Remediation
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
Immediate Containment
! Immediately block perimeter access to /PSEMHUB/* (specifically /PSEMHUB/hub) and /PSIGW/HttpListeningConnector at firewall/WAF.
! Isolate PeopleSoft servers exhibiting anomalous outbound connections to 142.11.200.186-190 or 176.120.22.24.
Exposure Reduction & Patching
🛡️ Restrict EMHub and Integration Broker listening endpoints to internal management subnets only.
🛡️ Disable outbound SMB (TCP port 445) from PeopleSoft hosts to internet destinations.
📦 Apply Oracle Security Alert Advisory for CVE-2026-35273 immediately across all PeopleSoft environments.
📦 Ensure all PeopleSoft application instances run actively supported maintenance releases.
Configuration & Credentials
⚙️ Harden WebLogic configuration to disallow dynamic deployment via EMHub where unnecessary.
⚙️ Implement network segmentation between PeopleSoft web tier and internal database tiers.
🔑 Rotate all administrative, WebLogic, database, and system accounts on compromised and peered PeopleSoft systems.
🔑 Invalidate active user and administrative session tokens across PeopleSoft Internet Architecture.
Evidence Preservation
📁 Capture volatile memory and preserve WebLogic access logs, bash history, and /tmp directory contents prior to remediation.
Verification & Rollback
✓ Verify that HTTP requests to /PSEMHUB/hub return 403 or are dropped at perimeter.
✓ Run vulnerability scan to confirm CVE-2026-35273 patch installation.
↩️ Rollback: Maintain snapshot of configuration files prior to applying emergency perimeter blocks to prevent operational regression.