Oracle PeopleSoft zero‑day exploited in mass hack of 100+ firms

Oracle’s PeopleSoft software, used for payroll and HR, contains a critical vulnerability that was exploited by the ShinyHunters hacking group to breach more than 100 organizations, most of them in the United States [1]. Mandiant, Google’s security unit, confirmed the same flaw is being used in the campaign and has notified the affected firms [1].

Key takeaways

• Oracle issued a security advisory for an unauthenticated, internet‑exploitable bug in PeopleSoft [1].
• ShinyHunters claims the attack stole extensive student records from several universities [1].
• Mandiant reported that about two‑thirds of the compromised entities are higher‑education institutions [1].
• No patch was available at the time of reporting; Oracle recommends mitigations until a fix is released [1].
• The breach follows a pattern of attacks on software platforms, including earlier campaigns against Salesforce, Gainsight, and Instructure [1].

Oracle’s advisory and the ShinyHunters campaign

On June 11, 2026, Oracle published a security advisory describing a critical‑rated vulnerability in PeopleSoft that can be exploited without any authentication [1]. The advisory came a day after ShinyHunters publicly claimed to have accessed more than 100 organizations that run PeopleSoft servers. A member of the group told TechCrunch that the attackers leveraged an unpatched zero‑day flaw, meaning Oracle had no prior fix when the bug was first used [1].

Mandiant’s blog post corroborated the claim, stating that the same vulnerability is at the heart of the ShinyHunters campaign. The security firm has reached out to over 100 global organizations—primarily U.S. companies—to advise them of the risk and to help block further exploitation [1]. While many of the notified firms have applied mitigations or blocked the activity, others suffered data theft that was later posted on the ShinyHunters data‑leak site [1].

The attackers also disclosed a message sent to a victim university, alleging the theft of “hundreds of thousands of student records” containing personal details such as names, addresses, dates of birth, GPAs and student IDs [1]. This mirrors previous ShinyHunters operations that targeted software platforms like Salesforce, Gainsight, and the education platform Canvas, where the group has repeatedly used ransomware and extortion tactics [1].

Broader context of software‑platform attacks

The PeopleSoft breach is part of a larger trend of threat actors focusing on widely deployed enterprise applications. Earlier in the year, the Cl0p ransomware group claimed responsibility for a separate campaign against Oracle’s E‑Business Suite (EBS), listing more than 100 alleged victims across sectors from technology to healthcare [2]. Although the Cl0p operation is linked to the FIN11 cluster, the pattern of exploiting zero‑day flaws in Oracle products underscores the high value placed on such software by attackers.