logs, fraud notes, and a target list.
- The crew ran a Go-based command-and-control framework and a Python discovery engine that queried certificate records, DNS data, and subdomains to find exposed services and weak application settings.
- Targeted campaigns included France's ANTAI traffic-fine payment system (token forgery, payment record enumeration) and a cryptocurrency exchange accessed via a readable environment file, with no confirmed zero-days used.
- IOCs include scripts ghost_token_forger.py, coinstable_admin.py, coinstable_drain.py, JWT secrets, and backend IPs 212.27.13.112 and 90.102.74.9.
Sources 📄 Source: threatmon.io · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)File-notification side-channel attack tracks user activity on Linux, Windows and macOS
Graz University of Technology researchers showed that OS file-notification services can be abused as a side channel to monitor user activity without elevated privileges.- Applies to Linux (inotify), Windows (ReadDirectoryChangesW) and macOS (FSEvents); requires only unprivileged local code execution, not a remote compromise.
- Attack correlates notification timing and file paths with recognizable behavior using semi-automated templates, identifying terminal commands, keystrokes, website visits, printing, VMs, containers, Bluetooth/VPN changes and USB interaction.
- Resolution ranged 0.2–11.5 ms with under 0.21% CPU overhead; Linux keystroke-timing detection scored 93.1–100% F1, SSH pseudo-terminal monitoring 100% F1.
- Windows unprivileged users watching C:\ root received paths inside other user profiles; Firefox site monitoring hit 97.8% F1 (Edge 48.5%); a KDE Plasma 6/Wayland pkexec UI-redress attack was demonstrated.
- Disclosed to Linux, Microsoft, Apple and KDE in October 2025; Linux shipped a partial /dev mitigation in early 2026, Microsoft called the behavior by design, and the EnforceDirectoryChangeNotificationPermissionCheck policy is disabled by default.
Sources 📄 Source: inoti.fyi · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
- 📄 Source for ShinyHunters defaces FBIjobs.gov, claims theft of data on nearly every FBI agent — fbi.gov