ShinyHunters exploits PeopleSoft zero-day, hits 100+ orgs

A cybercrime group known as ShinyHunters has breached Oracle PeopleSoft enterprise software systems at more than 100 organizations, primarily universities, in a campaign exploiting a critical, unpatched vulnerability. The attacks, which occurred between late May and early June, resulted in the theft of sensitive personal data, with extortion demands sent to the victims.

The campaign targeted a remote code execution flaw, tracked as CVE-2026-35273, in Oracle's PeopleSoft Enterprise PeopleTools. The vulnerability, rated 9.8 out of 10 in severity, resides in the software's Environment Management Hub component. It requires no user credentials or interaction, allowing attackers to take over servers simply by accessing them over a network. Oracle published an advisory and a patch for the flaw on June 10, but the vulnerability was a zero-day for the duration of the active exploitation window.

Security researchers from Google's Mandiant, which tracks the group as UNC6240, detailed the attack method. The attackers used Python servers to host staging files, including custom remote-management agents disguised as Microsoft Azure binaries and a lateral movement script. This script, named...