ShinyHunters' Expanding Toolkit: Oracle PeopleSoft Zero-Day Exploitation and the BreachForums Defense Gaps

Episode notes

ShinyHunters dominated headlines this week: a zero-day, a BreachForums listing, and unverified claims all hitting at once. The problem isn't just keeping up with the volume. It's knowing which of it is real, which is noise, and what your team actually needs to act on. Join hosts Tehman and John as they discuss: ShinyHunters zero-day exploitation of CVE-2026-35273 Why a BreachForums listing extends the threat well beyond the initial compromise What proactive, resource-development-stage detection looks like in practice Two questions your organization should be asking right now: Is your Oracle PeopleSoft Environment Management Hub internet-facing? Do you have dark web and criminal forum monitoring in place to detect before the attack begins? Resources: John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest. Tehman Tariq : Sr. Manager of Cyber Operations at ReliaQuest. He has spent a majority of my career leading our Incident Response, Security Architecture, and Detection teams.

• How Hackers Are Using AI Right Now: Faster Attacks, Smarter Malware, and a New Arms Race73 / 100
• Klue, Kali365, OAuth: When the Front Door Is a Trusted Integration
• China-Linked Cyber Espionage: How OP-512 Exploited Legacy IIS Servers and Evaded Detection
• SonicWall, MFA Bypass, IABs: Why Patched Devices Are Still Handing Attackers Initial Access
• Device Code, OAuth, PhaaS: How Session Token Theft is Breaking the Phishing Playbook