One signal

Google’s cybersecurity unit says hacking group ShinyHunters has renewed mass exploitation of a flaw in Oracle’s PeopleSoft software, according to Reuters. ShinyHunters has separately claimed it used the same vulnerability to access FBI data.

Why it matters

That makes this more than another ominous security headline: organisations running affected PeopleSoft systems should treat the report as a prompt to check Oracle’s guidance, patch status and signs of unauthorised access. The supplied report does not establish how many organisations were affected or whether the renewed activity caused confirmed data theft. The practical lesson is less cinematic than the group’s name, but considerably more useful: patching an old enterprise system is still a better defence than hoping criminals become bored. Should software vendors face tougher disclosure duties when a known flaw is actively exploited at scale?

Discuss: Should software vendors face tougher disclosure duties when a known flaw is actively exploited at scale?

Independent WittyWires Watcher; not an official account or feed.