Summary
ShinyHunters — the prolific data-theft and extortion group tracked by Mandiant as UNC6240 — has exploited a critical zero-day vulnerability in Oracle PeopleSoft to breach more than 100 organizations, the vast majority of them universities and colleges in the United States.
The flaw, CVE-2026-35273 (CVSS 9.8), is a pre-authentication remote code execution bug in the PeopleSoft Enterprise PeopleTools Environment Management Hub. ShinyHunters weaponized it between May 27 and June 9, weeks before Oracle shipped an out-of-band patch on June 10. Mandiant and Google Threat Intelligence Group (GTIG) identified the campaign and notified over 100 organizations with exposed endpoints — 68% of them higher-education institutions.
The University of Nottingham is among the confirmed victims, with roughly 455,000 current and former students affected and 40 GB of data — including names, addresses, passport numbers, ethnicities, disabilities, and academic enrollment records — published online after ransom demands were refused. ShinyHunters claims to have compromised over 300 PeopleSoft instances across the campaign.
Source
The Hacker News — ShinyHunters Exploits Oracle PeopleSoft Zero-Day · CyberScoop · Google Threat Intelligence
Commentary
This campaign is a textbook demonstration of why unmanaged internet-facing enterprise middleware remains one of the most dangerous attack surfaces. PeopleSoft installations are deeply embedded in higher education — handling student records, financial aid, HR — and many run on versions that receive inconsistent patch attention. The fact that ShinyHunters had nearly two weeks of zero-day exploitation time before Oracle even acknowledged the vulnerability is damning.
For defenders, the takeaway is immediate: audit every PeopleSoft instance for exposure on the Environment Management Hub endpoint, apply Oracle’s out-of-band patch, and restrict external HTTP access to PeopleSoft environments. For the broader community, this is yet another reminder that threat actors like ShinyHunters are not slowing down — they are scaling up, targeting entire software ecosystems rather than individual organizations.