ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
2026-09-27T13:23:22Z•46685ef065064e377bbcc12dad91ed160aaa1e28e37cb36c2ade36fa9a049431
CVE-2026-35273CVE-2026-5430AI agentsAdobe CommerceCSRFClopElementorGitHub ActionsGrav CMSOracle PeopleSoftSharePointShinyHuntersWAF bypassWSO2WordPressactive exploitationauthentication bypassdata exposurepath traversalransomwaresupply-chain compromiseweb application securityzero-day
What happened
BleepingComputer reports active exploitation of multiple enterprise and web application vulnerabilities, including ShinyHunters bypassing WAF protections for Oracle PeopleSoft CVE-2026-35273, CISA-confirmed exploitation of SharePoint, WSO2 CVE-2026-5430, and Adobe Commerce flaws, and attacks against vulnerable Grav CMS and Elementor WordPress installations. The feed also highlights supply-chain compromise risks involving malicious GitHub Actions, potential zero-day targeting of Kiteworks servers, and data exposure from AI agents uploading user images to third-party services.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 46685ef065064e377bbcc12dad91ed160aaa1e28e37cb36c2ade36fa9a049431
- Enrichment time
- 2026-09-27T13:23:22Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.