ShinyHunters Weaponizes Oracle PeopleSoft zero‑day (CVE‑2026‑35273) to Assault Universities

The ShinyHunters extortion gang leveraged the Oracle PeopleSoft zero‑day (CVE‑2026‑35273) to infiltrate multiple university networks, pilfering sensitive records and threatening exposure unless a ransom was paid.

Oracle PeopleSoft zero‑day fuels campus breaches

Activity, traced by Mandiant, spanned ↓ 14 days from May 27 to June 9, with Oracle’s advisory appearing only on June 10, a ↓ 1 day lag that left institutions exposed. University IT teams scrambled to patch systems while attackers exfiltrated data. Google’s Mandiant attributes the operation to the UNC6240 group, known for ransomware‑as‑a‑service campaigns.

“The rapid exploitation of an unpatched PeopleSoft flaw underscores the need for continuous vulnerability management,” a security analyst told Reuters.

The breach highlights how legacy ERP platforms remain attractive targets, prompting calls for tighter supply‑chain oversight. For further context, see the analysis by Bloomberg.