ShinyHunters Exploits Oracle PeopleSoft Zero-Day Vulnerability

**Executive summary:** A critical unauthenticated remote-code-execution zero-day (CVE-2026-35273) in Oracle PeopleSoft was actively exploited by the ShinyHunters group between May 27 and June 9, 2026, resulting in breaches of over 100 organizations—primarily educational institutions—and the publication of stolen data including approximately 500,000 student records; Oracle issued an advisory on June 10 and recommends immediate mitigation although no official patch is yet available.