erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: June 10, 2026

1 editorial brief and 8 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day. PeopleSoft customers on PeopleTools 8.61 or 8.62, above all universities running Campus Solutions and any organization with PeopleSoft exposed to the internet.
  • Go: 7 critical advisories (github.com/kubev2v/migration-planner, github.com/dhax/go-base, github.com/kubev2v/assisted-migration-agent). Check with govulncheck ./....
  • npm: 1 critical advisory (baileys, @whiskeysockets/baileys). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-35273

Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day

If you run PeopleTools 8.61 or 8.62 with PIA reachable from the internet, apply Oracle's fix and lock down the EMHub/PSIGW paths today, then hunt back to May 27, 2026.

Must act: PeopleSoft customers on PeopleTools 8.61 or 8.62, above all universities running Campus Solutions and any organization with PeopleSoft exposed to the internet.

Can relax: Organizations that do not run PeopleSoft, or whose PeopleSoft web tier is reachable only from internal networks and has been patched, are at much lower risk.

  1. Apply the remediation in Oracle's CVE-2026-35273 Security Alert for PeopleTools 8.61/8.62
  2. Disable the Environment Management Hub (EMHub) in multi-server setups, or remove the PSEMHUB application in single-server setups
  3. Block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter (non-breaking for normal PIA sessions, per Mandiant)

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 8

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 7

Check: govulncheck ./...

npm 1

Check: npm audit (or: npm ls <package>)