Oracle's Payment System Is Under Active Attack

Oracle E-Business Suite — enterprise software used by large organisations to manage finance, procurement, and operations — has a critical flaw in its Payments module that attackers are already exploiting, according to The Hacker News.

The vulnerability, CVE-2026-46817, carries a CVSS score of 9.8 (Critical). It allows anyone on a network to take full control of the Oracle Payments system without logging in first. Think of it like a bank vault where the lock mechanism responds to any key — including one the attacker made themselves five minutes ago.

What makes this notable is that no public proof-of-concept (a working demonstration of how the exploit works) exists. Researchers at Defused Cyber spotted the attacks over the weekend on systems set up specifically to attract attackers. Whoever is doing this worked it out independently.

Oracle issued a patch last month as part of its Critical Security Patch Update. That patch exists. The organisations being hit simply have not applied it.

This follows a pattern with Oracle's enterprise products. An earlier flaw in Oracle PeopleSoft Suite was exploited by the ShinyHunters group to steal employee records from Nissan — including payroll data, bank details, and Social Security numbers for workers across four countries.

What you should do: If your organisation runs Oracle E-Business Suite versions 12.2.3 through 12.2.15, confirm with your IT team that last month's Critical Security Patch Update has been applied. If you are unsure, assume it has not been and escalate today.

Security firm LayerX has demonstrated an attack technique, called BioShocking, that tricks AI browsers into handing over user credentials — and it worked on six different agents, according to The Hacker News.

AI browsers in agent mode can act on your behalf: clicking, typing, and accessing sites you are already signed in to. BioShocking exploits this using indirect prompt injection (a technique where a malicious web page slips instructions into the stream of content the agent reads, disguised as ordinary text). The attack dressed those instructions as game rules — and once the agent accepted "wrong answers win," it followed game logic over safety logic, handing over SSH credentials from a GitHub repository without hesitation.

ChatGPT Atlas was patched. Perplexity closed the report without acting. Anthropic's fix did not hold.

What you should do: Treat agent mode as a session with real consequences. Sign out of accounts you are not actively using, and limit what an AI browser can reach before enabling it.

What LoadMaster is: An application delivery controller and load balancer that enterprises use to manage and distribute incoming traffic across servers — it sits at the network edge, making it a high-value target.

What it is: An unauthenticated attacker can send a specially crafted request to LoadMaster's API and execute arbitrary commands as the root (highest-privilege) user. No login required.

Who's at risk: Any organisation running an affected LoadMaster version with the API enabled and network-accessible. A working proof of concept is now public as of June 29.

CVSS: 9.8 (Critical) — patch today.

Root cause: A function called escape_quotes() was meant to sanitise user input before passing it to a shell command. It allocated a memory buffer (a reserved block of storage for temporary data) without clearing it, and never wrote a null terminator (a marker character that tells the system "the string ends here"). Without that marker, the system reads past the sanitised input into adjacent memory — which an attacker can pre-load with a command injection payload (malicious commands disguised as ordinary input).

Attack vector: The attacker sends a JSON request to the /accessv2 endpoint, embedding a crafted apiuser value alongside dozens of extra keys each carrying the command to execute. The system sanitises the first value, keeps reading past it, and executes the attacker's commands as root. No credentials needed at any point.

Detection strategies: Look for unusual POST requests to /accessv2 with abnormally large JSON bodies or unexpected key counts. Monitor for root-level process spawning triggered by the LoadMaster process. Alert on any shell commands initiated from the LoadMaster API service.

Recommended actions:

1. Upgrade to GA v7.2.63.2 or LTSF v7.2.54.18 immediately.
2. If patching is not immediately possible, restrict API access to trusted IP ranges at the firewall.
3. Review LoadMaster API access logs for anomalous requests sent before the patch was applied.

WhatsApp is rolling out usernames globally today, and reserving yours is worth doing immediately, according to The Hacker News.

Once enabled, your phone number becomes invisible to anyone who contacts you via username. They need your exact username to find you — and optionally a username key (a secondary code you set that new contacts must also know before they can message you). No public directory exists, so you cannot be discovered by browsing.

This matters because phone numbers are a common starting point for SIM-swapping attacks, spam, and targeted scams. Removing your number from the equation cuts off one well-travelled route.

To reserve your username: Open WhatsApp, go to Settings > Account > Username, and follow the prompts. The feature is rolling out gradually, so it may not appear immediately.

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog to confirm that ransomware groups are actively exploiting CVE-2026-33825, a Microsoft Defender privilege escalation flaw known as BlueHammer, according to Bleeping Computer. The flaw allows a local attacker to access password data and escalate to full system control. Microsoft patched it on 14 April 2026. Federal agencies were ordered to patch by 7 May. If your Windows devices have not received the April Patch Tuesday update, that changes today.