# Oracle PeopleSoft zero‑day exploited in mass hack of 100+ firms

**Published:** 2026-06-11T21:12:34.212Z  
**Topic:** Oracle warns of security bug that hackers abused to breach 100+ companies  
**Sentiment:** neutral  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/a5c649e6-4efd-4014-8fcd-b6e041943964

Oracle warned of a critical PeopleSoft flaw after the ShinyHunters group claimed to breach over 100 organizations, prompting Mandiant to alert affected

Oracle’s PeopleSoft software, used for payroll and HR, contains a critical vulnerability that was exploited by the ShinyHunters hacking group to breach more than 100 organizations, most of them in the United States [1]. Mandiant, Google’s security unit, confirmed the same flaw is being used in the campaign and has notified the affected firms [1].

**Key takeaways**  
- Oracle issued a security advisory for an unauthenticated, internet‑exploitable bug in PeopleSoft [1].  
- ShinyHunters claims the attack stole extensive student records from several universities [1].  
- Mandiant reported that about two‑thirds of the compromised entities are higher‑education institutions [1].  
- No patch was available at the time of reporting; Oracle recommends mitigations until a fix is released [1].  
- The breach follows a pattern of attacks on software platforms, including earlier campaigns against Salesforce, Gainsight, and Instructure [1].

## Oracle’s advisory and the ShinyHunters campaign  

On June 11, 2026, Oracle published a security advisory describing a critical‑rated vulnerability in PeopleSoft that can be exploited without any authentication [1]. The advisory came a day after ShinyHunters publicly claimed to have accessed more than 100 organizations that run PeopleSoft servers. A member of the group told TechCrunch that the attackers leveraged an unpatched zero‑day flaw, meaning Oracle had no prior fix when the bug was first used [1].  

Mandiant’s blog post corroborated the claim, stating that the same vulnerability is at the heart of the ShinyHunters campaign. The security firm has reached out to over 100 global organizations—primarily U.S. companies—to advise them of the risk and to help block further exploitation [1]. While many of the notified firms have applied mitigations or blocked the activity, others suffered data theft that was later posted on the ShinyHunters data‑leak site [1].  

The attackers also disclosed a message sent to a victim university, alleging the theft of “hundreds of thousands of student records” containing personal details such as names, addresses, dates of birth, GPAs and student IDs [1]. This mirrors previous ShinyHunters operations that targeted software platforms like Salesforce, Gainsight, and the education platform Canvas, where the group has repeatedly used ransomware and extortion tactics [1].

## Broader context of software‑platform attacks  

The PeopleSoft breach is part of a larger trend of threat actors focusing on widely deployed enterprise applications. Earlier in the year, the Cl0p ransomware group claimed responsibility for a separate campaign against Oracle’s E‑Business Suite (EBS), listing more than 100 alleged victims across sectors from technology to healthcare [2]. Although the Cl0p operation is linked to the FIN11 cluster, the pattern of exploiting zero‑day flaws in Oracle products underscores the high value placed on such software by attackers.  

Both campaigns illustrate how cybercriminals first identify a vulnerable platform, then compromise the organizations that rely on it, often stealing data for ransom or public exposure. The lack of immediate patches for the PeopleSoft bug left many firms exposed, prompting Oracle to advise mitigations while a fix is developed [1].  

## Why it matters  

The confirmed exploitation of a PeopleSoft zero‑day highlights the urgent need for organizations to monitor vendor advisories and apply mitigations promptly, especially for software that handles sensitive personal and payroll data. With higher‑education institutions comprising a large share of the victims, the breach raises concerns about student privacy and potential regulatory scrutiny. As Mandiant continues to work with affected firms, the incident also serves as a reminder that even critical‑rated vulnerabilities can remain unpatched for weeks, giving threat actors a window to conduct large‑scale data theft. Companies using PeopleSoft should follow Oracle’s recommended mitigations and prepare for possible disclosures if data was exfiltrated.

## Sources
1. TechCrunch — [Oracle warns of security bug that hackers abused to breach 100+ companies](https://techcrunch.com/2026/06/11/oracle-warns-of-security-bug-that-hackers-abused-to-breach-100-companies/)
2. Securityweek — [Oracle EBS Hack: Only 4 Corporate Giants Still Silent on](https://www.securityweek.com/oracle-ebs-hack-only-4-corporate-giants-still-silent-on-potential-impact/)
3. Blog — [Random Oracle – Building and breaking systems](https://blog.randomoracle.io/)

---
Cite as: TrendWatcher, "Oracle PeopleSoft zero‑day exploited in mass hack of 100+ firms", https://www.trendwatcher.in/article/a5c649e6-4efd-4014-8fcd-b6e041943964