ShinyHunters Exploited Oracle Zero-Day Before Patch Disclosure
Extortion group breached universities via unpatched PeopleSoft flaw, stealing data for ransom during two-week window before Oracle's advisory.
The extortion crew known as ShinyHunters exploited an unpatched vulnerability in Oracle PeopleSoft to breach enterprise systems and steal data between May 27 and June 9. Oracle did not publish an advisory for the flaw—tracked as CVE-2026-35273—until June 10, leaving organizations exposed during the active exploitation window.
Google's Mandiant attributes the campaign to UNC6240, a group it associates with ShinyHunters. Universities bore the brunt of the intrusions. The attackers exfiltrated data and demanded payment to prevent its release, following the group's established extortion model.
The timing gap between exploitation and vendor disclosure underscores the risk window organizations face when zero-day flaws reach active use before patches exist. PeopleSoft is deployed widely across higher education and enterprise environments for human resources, finance, and student administration.
- 01Universities running PeopleSoft face heightened data breach and extortion risk
- 02Enterprises must assess exposure to CVE-2026-35273 and patch immediately
- 03Oracle customers may question disclosure timelines when zero-days are actively exploited
Ransomware attack executed entirely by AI agent, researchers report
JadePuffer operation marks what may be the first documented case of a fully autonomous LLM-driven ransomware deployment from reconnaissance to encryption.
Agentic AI Executes Multi-Stage Ransomware Attack via Langflow
Demonstration shows large language model agents autonomously combining exploitation techniques with real-time reasoning to conduct complex intrusions without human intervention.
FortiBleed Attackers Monetize Firewall Access Through Ransomware Partnerships
Actors who compromised thousands of Fortinet devices are now collaborating with Inc and Lynx ransomware groups, adding Nextcloud exploitation to their toolkit.