Loading article…
Oracle alerts customers to a zero‑day flaw in PeopleSoft that was used by the ShinyHunters group to breach over 100 organizations, many in higher education.
Oracle has issued a security advisory warning that a critical‑rated vulnerability in its PeopleSoft enterprise software can be exploited remotely without authentication, a flaw that the ShinyHunters hacking group says it used to breach more than 100 organizations [1].
Key takeaways
The advisory, published on Thursday, describes the PeopleSoft vulnerability as “critical‑rated” and notes that it can be exploited over the internet without any credentials [1]. Oracle has not yet provided a patch, instead urging customers to apply interim mitigations. The flaw was first publicized when a member of the ShinyHunters gang told TechCrunch that the group had compromised more than 100 organizations by exploiting the unpatched bug [1].
Mandiant, Google’s security unit, confirmed that the same vulnerability is being used in the ShinyHunters campaign and that it has alerted over 100 organizations—predominantly U.S. universities and colleges—about the risk [1]. According to Mandiant, roughly two‑thirds of the affected entities are in higher education, matching the group’s own claims. Some victims successfully blocked the activity or remediated the flaw, while others suffered data theft that was later posted on the ShinyHunters data‑leak website [1].
The stolen data, as described by the hackers, includes “hundreds of thousands of student records” containing personal identifiers, contact information, enrollment status, GPA, major, and student IDs across multiple campuses [1]. This mirrors previous ShinyHunters operations that have targeted software such as Salesforce, Gainsight, and Instructure’s Canvas, often demanding ransom after exfiltrating corporate or student data [1].
The PeopleSoft incident is part of a series of recent breaches affecting Oracle’s product lines. Earlier in the year, a separate cybercrime gang was suspected of compromising Oracle’s MICROS point‑of‑sale division, infecting more than 700 systems and prompting Oracle to reset passwords on a support portal [2]. While that breach involved legacy PoS hardware, the PeopleSoft attack targets enterprise resource planning software used for payroll and human‑resources management.
Coverage is mostly measured — 7 of 7 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
Reports indicate that vulnerabilities were exploited in Oracle's PeopleSoft and E-Business Suite (EBS) platforms.
Attackers are exploiting software vulnerabilities to gain unauthorized access, often without requiring authentication, and deploying malicious implants to steal data.
Oracle and security experts recommend that customers immediately apply the latest security patches and mitigations to protect their systems from exploitation.
Security researchers also note that another campaign, attributed to the Cl0p ransomware group, exploited zero‑day flaws in Oracle’s E‑Business Suite (EBS) and listed over 100 victims across diverse sectors [3]. Although the Cl0p operation is distinct from ShinyHunters, the pattern underscores the attractiveness of Oracle’s widely deployed enterprise applications to cybercriminals.
The PeopleSoft vulnerability highlights the risk of unpatched, internet‑exposed enterprise software, especially in sectors that handle sensitive personal data such as education. With no patch available, organizations must rely on mitigations and heightened monitoring to prevent exploitation. The breach also illustrates how threat actors chain together multiple software platforms—PeopleSoft, Salesforce, Canvas—to maximize impact and extortion potential.
Going forward, affected customers are expected to implement Oracle’s recommended mitigations while awaiting a formal patch. Security firms like Mandiant will likely continue to issue alerts and guidance to the broader community. The incident reinforces the need for rapid vulnerability disclosure and coordinated response across vendors, customers, and security researchers to limit the damage from zero‑day exploits.
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 4 outlets · Jun 11, 2026 · How we report