1 article on this topic.
The FBI says ShinyHunters got in because a contractor never applied an Oracle PeopleSoft patch that had been out since June. The incident is a clear case of a perimeter rule being treated as a substitute for the fix.