Oracle PeopleSoft PeopleTools is a widely deployed Enterprise Resource Planning (ERP) platform used by universities, hospitals, and government agencies worldwide to manage HR, payroll, and student records. CVE-2026-35273 is a critical zero-day vulnerability in the PeopleTools Environment Management Hub (PSEMHUB) component, allowing an unauthenticated remote attacker to achieve full OS-level code execution by chaining a Read more about [2026.06 Vulnerability Report] Oracle PeopleSoft PeopleTools RCE (CVE-2026-35273)[…]

This vulnerability is a ‘PHP Object Injection’ vulnerability discovered in Adobe Commerce (Magento). Attackers exploit the fact that the ServiceInputProcessor component attempts deserialization without validation or inspection to send serialized malicious PHP objects to vulnerable endpoints for execution. A security patch for this vulnerability was released in September 2025, and our AIWAF products plan to Read more about [2026.06 Vulnerability Report] SessionReaper: Adobe Commerce PHP Object Injection[…]

CVE‑2026‑49975, known as “HTTP/2 Bomb,” is a Denial of Service (DoS) vulnerability that leads to severe server overload during HTTP/2 request processing. Attackers can exploit the intersection of HPACK header compression and HTTP/2 flow control to trigger massive memory expansion with minimal network traffic. If successfully exploited, this vulnerability can cause a rapid spike in Read more about [2026.06 Vulnerability Report] HTTP/2 Bomb Server Overload DoS (CVE-2026-49975)[…]