Oracle PeopleSoft zero‑day fuels ShinyHunters extortion spree

Attackers exploited a critical zero-day vulnerability (CVE-2026-35273, an unpatched security flaw) in Oracle PeopleSoft's Environment Management component to break into over 100 organizations, primarily universities, and steal sensitive data including billing records and student finance information. The ShinyHunters group used the RCE (remote code execution, the ability to run commands on systems they don't own) flaw to gain initial access, then deployed a disguised remote monitoring tool to maintain control and extract data. Oracle issued a security advisory on June 10, 2026, urging customers to patch immediately.