Cyber gang ShinyHunters attacks Oracle PeopleSoft vulnerability:
The criminal group ShinyHunters is attacking the critical security vulnerability in Oracle ...
heise.de/news/Cybergang-ShinyHunters-attackiert-Oracle-PeopleSoft-Schwachstelle-11331861.html
Photo: heise.de · view article
ShinyHunters Apparently Targets Oracle PeopleSoft FlawMandiant has observed attacks since May 27, 2026, targeting PeopleTools versions 8.61 and 8.62.
- According to Oracle, CVE-2026-35273 enables unauthenticated code execution through HTTP and carries a critical CVSS score of 9.8.
- Mandiant says ShinyHunters, also known as UNC6240, has exploited the flaw for extortion attacks since May 27, 2026.
- The US agency CISA added the vulnerability to its catalog of known exploited vulnerabilities.
- Mandiant contacted more than 100 organizations worldwide whose IP addresses correlated with vulnerable endpoints; slightly over two-thirds of US organizations were in higher education.
Story Details
| Last Updated | |
| Total Articles | 1 |
Main Topics
Similar to This
Previous
FBI removed an Accenture contractor after a data breach exposed thousands of employees' records
qz.com/fbi-accenture-contractor-shinyhunters-data-breach-100626
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks: The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall ...
bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/
dlvr.it Sep 25
ShinyHunters tells The Reg: We hacked the FBI to 'protect our business': Data theft and extortion biz, that is
theregister.com/cyber-crime/2026/09/25/shinyhunters-tells-the-reg-we-hacked-the-fbi-to-protect-our-business/5299250
FBI rushes to investigate if ShinyHunters hack of thousands of employees is real: It's unclear what will happen if FBI misses ShinyHunters' deadline.
arstechnica.com/tech-policy/2026/09/fbi-rushes-to-investigate-if-shinyhunters-hack-of-thousands-of-employees-is-real/
Hacker-on-Hacker Crime: ShinyHunters Is Trying to Extort CLOP Ransomware Group: Cybercriminal group ShinyHunters claims to have hijacked the website of a rival ...
pcmag.com/news/hacker-on-hacker-crime-shinyhunters-is-trying-to-extort-clop-ransomware
Nissan discloses employee data breach linked to Oracle zero-day attacks: Nissan is warning that it suffered a data breach affecting current and former employees ...
bleepingcomputer.com/news/security/nissan-discloses-employee-data-breach-linked-to-oracle-zero-day-attacks/
NAIC says public data stolen in ShinyHunters' PeopleSoft breach: The National Association of Insurance Commissioners (NAIC) says the ShinyHunters extortion ...
bleepingcomputer.com/news/security/naic-says-public-data-stolen-in-shinyhunters-peoplesoft-breach/
dlvr.it Jun 29
Nissan says Oracle PeopleSoft break-in may have spilled payroll records, SSNs: Carmaker points finger at an 'unknown' flaw as customer fallout continues
theregister.com/security/2026/06/29/nissan-says-oracle-peoplesoft-break-in-may-have-spilled-payroll-records-ssns/5263534
dlvr.it Jun 15
Council of Europe hacked in ShinyHunters' PeopleSoft heist: Joins the ranks of Nottingham Uni and 100 other unnamed victims
theregister.com/cyber-crime/2026/06/15/council-of-europe-hacked-in-shinyhunters-peoplesoft-heist/5255757
Google Sounds Alarm On Active Oracle PeopleSoft Zero-Day Attacks Linked To ShinyHunters - Alphabet (NASDA
benzinga.com/markets/tech/26/06/53161062/google-sounds-alarm-on-active-oracle-peoplesoft-zero-day-attacks-linked-to-shinyhunters
PeopleSoft 0-day affecting hundreds of organizations steals gigabytes of data: Vulnerability in the Oracle-owned PeopleSoft software is about as critical as they ...
arstechnica.com/security/2026/06/peoplesoft-0-day-affecting-hundreds-of-organizations-steals-gigabytes-of-data/
Oracle warns of security bug that hackers abused to breach 100+ companies: The tech giant warned of a security flaw that a cybercrime gang said it's ...
techcrunch.com/2026/06/11/oracle-warns-of-security-bug-that-hackers-abused-to-breach-100-companies/
dlvr.it Jun 11
ShinyHunters claims Oracle PeopleSoft 0-day hit 100+ orgs: University of Nottingham is first of many, Shiny tells The Reg
theregister.com/cyber-crime/2026/06/11/shinyhunters-claims-oracle-peoplesoft-0-day-hit-100-orgs/5254443
Oracle mitigates PeopleSoft zero-day exploited in data theft attacks: Oracle is warning about a critical PeopleSoft Suite zero-day vulnerability tracked ...
bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks/
Nottingham University data breach affects over 450,000 students: The University of Nottingham confirmed on Wednesday that a hacking group gained access to its ...
bleepingcomputer.com/news/security/nottingham-university-data-breach-affects-over-450-000-students/
Vimeo: Data available for download on the darknet after data leak: The cyber gang ShinyHunters is offering Vimeo data, stolen via an Anodot hack ...
heise.de/news/Vimeo-Cybergang-ShinyHunters-stellt-Daten-ins-Darknet-11277692.html
Next