ShinyHunters is actively extorting universities after exploiting an unpatched Oracle flaw

Researchers report that the ShinyHunters cybercrime group exploited a zero-day in Oracle PeopleSoft PeopleTools (CVE-2026-35273) to achieve unauthenticated remote code execution, potentially compromising networks and stealing data from more than 100 organizations—68% in higher education; attacks began around May 27, extortion is ongoing, Google and Mandiant are tracking victims, and Oracle has not yet released a patch.