Published: 09/29/26
Tuesday opens on a patch that a lot of teams swapped for a firewall rule. Google says ShinyHunters is back on unpatched PeopleSoft servers. One encoded letter gets it past the WAF. Also on the desk: Kiteworks asked customers to power down for a weekend, Apple fixed an iPhone bug used against specific people, and 16,000 Supabase databases are open to anyone who asks.
Lead Story
PeopleSoft attackers are walking past WAF rules. Patch HR and payroll servers now
Mandiant and GTIG report a renewed mass-exploitation wave against CVE-2026-35273, the unauthenticated PeopleTools RCE Oracle fixed on June 10. ShinyHunters now requests /%50SEMHUB/ instead of /PSEMHUB/, which slips past string-matching WAF rules. Web shells have turned up on dozens of systems in education, healthcare, government and other sectors.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters: PeopleSoft holds payroll, HR and student records. This group steals data and then extorts the owners.
Also Worth Your Attention
Kiteworks told customers to power down for the weekend
After a federal threat tip, Kiteworks recommended a precautionary shutdown. It lifted that advice on September 27. The company says the flaw is in Advanced Forms (under 50 customers) and that no compromise is known; version 9.5.1, it says, addresses all known vulnerabilities.
Why it matters: Extortion crews go after file-sharing servers, and Kiteworks has been through that before.
iPhones still on iOS 26 need 26.7.1
CVE-2026-86950 is a CoreGraphics out-of-bounds write that Apple says may have been exploited against specific targeted individuals on iOS before 27. Fixed in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Why it matters: The people most likely to be targeted are often the ones who deferred the big upgrade.
16,326 Supabase databases are readable by anyone
UpGuard scanned about 300,000 Supabase-backed sites. It found tables anyone could read, holding personal data and sometimes passwords or tokens, because row level security was missing or weak. That happens a lot when code or AI agents create the tables.
Why it matters: Quick internal apps start collecting real customer data long before anyone reviews them.
PeopleSoft: Oracle’s June 10 fix installed (not just WAF), EMHub off if unused, grep for encoded /PSEMHUB/; Kiteworks on 9.5.1, Advanced Forms check; iOS 26 devices to 26.7.1; Supabase projects: RLS on every table.
Go Deeper
Identity & access: IAM library · Tools & playbooks: Cybersecurity Tools · Subscribe: Daily Brief
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
