Breaking-Alert

Published Sunday, June 14, 2026 at 08:03 PM PT BLUF: Two chained vulnerabilities in n8n workflow automation platform — CVE-2025-68613 and CVE-2026-21858 — enable unauthenticated remote code execution. Any organization running exposed n8n instances is at risk of full compromise. Assess exposure and apply mitigations now. DETAILS Two CVEs chain to unauthenticated RCE: CVE-2025-68613 and CVE-2026-21858 (tracked as “Ni8mare”) have been publicly detailed, with exploit methodology demonstrated. The combination allows an unauthenticated attacker to achieve full compromise of n8n workflow environments. n8n is a high-value target: The platform automates workflows and commonly holds credentials, API keys, and integrations with internal systems — making full compromise exceptionally impactful beyond the host itself. Public exploit detail is now available: Hack The Box has published technical breakdown of the exploit chain and released a practice machine (“BloodFlow”), meaning exploit methodology is broadly accessible to threat actors. Weaponization risk is elevated. CVE-2026-21858 designation is notable: The 2026 CVE year designation is unusual and may indicate a pre-publication reserved identifier or a data anomaly — treat this detail as unconfirmed pending vendor advisory verification. No patch confirmation available in provided sources: Patch status and affected version ranges have not been confirmed in the information provided. Organizations should consult the n8n official advisory and NIST NVD entries directly. IMPACT Who: Any organization running n8n instances, particularly those exposed to the internet or accessible without strong authentication controls. What: Automated workflow platforms, internal integrations, stored credentials, connected APIs, and downstream systems reachable via n8n workflows. Scope: Potentially broad — n8n is widely used in DevOps, IT automation, and business process environments. A compromised n8n instance may serve as a pivot point into broader infrastructure. RECOMMENDED ACTIONS Inventory immediately — Identify all n8n instances in your environment, including self-hosted and containerized deployments. Restrict network exposure — If n8n is internet-facing, place behind VPN or restrict access via firewall rules until patched. Check for indicators of compromise — Review n8n logs for unexpected workflow executions, new user creation, or anomalous API calls. Apply vendor patches — Monitor n8n’s official GitHub and security advisories for patch releases; apply immediately upon availability. Audit stored credentials — Assume any credentials stored in n8n workflows may be exposed if instances were reachable prior to mitigation. Rotate API keys and secrets held within n8n integrations as a precautionary measure. ⚠️ UNCERTAINTY FLAGS CVE-2026-21858 year designation is anomalous — verify against official NVD and n8n advisories before citing in formal reporting. Affected version ranges and patch availability are not confirmed in available sources. Active in-the-wild exploitation has not been confirmed — current risk is elevated due to public exploit disclosure, not confirmed threat actor activity. SOURCES Hack The Box: “Ni8mare fuel: Chaining n8n CVEs for full compromise in automated workflows” CVE identifiers: CVE-2025-68613, CVE-2026-21858 Verify against: n8n official security advisories, NIST NVD

Published Saturday, June 13, 2026 at 10:03 PM PT BLUF: Reporting indicates the United States may be deprioritizing offensive and defensive cyber operations targeting Russian threat actors, representing a potential major shift in Western cyber deterrence posture. Organizations relying on U.S. government threat intelligence and response coordination against Russian-nexus actors should reassess their defensive assumptions immediately. DETAILS U.S.-Russia cyber posture shift (UNCONFIRMED/DEVELOPING): Industry analysts, including commentary from Risky Business podcast ep. #782, are raising credible questions about whether the U.S. has materially reduced focus on Russian cyber threat actors. Specific policy decisions driving this have not been publicly confirmed — treat as a significant indicator requiring monitoring, not established fact. ...

Published Saturday, June 13, 2026 at 10:02 PM PT BLUF: The incoming Trump administration has removed expert members from the Cyber Safety Review Board (CSRB), eliminating a key federal cyber incident review body. Simultaneously, a confirmed Chinese breach of the U.S. Treasury has been disclosed. Federal agencies, contractors, and critical infrastructure operators should reassess their threat posture and incident reporting chains immediately. ...

Published Saturday, June 13, 2026 at 10:01 PM PT BLUF: SentinelOne’s Chief Intelligence and Public Policy Officer Chris Krebs has provided detailed public analysis of ongoing Chinese state-sponsored cyber campaigns — Salt Typhoon and Volt Typhoon — covering two decades of operational evolution. Organizations in telecommunications and critical infrastructure sectors should treat current threat posture as elevated and review defensive controls immediately. ...

Published Friday, June 12, 2026 at 09:59 AM PT BLUF: Oracle has disclosed CVE-2026-35273, a CVSS 9.8 unauthenticated remote code execution vulnerability in PeopleSoft Enterprise PeopleTools. An out-of-band patch was released June 10, 2026. All organizations running affected PeopleSoft PeopleTools versions should apply the patch immediately. DETAILS CVE-2026-35273 affects the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools CVSSv3.1 base score: 9.8 (Critical) — remotely exploitable with no authentication required Successful exploitation may result in remote code execution (RCE); full impact scope is not yet confirmed in available reporting Oracle issued an out-of-band security alert on June 10, 2026 — outside its standard quarterly CPU cycle — indicating elevated urgency No confirmed in-the-wild exploitation has been reported at time of publication; exploitation status is unconfirmed IMPACT Affected: Organizations running Oracle PeopleSoft Enterprise PeopleTools with the Updates Environment Management component exposed — commonly used in HR, finance, and ERP environments across enterprise and public sector Scope: Network-accessible PeopleSoft instances are at highest risk; internet-facing deployments should be treated as priority Potential consequence: Full system compromise via unauthenticated RCE; lateral movement and data exfiltration are plausible follow-on risks ⚠️ Specific affected version ranges not confirmed in available details — consult Oracle’s advisory directly RECOMMENDED ACTIONS Apply Oracle’s out-of-band patch immediately — available as of June 10, 2026 via Oracle’s support portal Audit exposure — identify all PeopleSoft PeopleTools instances, particularly any internet-facing or externally accessible deployments Restrict network access to the Updates Environment Management component where patching cannot be immediately applied Monitor for exploitation indicators — review logs for anomalous unauthenticated access attempts against PeopleSoft endpoints Escalate to system owners and patch management teams now — do not wait for next scheduled maintenance window SOURCES Rapid7 Security Advisory (June 10, 2026) Oracle Security Alert — CVE-2026-35273 (June 10, 2026) ⚠️ NOTE: Specific affected version numbers and confirmed exploitation status were not available in source material at time of publication. Verify scope against Oracle’s official advisory.

Published Friday, June 12, 2026 at 03:58 AM PT BLUF: CISA has issued an emergency order requiring all U.S. federal agencies to patch an actively exploited Ivanti vulnerability by this Sunday. Federal agencies must act immediately; non-federal organizations running Ivanti products should treat this as high-priority. DETAILS CISA has added an Ivanti vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and issued a binding operational directive requiring federal civilian agencies to apply patches by Sunday’s deadline The flaw is confirmed to be actively exploited in the wild — this is not a theoretical risk Ivanti products are widely deployed across government and enterprise environments, including VPN/network access solutions (e.g., Ivanti Connect Secure, Policy Secure, Neurons) ⚠️ UNCERTAINTY NOTE: Specific CVE identifier, CVSS score, technical exploitation details, and confirmed threat actor attribution have not been confirmed in available source material at this time — treat specifics as pending CISA’s accelerated Sunday deadline signals assessed severity and likely ongoing exploitation activity IMPACT Directly affected: All U.S. federal civilian executive branch (FCEB) agencies running vulnerable Ivanti products — compliance is mandatory, not advisory Broader risk: Any enterprise, critical infrastructure operator, or managed service provider running Ivanti solutions should assume exposure until patched Scope: Ivanti products are prevalent in large-scale network environments; exploitation could enable unauthorized access, lateral movement, or credential theft depending on the specific flaw RECOMMENDED ACTIONS Identify immediately — Audit all Ivanti product deployments across your environment (Connect Secure, Policy Secure, Ivanti Neurons, ITSM platforms) Apply vendor patch — Check Ivanti’s official security advisories for the relevant patch and apply before Sunday if possible, regardless of federal status Check for indicators of compromise — Review logs for anomalous authentication, lateral movement, or unexpected outbound connections on Ivanti-adjacent systems Isolate if unpatched — If patching cannot be completed immediately, consider isolating affected systems from sensitive network segments Monitor CISA KEV — Track updates at cisa.gov/known-exploited-vulnerabilities-catalog for confirmed CVE details and additional guidance SOURCES BleepingComputer — “CISA orders feds to patch actively exploited Ivanti flaw by Sunday” CISA Known Exploited Vulnerabilities Catalog (cross-reference recommended) ⚠️ This alert reflects confirmed reporting as of time of publication. CVE specifics and exploitation technical details are pending confirmation — update your response posture as additional details emerge.

Published Friday, June 12, 2026 at 03:57 AM PT BLUF: Google has confirmed active in-the-wild exploitation of a zero-day vulnerability in Oracle PeopleSoft (CVE-2026-35273) by threat actor ShinyHunters. Oracle has mitigated the flaw but has not publicly confirmed exploitation. Organizations running PeopleSoft should treat this as an emergency patching priority. DETAILS CVE-2026-35273 affects Oracle PeopleSoft; specific technical details of the vulnerability class (e.g., RCE, authentication bypass) have not been publicly confirmed at this time. Google — attribution source not yet specified (Threat Intelligence, Mandiant, or Project Zero — unconfirmed which team) — has confirmed the vulnerability was exploited in the wild prior to patching. ShinyHunters is the attributed threat actor. The group has a documented history of large-scale data theft and extortion operations, including credential harvesting and database exfiltration. Oracle has deployed a mitigation for CVE-2026-35273 but has not issued a public advisory confirming exploitation as of this alert. The gap between vendor and third-party confirmation is notable and should be monitored. Patch availability status beyond Oracle’s mitigation action is not yet confirmed — it is unclear whether a full patch is available or if workarounds are the current remediation path. IMPACT Directly affected: Organizations running Oracle PeopleSoft — commonly deployed in higher education, government, and large enterprise environments for HR, finance, and student administration. Scope: Potentially broad. PeopleSoft deployments frequently contain sensitive PII, payroll, financial, and HR data — consistent with ShinyHunters’ historical targeting profile. Data exfiltration risk is elevated given ShinyHunters’ operational pattern of bulk data theft for sale or extortion. RECOMMENDED ACTIONS Apply Oracle’s mitigation immediately. Do not wait for a full patch release. Contact Oracle support for guidance specific to your deployment version. Audit PeopleSoft access logs for anomalous authentication attempts, unusual API calls, or unexpected data exports — particularly over the past 30–60 days. Restrict external-facing PeopleSoft access where operationally feasible pending full remediation. Monitor Oracle’s security advisory portal for a formal CVE disclosure and patch release. Brief incident response teams now. If ShinyHunters has already accessed your environment, early detection is critical to limiting exfiltration scope. SOURCES SecurityWeek — “Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters” Oracle mitigation action: confirmed via SecurityWeek reporting; no independent Oracle advisory confirmed at time of publication. ⚠️ UNCERTAINTY FLAG: Oracle has not publicly confirmed exploitation. Vulnerability technical class, affected version range, and Google attribution team are unconfirmed. This alert will require update as details emerge. ...

Published Thursday, June 11, 2026 at 03:55 PM PT BLUF: Mandiant and Google Threat Intelligence Group have confirmed an active compromise and extortion campaign by ShinyHunters (tracked as UNC6240) targeting Oracle PeopleSoft infrastructure in the education sector. Organizations running Oracle PeopleSoft should treat this as an active threat and audit systems immediately. DETAILS Mandiant and Google Threat Intelligence Group (GTIG) jointly attributed the campaign to UNC6240, a threat actor publicly known as ShinyHunters, a group with a documented history of large-scale data theft and extortion operations. The campaign specifically targets Oracle PeopleSoft application infrastructure — widely deployed across universities and higher education institutions for HR, finance, and student data management. The activity involves both compromise and extortion, indicating data exfiltration is likely occurring or has occurred prior to ransom demands being issued. NOTE: Specific CVE identifiers, exploit technical details, and confirmed victim count have not been confirmed in available source material at this time — treat those details as pending. ShinyHunters has previously been linked to high-volume credential theft and data broker activity; education sector targeting aligns with the group’s history of pursuing large repositories of PII. IMPACT Primary targets: Higher education institutions and universities running Oracle PeopleSoft for ERP, HCM, or student information systems. Data at risk: Student records, employee PII, financial data, and authentication credentials stored within PeopleSoft environments. Scope: Confirmed active campaign — not a historical or theoretical threat. Extortion component suggests victims may face public data exposure or sale if demands are not met. Secondary risk: Institutions using PeopleSoft in healthcare, government, or enterprise contexts should also elevate monitoring posture pending further scope clarification. RECOMMENDED ACTIONS Immediately audit Oracle PeopleSoft internet-facing instances for signs of unauthorized access, anomalous queries, or privilege escalation. Review and restrict external access to PeopleSoft portals — enforce MFA where not already in place. Check Oracle patch status — ensure all available PeopleSoft security patches are applied; prioritize any recent Critical Patch Update (CPU) advisories. Hunt for indicators — engage threat intelligence feeds for UNC6240/ShinyHunters IOCs; Mandiant customers should query GTIG directly for campaign-specific indicators. Activate incident response protocols if anomalous access is detected — do not delay pending full investigation. Notify legal and compliance teams proactively given the extortion component and likely PII exposure. SOURCES Mandiant / Google Threat Intelligence Group (GTIG) — active campaign attribution Source detail on specific exploit mechanism and full victim scope: PENDING — monitor Mandiant and Oracle Security Advisories for updates

Published Thursday, June 11, 2026 at 03:54 PM PT BLUF: Threat actor ShinyHunters is actively exploiting a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft to breach university networks. All higher education institutions running Oracle PeopleSoft should treat this as an active threat requiring immediate action. No patch status confirmed at time of publication. DETAILS ShinyHunters — a financially motivated threat actor with a documented history of large-scale data theft and extortion — has been attributed to active exploitation of CVE-2026-35273 in Oracle PeopleSoft. The vulnerability is described as a zero-day, meaning exploitation is occurring without a publicly available patch at the time of reporting. Patch availability has not been independently confirmed in the source material provided. Confirmed targets are universities; the number of affected institutions, specific names, and volume of data compromised are not confirmed in available reporting. The nature of the vulnerability (e.g., authentication bypass, RCE, SQL injection) is not specified in source material — treat all PeopleSoft attack surfaces as potentially in scope until Oracle publishes an advisory. ShinyHunters has previously exfiltrated and auctioned stolen data; data exposure for affected institutions should be assumed until ruled out. IMPACT Who: Higher education institutions globally running Oracle PeopleSoft — commonly used for student information systems (SIS), HR, and financial data. Data at risk: Potentially includes student PII, financial records, employee data, and academic records — scope unconfirmed. Breadth: Number of breached institutions unknown at this time. Assume threat is ongoing and opportunistic. RECOMMENDED ACTIONS Immediately audit Oracle PeopleSoft internet-facing instances for signs of unauthorized access, unusual queries, or lateral movement. Restrict external access to PeopleSoft portals where operationally feasible pending patch availability. Monitor Oracle’s security advisory portal (https://www.oracle.com/security-alerts/) for an emergency patch or mitigation guidance for CVE-2026-35273. Review logs for indicators of compromise associated with ShinyHunters TTPs, including bulk data staging and exfiltration activity. Notify incident response teams and legal/compliance functions now — student and employee PII exposure may trigger regulatory notification obligations (FERPA, GDPR, state breach laws). Do not wait for Oracle confirmation before initiating defensive measures. ⚠️ UNCERTAINTY FLAGS Patch availability, vulnerability class, and full victim list are unconfirmed in source material. CVE-2026-35273 is a future-dated identifier — verify against Oracle’s official CVE registry before finalizing internal reporting. SOURCES The Hacker News — ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities Additional context: Broader active exploitation trend across enterprise platforms (Cisco SD-WAN, PAN-OS, Oracle WebLogic) suggests elevated threat environment for unpatched infrastructure.

Published Thursday, June 11, 2026 at 03:54 PM PT BLUF: Oracle has mitigated a zero-day vulnerability in PeopleSoft that threat actors actively exploited to steal data. Organizations running PeopleSoft should apply Oracle’s mitigation immediately and audit systems for signs of unauthorized data access. DETAILS Oracle has confirmed a zero-day vulnerability in PeopleSoft was exploited in the wild prior to mitigation, resulting in confirmed data theft incidents. Oracle has issued a mitigation — note: it is not confirmed at this time whether a full patch is available or whether the mitigation is a workaround only; organizations should verify patch status directly with Oracle support. The vulnerability was exploited before Oracle could issue a fix, classifying this as a true zero-day exploitation event. Specific technical details of the vulnerability (CVE assignment, attack vector, authentication requirements) are not confirmed in available reporting at this time. Threat actor identity, campaign scope, and volume of affected organizations are currently unknown. IMPACT Directly affected: Organizations running Oracle PeopleSoft — commonly deployed in higher education, government, and large enterprise environments for HR, finance, and student information systems. Data at risk: PeopleSoft environments typically contain sensitive HR records, payroll data, financial data, and personally identifiable information (PII) — high-value targets for data theft and extortion. Scope: Unknown at this time. Active exploitation confirmed; breadth of victim organizations has not been publicly disclosed. RECOMMENDED ACTIONS Apply Oracle’s mitigation immediately. Access Oracle Support (My Oracle Support) for the specific mitigation guidance relevant to your PeopleSoft version. Audit access logs on PeopleSoft systems for anomalous queries, bulk data exports, or unauthorized API calls — particularly in the period prior to mitigation deployment. Restrict external-facing PeopleSoft access where operationally feasible until a full patch is confirmed available and applied. Engage your incident response process if any indicators of compromise are identified; assume data exfiltration may have occurred if systems were internet-accessible during the exploitation window. Monitor Oracle’s security advisories for CVE assignment and additional technical indicators. SOURCES BleepingComputer — Oracle mitigates PeopleSoft zero-day exploited in data theft attacks ⚠️ UNCERTAINTY FLAG: Technical specifics including CVE identifiers, affected version ranges, attack vectors, and threat actor attribution are unconfirmed in available reporting. This alert will require update as Oracle releases formal advisory documentation.