ShinyHunters have found a way to bypass a mitigation for a zero-day they previously exploited - so now, not only are they back to abusing the same bug, they’ve even expanded their scope to target a much larger pool of organizations.
In June 2026, it was reported that ShinyHunters, the infamous data extortionists, found a Java deserialization vulnerability in Oracle’s PeopleSoft Environment Management Hub (PSEMHUB) servlet that allowed them to achieve web shell deployment or fileless command execution on vulnerable servers.
Oracle PeopleSoft is a suite of enterprise business software used mainly by large organizations, universities, governments, and corporations to manage things like human resources, finance, supply chain, and student administration.
This remote code execution (RCE) bug caused by unsafe deserialization of Java objects in PSEMHUB was exploited for days, targeting higher education institutions, stealing their sensitive files, and enabling extortion campaigns.
Oracle fixed the issue on June 10 2026, bringing the tool to versions 8.61 and 8.62. The bug was assigned an identifier CVE-2026-35273 and was given a severity score of 9.8/10 (critical). The US Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog on June 12, giving federal agencies a three-day deadline to patch up.
ShinyHunters ReturnThe company also provided mitigation measures for organizations that were unable to install the patch at the time. However, Mandiant and Google’s Threat Intelligence Group (GTIG) are now reporting that ShinyHunters found a way to bypass these mitigations, and are back to exploiting the flaw against organizations running unpatched versions of the software.
“This new wave of activity stems from UNC6240 modifying its exploit to bypass web application firewall (WAF) rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint,” the two organizations said in a new report, stressing that the campaign has now expanded globally.
“The threat actor bypassed these string-based WAF rules by URL-encoding a single character in the request path, requesting /%50SEMHUB/ in place of /PSEMHUB/,” the researchers said. “Many WAF and reverse proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet. This allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure.”
At first, ShinyHunters were focused mostly on higher education institutions. This time around, though, they’re casting a much wider net, deploying web shells on “dozens of systems globally” including technology, IT services, healthcare, agriculture, transportation, and government.
“Mandiant recommends that organizations running Oracle PeopleSoft take the following immediate actions,” the researchers added.
ShinyHunters are known extortionists. They are using the PeopleSoft vulnerability to gain persistent access and steal credentials, allowing them to move laterally through target environments and exfiltrate sensitive data such as HR or payroll.
Patching worksThe good news is that the patch still works. If an organization applied Oracle’s fix for CVE-2026-35273, this WAF bypass should not matter, because it only works around the mitigation, not the underlying vulnerability fix. Therefore, both Google and Mandiant advise, first and foremost, that organizations apply the Oracle Security Alert issued when the zero-day was first disclosed.
Businesses should also disable the Environment Management Hub (EMHub) service in multi-server configurations, or remove the PSEMHUB application entirely, in single-server configurations.
To check whether they were targeted or not, they should search PIA WebLogic access logs for requests to /PSEMHUB) and any percent-encoded variant, and should inspect /webserv//applications/peoplesoft/PSEMHUB.war/ for files that are not part of the shipped product.
Finally, they should rotate all credentials the PeopleSoft application service account can read, and monitor outbound traffic from PeopleSoft hosts to the network indicators listed here.
We've seen robot delivery schemes before, but none quite like this: British delivery company Evri has partnered with Refined Robotics in Japan to run the first trial of a two-legged delivery robot in Europe — with Barnsley, the UK's first official Tech Town, chosen as the location.
According to the announcement, the bot doesn't have an official name, but is designed to give customers "more choice, convenience and control over how they receive their parcels" according to Evri's Chief Technology Officer Marcus Hunter.
Most of the delivery robots we've seen to date look like cool boxes trundling along on wheels, but the bipedal approach of this new machine means it can navigate its way around obstacles and even get up stairs if necessary.
For the purposes of this pilot scheme at least, the idea is to have the robot act as a "support" for couriers, so it won't be going out delivering parcels on its own (and can't drive a van anyway). The bot can move at speeds of up to 6 kph (3.7 mph), and carry parcels up to 15 kilograms (33 pounds) in weight.
Last-mile logisticsEvri has previously tested four-wheeled delivery robots (Image credit: Evri)Evri says its delivery robot is able to traverse "uneven surfaces", and get in and out of a delivery van. It can be remotely controlled or work autonomously as the situation demands, and can drop off parcels with or without the recipient being present — so presumably it has a trick for releasing its cargo without any help.
Perhaps understandably, in these early stages the robot is going to be delivering "fashion parcels", as per the BBC — so nothing that's going to get broken or bashed in transit if the robot takes a tumble on the kerbside.
There's no word yet on if or when this might be rolled out more widely: Evri is going to evaluate all aspects of the delivery service trial to see what works and what doesn't, and how robots might ultimately be of most use to customers and couriers.
"Our two-legged delivery robot has been specifically designed to tackle some of the most complex challenges in last-mile logistics," says Refined Robotics CEO Nick Hafner. "[We] look forward to understanding how robotics can complement existing delivery networks and support the future of parcel delivery."
The Trump administration has weakened fuel efficiency standards for new cars. And, prosecutors have reopened a Cornell University fraternity rape case.
(Image credit: Matt Burkhartt)
New Morgan McKinley research has claimed more than half (55%) of UK employers still don't use AI in recruitment – putting Britain far behind the global average of 36% non-users.
And on the other side of the process, UK jobseekers are also apparently wary of AI being used to assess them, with more than a quarter (28%) saying AI-based assessments would make them less likely to apply for a job (again, more than the 23% global average).
However, concerns over AI's usage are clearly more pronounced in certain areas, because 78% of global candidates use AI at some point in their job searching journey.
Recruiters and applicants are still wary about AI's use in recruitmentUltimately, it seems that AI could be obscuring human assessment processes, for example two in five UK employers say the use of AI has made it harder to verify applicants' skills. Head hunters also note that AI has led to a higher volume of applications they're having to process, likely increasing quantity but not quality.
"As candidates increasingly use AI in their job searches and employers grapple with verifying skills and experience, organisations will need to balance the benefits of AI with transparency and human oversight," Morgan McKinley UK Senior MD Chris Lawton explained.
More broadly, it's clear that job-related concerns continue to plague AI adoption, with nearly half (46%) of global employees worried that AI could replace their job, even though 64% of employers say it hasn't actually impacted headcount.
Moving forward, the report calls for a more meaningful approach to AI adoption with supported training opportunities. With just one in four workers believing their employer is investing adequately in their AI development and Morgan McKinley data revealing that two-thirds (68%) have had either inadequate or zero AI training, this area is clearly lacking.
"Organisations need to give their people the skills, guidance and governance to use AI effectively and responsibly, rather than leaving individuals to navigate this transition alone," Lawton concluded.
Think PCs are getting too pricey due to the RAM crisis? That's clearly true, but if you thought a top-end computer (with the likes of an RTX 5090 GPU) was getting ridiculously costly, it's nothing compared to this fanless rig which is fashioned from pure gold.
FanlessTech flagged up the PC from Kubb (via VideoCardz), a European manufacturer that specializes in fancy mini PCs. This take on the Kubb Fanless, a 120mm cube with no active cooling (fans), so it's silent, is made from 24-carat gold, rather than the aluminum that would normally be used for this model.
The gold version, which was built to order for a (presumably wealthy) customer, reportedly weighs 13kg (over six times the weight of the aluminum chassis), but the price tag is the real eye-opener here, as the PC runs to around $1.7 million (or £1.3 million / AU$2.4 million). Essentially the value of its weight in gold, of course.
As for the spec, the Kubb Fanless normally offers options of up to an Intel Core Ultra X7 358H or AMD Ryzen AI 5 340 CPU with up to 128GB of DDR5 RAM, although it's entirely possible that the buyer may have upped the spec with a custom request here.
Analysis: worth its weight in gold(Image credit: FanlessTech / Kubb)What's interesting is that as FanlessTech points out, gold is a good material to make a fanless PC from due to its heat transference properties. Indeed, it offers around a 30% better level of thermal conductivity than aluminum, so you're actually getting much improved passive cooling here — for a price (and a half).
While this might appear to be an outlandish extravagance on the face of it, the other way to look at this solid-gold take on the Kubb Fanless is that it's an investment, in the same way as buying gold bars. The price of this precious metal has risen sharply since the pandemic, and I'm guessing the wealthy buyer has that in mind with this purchase — as well as showing off. (Don't take any of this as investment advice, I hasten to add — it certainly isn't offered as such.)
The nominees for the 44th annual Golden Joystick Awards have been officially announced across 21 categories, with games like Resident Evil Requiem, Big Walk, and 007 First Light leading nominations.
Public voting is now live and will remain open until October 23 at 4pm PT / 7pm ET / 0:00am BST. Fans can vote for their favourite games of 2026 in 21 categories, including Console Game of the Year, PC Game of the Year, Most Wanted Game, and more.
Winners will be revealed during the ceremony on November 11, with the Ultimate Game of the Year shortlist to be announced on October 26.
"With the hugely-anticipated GTA 6 set to launch a week after our live show, the 44th annual Golden Joystick Awards is delighted to share its most diverse and creative nominees line-up yet," said Daniel Dawkins, content director of Golden Joystick Awards at Future.
"Indie hits Big Walk, Dispatch and Mina the Hollower sit alongside AAA blockbusters such as 007 First Light, Forza Horizon 6 and Resident Evil Requiem. This year, no single game dominates the field, this is one of our most open and unpredictable years yet - making your vote more influential than ever in deciding our winners. We’re thrilled to debut a new look for the Golden Joystick Awards, embracing the iconic joystick trophy that traces all the way back to our inception in 1983. Gaming has changed so much in the following 43 years, but not the creativity and determination of those who sacrifice so much to share the games we love so much."
The Golden Joystick Awards 2026 - NominationsConsole Game of the Year
PC Game of the Year
Best Audio Design
Best Early Access Game
Best Game Adaptation
Best Game Expansion
Best Game Trailer
Best Gaming Hardware
Best Indie Game
Best Indie Game - Self-published
Best Lead Performer
Best Supporting Performer
Best Multiplayer Game
Best Remake / Remaster
Best Soundtrack
Best Storytelling
Best Visual Design
Most Wanted Game
Still Playing - Mobile
Still Playing - PC & Console
Studio of the Year
You can’t even buy the iPhone Duo yet, but that hasn’t stopped developers from working on apps for it — and there’s already one app that could, for me, almost justify an iPhone Duo purchase all on its own.
Vidit Bhargava has shared details of their ‘Duo-Man’ app on X, and it’s designed to recreate the experience of an old-school Walkman.
This is something that only works with a foldable form factor, and the dimensions of the iPhone Duo look ideal for it, with the cover screen acting as the front of a Walkman — where you can see a tape spinning away and access controls — and the foldable screen being something that you can open to insert or remove a tape.
Duo-Man offers the complete walkman experience on the iPhone Duo. Open the Duo to pick and 'insert' the cassette, Close the Duo to start listening.Yes, I actually recorded the button clicks and static noise from a real Walkman!It was fun making this at @bitrig hacks today. pic.twitter.com/juSrLhofrHSeptember 27, 2026
A digital take on analog techOf course, you’re not actually jamming a tape into the iPhone Duo, but the interface of the app comes close to replicating what a Walkman looks like, and the act of opening and closing the screen to insert a new tape should help recreate some of the tactility of that device too.
The app also includes button click and static sounds recorded from a real Walkman, just to add to the nostalgia value, and you’ll even be able to use an Apple Pencil to wind the tapes.
But this has some modern conveniences too, with support for both Apple Music and local files (with Spotify support possibly being added later), so you’ll have access to a massive library of ‘tapes’ immediately, rather than having to carry around multiple real tapes with you (as we did in the 90s if we didn’t want to hear the same thing on repeat).
The app — like the iPhone Duo itself — isn’t available yet, but it’s seemingly going to be a hit when it does launch, given that the X post about it currently has 2.1 million views and 10,000 likes.
The Dutch government has become the latest European ruler to announce plans to invest more heavily in sovereign software in a bid to reduce its reliance on foreign tech vendors, including Microsoft, following an earlier April 2026 pilot.
The DAWO (Digitaal Autonome Werkomgeving Overheid), which translates loosely as the Digital Autonomous Work Environment for Government scheme, covers a broad spectrum of software changes.
Besides just ditching Windows in favor of an open-source alternative, the Netherlands wants to explore cloud infrastructure, productivity software and more.
Dutch government announces plans to ditch MicrosoftThough the migration is still in its early stages, small-scale trials are reportedly taking place across the country's public bodies, with eight municipalities allegedly preparing trials.
Naturally, the long-term migration is likely to take years and include multiple bids, but the country expects the first migrations to have happened by the end of next year, per Tom's Hardware.
The biggest migration will likely involve Microsoft's Windows operating system. Windows currently accounts for around 63% of global desktops across all users, per Statcounter data – a proportion that's dropping as macOS and other operating systems rise in popularity.
NixOS is set to be the replacement, developed by Dutch develop Eelco Dolstra with the NixOS Foundation based in the Netherlands itself. openSUSE and Fedora were also reportedly trialled before reaching the decision to go for NixOS.
The Netherlands is also said to be working with other European tech vendors, like France's La Suite and Germany's openDesk, in a broader pro-European push.
Ultimately, what the Netherlands is doing is a move we're seeing reflected across the bloc, with government agencies and other public bodies seeking to support sovereign and homegrown tech amid complex geopolitical happenings, set against a backdrop of concerns, namely potential US government access to American software users' data.
And the Netherlands is just one of a growing list of countries making similar moves – Germany's Schleswig-Holstein state already revealed plans to migrate a long time ago, together with Estonia, the French city of Lyon and more.
As the EU AI Act’s transparency requirements come into force, organizations need to be on the front foot when it comes to regulatory readiness and how AI is being used. Facing fines of up to €35 million or 7% of global turnover mean it’s no longer enough to just monitor communication risks. Firms must definitively prove how those risks were identified, reviewed, and escalated.
When regulators ask questions, most compliance teams don’t face the issue of a lack of data. In most cases, the information does exist somewhere within the organization. The harder challenge is bringing that evidence together quickly, clearly, and defensibly across different systems, workflows, and teams.
That challenge is becoming more important as regulators place greater emphasis on demonstrable outcomes. Firms are increasingly expected to show not only that controls exist, but how those controls operate when a potential risk emerges. This is where comms surveillance has become central to effective compliance.
From surveillance activity to supervisory outcomesComms surveillance has typically been measured through activity. Compliance teams have tracked how many alerts were generated, how many reviews were completed, how many cases were escalated, and how many investigations were closed.
Those metrics still matter, but they only tell part of the story.
A stronger measure of readiness is whether a firm can connect surveillance activity to supervisory outcomes. Can it explain why a particular risk was identified? Can it show how an alert was reviewed? Can it document the evidence that supported a decision? Can it demonstrate whether escalation was appropriate? And, crucially, can it reconstruct that process months later when a regulator asks for evidence?
These are the questions that now sit at the heart of regulatory readiness.
The evidence chain is often too fragmentedMost firms have already solved the basic issue of capturing communications. The next stage is more complex: connecting communications, alerts, reviews, investigations, and outcomes into a clear and defensible chain of evidence.
Too often, that chain is fragmented and therefore, obsolete. Comms often sit in one platform, while surveillance workflows sit in another, and investigation records somewhere else entirely. Each system may function effectively in isolation, but the gaps are evident when compliance teams need to explain what happened from start to finish.
This is especially pertinent as AI-driven communications become a bigger compliance risk. Our research found while more than half (55%) of organizations globally have the core AI policies, training and review steps in place, fewer than one in five (19%) have the logging, retention, detection and scoring controls needed to prove what happened.
Without that evidence layer in place, organizations lack being able to confidently demonstrate what AI tools produced, who reviewed it, where it went and whether the record was kept.
The result is unnecessary friction: investigations take longer than they should, evidence is harder to assemble, and supervisory decisions still require additional manual validation.
Regulatory requests become more disruptive when teams have to spend valuable time piecing together information that should already be connected. This risks turning into an operational readiness nightmare.
Transparency is becoming a regulatory expectationAs regulatory expectations continue to evolve, firms need to be able to demonstrate how oversight works in practice. In other words, showing how potential risks are identified, how decisions are made, how evidence is reviewed, and how outcomes are recorded.
A surveillance program is only truly effective if it can support that level of transparency. Regulators may not prescribe a specific architecture, but they do expect firms to show that oversight is effective, repeatable, and defensible.
That's why organizations are now looking beyond individual tools and towards a more unified approach to communications governance, surveillance, investigations, and retention.
Operational visibility matters as much as information storageOperational visibility is becoming just as important as data capture. Compliance teams need to understand where information is stored, as well as how it moves through the organization once a potential issue is identified.
They need to be able to follow the full chain of activity from initial alert through to investigation, escalation, decision, and retention. Comms surveillance has become a critical part of evidence framework.
Done well, it helps teams identify risk earlier, investigate issues more efficiently and demonstrate how supervision operated over time.
Readiness is about proving what happenedThe priority is now creating the context needed to make better decisions, and to evidence those decisions effectively.
Regulatory readiness increasingly depends on the ability to demonstrate judgement: why a case was reviewed, what information was considered, whether escalation was required and how the final outcome was reached. Without that connected view, even well-run processes can become difficult to defend.
Comms surveillance is therefore moving from a narrow monitoring function to a core component of regulatory preparedness. It provides the first line of evidence for how potential risk was identified, assessed, and resolved. It also gives firms the foundation they need to demonstrate that supervision is not only in place, but working effectively.
In today’s regulatory environment, readiness is all about being able to prove what happened, not simply locating the information.
We've featured the best AI website builder.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit
Not so long ago, tiny ereaders like the Xteink X4 Pro seemed like a novel concept, but now, we seem to be hearing more about them than standard-size ereaders; along with the Xteink line, there’s the recently announced Boox Picco, and now Honor is getting in on the act too with the Honor Life S3.
This device was announced alongside the Honor Magic 9 series of phones, and just like Xteink’s products, it can magnetically attach to the back of your phone, essentially giving you a second screen on your handset — though you can also use the Honor Life S3 separately if you simply want a tiny ereader on its own.
It has a 3.68-inch e-paper screen with 259 pixels per inch, and it weighs just 61g and measures 5.6mm thick. So whether you’re attaching it to your phone or just putting it in your pocket, it’s not going to add much bulk or weight.
(Image credit: Honor)Unlike most rival devices, the Honor Life S3 is entirely touchscreen, with no physical page buttons. Most alternatives either don’t have a touchscreen or have both.
According to GizmoChina it also has a “soft-light eye-protection feature” designed to make it easy on your eyes during lengthy reading sessions, and a battery that’s said to deliver 30 hours of run time in continuous use, and up to a week of life with typical use.
It uses a microSD card for storage, supports most common ebook and document formats, and runs a custom operating system, with the ability to transfer books wirelessly through the Honor Smart Space app.
So, as with most of these tiny ereaders you’re not getting Android, meaning there’s no access to the Kindle or Kobo stores.
Carving out a tiny nicheOverall, the Honor Life S3 sounds like some combination of the Xteink X4 Pro and the Xteink X3, with a touchscreen like the X4 Pro but a screen size that’s closer to the X3, and the magnets that both offer — but which some rivals like the Boox Picco don’t.
The Honor Life S3 is, however, marginally thicker and heavier than the Xteink X3, with that coming in at 5.1mm thick and 58g. There’s not much in it, but that could still make a difference if you want the slimmest and lightest device possible. The Xteink X4 Pro is a bit bigger and heavier, but you’re also getting a larger 4.3-inch screen there.
What the Honor Life S3 might have going for it is that it comes from a more recognizable brand, albeit one that doesn’t currently have a massive presence outside China. Indeed, so far it’s only been announced for China, so it remains to be seen whether you’ll even be able to buy it elsewhere.
Personally, there’s nothing here that would tempt me away from the Xteink X4 Pro that I already have, but if I didn’t already own that device and this was available, I’d certainly consider it.
Naughty Dog co-president Neil Druckmann has confirmed the studio is working on more games to expand the world of The Last of Us.
To close out this year's The Last of Us Day, Druckmann shared new insight into the studio's current projects, including Intergalactic: The Heretic Prophet, and what's next for The Last of Us.
In a blog post, The Last of Us Part 2 director revealed that two new The Last of Us projects are in early development, saying Naughty Dog hopes to "expand the canon" of the first two games.
"Since Grounded II, we’ve talked about the possibility of telling more stories in the world of The Last of Us," Druckmann said. "We have a couple of very exciting new projects in very early stages – so we can’t say much about them at this point. I will tell you that both projects will expand the canon of The Last of Us beyond Part 1 and Part 2.
"The world of The Last of Us means a great deal to us, and we wouldn’t return to it unless we had something meaningful to say. We believe these stories are worth telling."
As for Intergalactic, which was revealed almost two years ago, Druckmann said the development team is "heads down on what is shaping up to be Naughty Dog’s most ambitious game yet."
"There’s an electricity around the studio right now as all the pieces come together, and we’re stoked to finally unveil Intergalactic in all its glory. But...we need to cook for just a little bit longer," he said.
Druckmann said the team will remain quiet for the rest of 2026, but in 2027, it will "fully reveal" the game and give fans "a proper look."
"We know it’s been a long time since we’ve had much to share with you. We don’t take your continued support for granted," he added. "We’re working incredibly hard to make something worthy of your patience. Until then…Endure & Survive!"
Companies have changed the way they price their products — and shoppers are getting deliberately overcharged. Here are steps you can take to ensure you are getting the best deal.
Turkey's bid for regional influence comes at a time when the Middle East has been hit by profound shocks that started with the Hamas-led 2023 attack on Israel, and continues with the stalemated, seven-month-old war on Iran.
(Image credit: Seth Wenig)
Lloyds has launched a new tool designed to help its business banking customers spend less time on admin and more time actually running their business.
The new Get Paid invoicing and payment collection tool will look to support business customers with their payments admin within their existing Lloyds app and online banking platform.
Powered by Lloyds’ strategic partnership with BankiFi, the service will come at no additional cost and without the need to purchase separate invoicing or accountancy software.
Get Paid“Businesses shouldn't have to pay extra for the tools they need to get paid," said Ruchir Rodrigues, BCB Client Strategy & Commercial Director at Lloyds.
"By building invoicing and payment collection directly into the Lloyds banking experience at no additional cost, we're making it easier for customers to manage cashflow and spend more time growing their business.”
Get Paid will mean Lloyds business customers can now carry out tasks such as creating and sending invoices, issue secure payment links and track paid and outstanding requests through the Lloyds app and online banking.
Customers will also be able to send invoices and use automated reminders, cutting down on time being spent following up payments from their customers. Late payments are a particular concern for many SMBs, with recent UK Government research finding nearly half (49%) reporting their business customers typically take longer to pay than the agreed terms.
The Office of the Small Business Commissioner also recently estimated 14,000 businesses close each year because of late payments and UK businesses are owed around £26 billion in overdue payments at any given time, an average of £17,000 per business.
Lloyds says the launch will contribute towards its view of "embedded accounting", as having all these systems in one central location will also let customers manage more of their day-to-day finances in one place, with less need to move between separate systems and records.
Five men arrested on terror charges near U.K. air base released on bail, Trump administration rolls back fuel efficiency standards for new vehicles, prosecutors reopen Cornell fraternity rape case.
Jaimie Bethea, a 21-year-old mass communication specialist, had been deployed on the USS Fort Lauderdale for more than 11 months. She died by suicide in June.
(Image credit: Arianna Calderon)
The Trump administration is weakening Biden-era fuel efficiency standards for new cars and trucks.