Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters

Multiple SecurityWeek reports: Google confirms exploitation of an Oracle PeopleSoft vulnerability (CVE-2026-35273) by the ShinyHunters group; Oracle has issued mitigations. Other notable stories: OnyxC2 stealer marketed as an enterprise-grade theft-as-a-service; active exploitation of a Langflow RCE allowing arbitrary file writes; a ‘GreatXML’ zero-day proof-of-concept that bypasses BitLocker via Microsoft Defender offline scan; Splunk and Palo Alto Networks released patches for severe vulnerabilities; CISA issued BOD 26-04 to prioritize patching using the KEV catalog; the FBI seized 13 sites,