ShinyHunters Exploits Critical Oracle PeopleSoft Flaw to Deploy Web Shells via WAF Bypass

·3 views

Threat group UNC6240, linked to ShinyHunters, has been actively exploiting a critical pre-authentication remote code execution vulnerability (CVE-2026-35273, CVSS 9.8) in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62, according to a September 25, 2026 report by Google Threat Intelligence Group and Mandiant. Attackers bypass web application firewalls by percent-encoding the letter 'P' in the target URL path as '%50', causing WAF string-matching rules to miss the request while the backend WebLogic server decodes and processes it normally. JSP web shells have been confirmed on dozens of compromised systems, with some intrusions also involving fileless command execution that leaves no shell files on disk. Following initial access, attackers deployed multiple post-intrusion tools including SIDEEYE for credential theft, Neo-reGeorg for internal SOCKS tunneling, and MeshAgent for remote management on Linux hosts. Oracle has issued a security advisory, and organizations running affected PeopleSoft versions are urged to apply patches and review WAF rules to detect encoded URI variants.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

The Hidden Cron Scheduling Bugs That Catch Even Experienced Developers

Cron jobs, used to automate backend tasks like backups and health checks, follow a simple five-field syntax but hide subtle bugs that stem from differing implementations across platforms. A common production mistake involves combining day-of-month and day-of-week restrictions: in standard Unix cron, the expression '0 0 1 * 1' runs on both the 1st of every month and every Monday, not just Mondays that fall on the 1st. Extended syntax features like L, W, and # are supported in modern schedulers such as Quartz and Kubernetes but are silently ignored or treated as errors in classic Unix cron, causing jobs to never run without any warning. Cloud platforms including AWS EventBridge and GitHub Actions default to UTC, meaning a job scheduled for 9 AM may fire at an unintended local time for users in other time zones. Developers are advised to verify the target scheduler's syntax rules, timezone defaults, and day-field logic before deploying any cron expression.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

New tool countfn measures algorithm complexity by counting operations, not time

A developer has released countfn, available on both PyPI and npm, which measures algorithmic complexity by counting operations such as reads, writes, and calls rather than relying on elapsed execution time. Unlike existing tools such as big-O and big-o-calculator, countfn can return an 'UNDETERMINED' result instead of forcing a potentially incorrect complexity classification. Because operation counts are deterministic and noise-free, the tool avoids the statistical uncertainty inherent in timing-based measurements. The library also guarantees cross-language parity, meaning the same algorithm with the same seed produces identical operation counts in both Python and JavaScript. When complexity cannot be confidently identified — such as when two classes are too close to distinguish — countfn explicitly refuses to name one rather than guessing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Make vs Zapier for Freelancers: How to Choose the Right Automation Tool

Freelancers in 2026 broadly have two leading automation platforms to choose from — Zapier and Make — each suited to different working styles and needs. Zapier is recommended for those who want quick, straightforward setups with a guided experience and a large template library, while Make better serves users who need branching logic, bulk operations, and more cost-efficient handling of complex, high-volume workflows. Both platforms support thousands of app integrations and now include AI steps capable of summarizing or drafting text mid-flow. Pricing models differ significantly: Zapier charges per task and costs can rise quickly with multi-step automations, whereas Make's operations-based billing often proves cheaper for data-heavy or frequent workflows. Experts suggest freelancers prototype in Zapier for speed, then migrate demanding pipelines to Make once volume and complexity justify the switch.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

docs-governance Helps Preserve Project Context Across AI Coding Agent Sessions

A developer has released docs-governance, an MIT-licensed open-source tool designed to retain project decision context across AI coding-agent sessions in Claude Code and Codex. The tool uses a set of small, purpose-specific Markdown files — covering project rules, navigation notes, current status, and change logs — to give each new session structured context without overloading a single instruction file. It also includes reusable skills, templates, and audit scripts, with support for larger projects needing architecture documents and decision records. The project is available on GitHub with installation instructions for both Claude Code and Codex. The developer is seeking community feedback on whether the audit tooling surfaces useful issues and whether maintaining the files remains practical in real-world projects.

0 comments Read more at DEV Community