# Oracle warns of critical PeopleSoft bug exploited by ShinyHunters

**Published:** 2026-06-11T21:12:34.212Z  
**Topic:** Oracle warns of security bug that hackers abused to breach 100+ companies  
**Sentiment:** neutral  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/5b8025e4-ec73-401e-9563-39864490bf30

Oracle alerts customers to a zero‑day flaw in PeopleSoft that was used by the ShinyHunters group to breach over 100 organizations, many in higher education.

Oracle has issued a security advisory warning that a critical‑rated vulnerability in its PeopleSoft enterprise software can be exploited remotely without authentication, a flaw that the ShinyHunters hacking group says it used to breach more than 100 organizations [1].  

**Key takeaways**  
- The PeopleSoft bug is a zero‑day that allows unauthenticated internet access to the system [1].  
- ShinyHunters claims to have stolen extensive student records from dozens of universities [1].  
- Mandiant has notified over 100 global organizations, about two‑thirds of which are U.S. higher‑education institutions [1].  
- Oracle has not yet released a patch and recommends mitigation steps for affected customers [1].  
- The incident follows a pattern of attacks on software platforms, including prior campaigns against Salesforce, Gainsight, and Instructure [1].  

## Critical PeopleSoft flaw and the ShinyHunters campaign  

The advisory, published on Thursday, describes the PeopleSoft vulnerability as “critical‑rated” and notes that it can be exploited over the internet without any credentials [1]. Oracle has not yet provided a patch, instead urging customers to apply interim mitigations. The flaw was first publicized when a member of the ShinyHunters gang told TechCrunch that the group had compromised more than 100 organizations by exploiting the unpatched bug [1].  

Mandiant, Google’s security unit, confirmed that the same vulnerability is being used in the ShinyHunters campaign and that it has alerted over 100 organizations—predominantly U.S. universities and colleges—about the risk [1]. According to Mandiant, roughly two‑thirds of the affected entities are in higher education, matching the group’s own claims. Some victims successfully blocked the activity or remediated the flaw, while others suffered data theft that was later posted on the ShinyHunters data‑leak website [1].  

The stolen data, as described by the hackers, includes “hundreds of thousands of student records” containing personal identifiers, contact information, enrollment status, GPA, major, and student IDs across multiple campuses [1]. This mirrors previous ShinyHunters operations that have targeted software such as Salesforce, Gainsight, and Instructure’s Canvas, often demanding ransom after exfiltrating corporate or student data [1].  

## Broader context of Oracle‑related attacks  

The PeopleSoft incident is part of a series of recent breaches affecting Oracle’s product lines. Earlier in the year, a separate cybercrime gang was suspected of compromising Oracle’s MICROS point‑of‑sale division, infecting more than 700 systems and prompting Oracle to reset passwords on a support portal [2]. While that breach involved legacy PoS hardware, the PeopleSoft attack targets enterprise resource planning software used for payroll and human‑resources management.  

Security researchers also note that another campaign, attributed to the Cl0p ransomware group, exploited zero‑day flaws in Oracle’s E‑Business Suite (EBS) and listed over 100 victims across diverse sectors [3]. Although the Cl0p operation is distinct from ShinyHunters, the pattern underscores the attractiveness of Oracle’s widely deployed enterprise applications to cybercriminals.  

## Why it matters  

The PeopleSoft vulnerability highlights the risk of unpatched, internet‑exposed enterprise software, especially in sectors that handle sensitive personal data such as education. With no patch available, organizations must rely on mitigations and heightened monitoring to prevent exploitation. The breach also illustrates how threat actors chain together multiple software platforms—PeopleSoft, Salesforce, Canvas—to maximize impact and extortion potential.  

Going forward, affected customers are expected to implement Oracle’s recommended mitigations while awaiting a formal patch. Security firms like Mandiant will likely continue to issue alerts and guidance to the broader community. The incident reinforces the need for rapid vulnerability disclosure and coordinated response across vendors, customers, and security researchers to limit the damage from zero‑day exploits.

## Sources
1. TechCrunch — [Oracle warns of security bug that hackers abused to breach 100+ companies](https://techcrunch.com/2026/06/11/oracle-warns-of-security-bug-that-hackers-abused-to-breach-100-companies/)
2. Securityweek — [Cybercrime Gang Suspected in Attack on Oracle PoS Division -](https://www.securityweek.com/cybercrime-gang-suspected-attack-oracle-pos-division/)
3. Securityweek — [Oracle EBS Hack: Only 4 Corporate Giants Still Silent on](https://www.securityweek.com/oracle-ebs-hack-only-4-corporate-giants-still-silent-on-potential-impact/)
4. Thehackernews — [oracle — Latest News, Reports & Analysis | The Hacker News](https://thehackernews.com/search/label/oracle)

---
Cite as: TrendWatcher, "Oracle warns of critical PeopleSoft bug exploited by ShinyHunters", https://www.trendwatcher.in/article/5b8025e4-ec73-401e-9563-39864490bf30