ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed

ShinyHunters exploited a critical zero-day (CVE-2026-35273, CVSS 9.8) in Oracle PeopleSoft's PeopleTools EMHub to perform unauthenticated remote code execution between May 27 and June 9, 2026, compromising over 300 PeopleSoft instances across more than 100 organizations (predominantly higher education), exfiltrating sensitive data (including student records), and publishing stolen data; researchers observed use of MeshCentral for C2, credential spraying, and Zstandard for mass exfiltration, and Oracle released a patch and mitigation guidance.