How the chain worked

A critical Oracle PeopleSoft flaw exploited by criminals since May was not a single bug at all. Researchers at the Zero Day Initiative (ZDI), who first reported it, have now disclosed that what Oracle patched under one identifier was in fact three distinct vulnerabilities chained together into a single attack.

The chain began with a server-side request forgery flaw in PeopleSoft's Integration Gateway, the component that exchanges messages with outside systems. It then passed through a trust bypass: the system's allowed-hosts configuration accepts the loopback address 127.0.0.1 by default, so a forged request appearing to come from the server itself was treated as trusted. From there, an attacker could reach remote code execution by writing malicious log files to plant web shells, or by sending a crafted XML payload to Java's XMLDecoder class.

Why patching alone is not enough

Oracle issued its patch on 10 June 2026, roughly two weeks after the ShinyHunters group had already begun exploiting the flaw as a zero-day, according to the researchers. Mandiant reported a second, broader wave of attacks by September, in which the group bypassed firewall rules with URL encoding. The flaw affects PeopleTools versions 8.61 and 8.62 and carries a CVSS score of 9.8. Crucially, installing the patch closes the hole but does not remove access an attacker may already have gained, so affected organisations are urged to hunt for web shells and backdoors as well as patching. Oracle has issued separate CVE assignments for the three components, and ZDI says the loopback trust default deserves its own review, since a future flaw in another component could route through it again.

Sources: 0daynews (Zero Day Initiative disclosure) | IT Security News (via The Hacker News)