# Chrome zero-day, PeopleSoft flaw hit universities, VPN bypass exploited

Published: 2026-06-15 · Severity: high · Sectors: education, technology, financial-services, government-national
Canonical: https://vorant.io/reports/38ac0861-b52b-5f2d-800b-209548aa1e0c/chrome-zero-day-peoplesoft-flaw-hit-universities-vpn-bypass-exploited

> Google patched an actively exploited Chrome zero-day (CVE-2026-11645); ShinyHunters exploited Oracle PeopleSoft (CVE-2026-35273) targeting higher education; Check Point VPN bypass (CVE-2026-50751) used in Qilin ransomware attacks.

Google released fixes for 74 Chrome vulnerabilities including CVE-2026-11645, an out-of-bounds memory access in the V8 engine actively exploited in the wild. This marks the fifth Chrome zero-day patched in 2026. Meanwhile, the ShinyHunters extortion crew exploited CVE-2026-35273, a critical authentication bypass in Oracle PeopleSoft, between May 27 and June 9, 2026. The campaign primarily targeted higher education, affecting over 100 organizations with 68% being universities and colleges. Attackers conducted reconnaissance using MeshCentral, performed lateral movement, and exfiltrated data before publishing it on their leak site.

Check Point disclosed active exploitation of CVE-2026-50751, a critical VPN authentication bypass affecting Remote Access VPN and Mobile Access deployments using deprecated IKEv1. Exploitation began as early as May 7, 2026, ramping up in June and affecting a few dozen targeted organizations globally. In one incident, post-exploitation activity was linked to a Qilin ransomware affiliate. Additionally, the FBI took down Outsider, a Chinese PhaaS platform responsible for 3.87 million stolen credit cards and $1.9 billion in losses since July 2023, while over 1,500 Arch Linux packages were compromised to deliver the atomic-lockfile stealer and rootkit.

The Gentlemen ransomware operation, active since March 2025, has claimed 478 victims. The group initially operated as an affiliate leveraging LockBit, Qilin, and Medusa RaaS platforms before launching its own operation in September 2025. Meanwhile, threat actors exploited UniFi OS vulnerabilities (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) for unauthenticated root code execution, and campaigns leveraging AI brand names as lures distributed credential stealers and malware through phishing, malvertising, and fake installers.

## Mentioned in this report

- Vulnerabilities: CVE-2026-11645 (KEV), CVE-2026-2441 (KEV), CVE-2026-34908 (KEV), CVE-2026-34909 (KEV), CVE-2026-34910 (KEV), CVE-2026-35273 (KEV), CVE-2026-3909 (KEV), CVE-2026-3910 (KEV), CVE-2026-50751 (KEV), CVE-2026-5281 (KEV)
- Threat actors: Fox Tempest, Khmer Shadow, Phantom Mantis, ShinyHunters, Storm-3075, Transparent Tribe
- Malware: Akira, Havoc Demon, LockBit, MagicAd, MeshCentral, NIGHTFORGE, Qilin, Vidar Stealer, atomic-lockfile

## Detection guidance (public sample)

### Suspicious Child Process Spawned by Exploited Web Application Server

ATT&CK: T1190

Detects command interpreters or shells launched by web/application server processes (e.g. Java, IIS worker, Tomcat), consistent with exploitation of internet-facing applications such as PeopleSoft or VPN gateways followed by post-exploitation command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by Exploited Web Application Server
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \w3wp.exe
    - \java.exe
    - \javaw.exe
    - \tomcat.exe
    - \httpd.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \bitsadmin.exe
    - \certutil.exe
  filter:
    CommandLine|contains:
    - HealthCheck
    - monitoring
  condition: selection and not filter
  falsepositives:
  - Legitimate application server administration scripts invoking system utilities
  - Scheduled health-check or monitoring scripts launched by the application server
    account
  level: high
  tags:
  - attack.t1190
  - attack.t1071.001
id: 9e3ffc6c-14e8-57c8-a3cc-5f6aeadbf8ff
status: experimental
author: Vorant
```

### Office Application Spawning Script Interpreter After Attachment Open

ATT&CK: T1204.002

Detects Microsoft Office applications spawning script interpreters or command shells, a common pattern following opening of malicious spearphishing attachments used to deliver credential stealers and malware in phishing campaigns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script Interpreter After Attachment Open
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \winword.exe
    - \excel.exe
    - \powerpnt.exe
    - \outlook.exe
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \cmd.exe
  filter:
    CommandLine|contains:
    - AddIns
  condition: selection and not filter
  falsepositives:
  - Legitimate Office macros or add-ins that invoke scripting for automation
  - Enterprise document automation tooling built on Office COM automation
  level: high
  tags:
  - attack.t1204.002
  - attack.t1566.001
  - attack.t1027
id: 3788c7d2-7f7a-52ab-a467-4ea36147d598
status: experimental
author: Vorant
```

### Security Tooling Disabled via Service Control Prior to Ransomware Deployment

ATT&CK: T1562.001

Detects use of sc.exe, net.exe, or PowerShell to stop or disable security/endpoint protection services, a common precursor step observed before ransomware encryption (e.g. Qilin, Gentlemen affiliates) following initial access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Security Tooling Disabled via Service Control Prior to Ransomware Deployment
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \sc.exe
    - \net.exe
    - \net1.exe
    - \powershell.exe
  selection_cmd:
    CommandLine|contains:
    - stop
    - disable
    - config start= disabled
  selection_target:
    CommandLine|contains:
    - defender
    - sense
    - antivirus
    - sophos
    - mcafee
    - crowdstrike
    - sentinelone
    - webroot
    - wuauserv
  condition: selection_img and selection_cmd and selection_target
  falsepositives:
  - Authorized security software migration or maintenance performed by IT staff
  - Endpoint agent reinstallation scripts that stop services before upgrade
  level: high
  tags:
  - attack.t1562.001
  - attack.t1486
id: 4650c248-380d-5ec4-94f2-1d2b9f7a7265
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://thehackernews.com/2026/06/weekly-recap-chrome-0-day-unifi.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/38ac0861-b52b-5f2d-800b-209548aa1e0c/chrome-zero-day-peoplesoft-flaw-hit-universities-vpn-bypass-exploited.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup