FBI contractor removed after breach tied to unpatched PeopleSoft flaw

The FBI confirmed a breach affecting thousands of employees after a contractor failed to apply a critical Oracle PeopleSoft patch (CVE-2026-35273), exploited by actors including ShinyHunters. The incident highlights third-party patching risk: Verizon's 2026 breach report notes vulnerability exploitation is now the leading initial access vector, with AI compressing disclosure-to-exploitation timelines, and breaches involving third parties up 60 percent.

Sources: scworld.com