Shiny Hunters Exploits Oracle People Soft Zero-Day (CVE-2026-35273) to Breach Universities

Summary: The ShinyHunters extortion crew, tracked by Google's Mandiant as UNC6240, exploited an unpatched remote code execution flaw in Oracle PeopleSoft (CVE-2026-35273, rated 9.8) between May 27 and June 9, before Oracle published its advisory on June 10. Mandiant notified more than 100 organizations with matching vulnerable endpoints, 68 percent of them in higher education and most in the United States, and the University of Nottingham is among the first confirmed victims.
What's compelling: The attackers left their own staging servers open, exposing a fanout script that sprays hardcoded credentials over SSH and drops a file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT, while Have I Been Pwned counts about 455,000 leaked email addresses including passport numbers and disability details. ShinyHunters says victim outreach has only just started and has not posted most of the organizations it claims, so the confirmed list is likely to grow.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2026-35273
Related: Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild Cyber Risks ·
Shiny Hunters-Exploited Oracle People Soft Zero-Day Turns Out to Be Three Chained Flaws Cyber Risks ·
Shiny Hunters Renewed Mass Exploitation Campaign Targeting Oracle People Soft Cyber Risks · Sep 25, 2026