ShinyHunters MeshCentral Session Hijacking on PeopleSoft via meshctrl.js RunCommand

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•7

Detects unauthorized execution of MeshCentral's meshctrl.js to interface with a local WebSocket endpoint on PeopleSoft servers, likely indicative of session hijacking post-exploitation of CVE-2026-35273 by the ShinyHunters threat group.