Google Confirms ShinyHunters Exploited Oracle PeopleSoft Zero-Day CVE-2026-35273

Google's Threat Intelligence Group confirmed that ShinyHunters actively exploited a zero-day (CVE-2026-35273) in Oracle PeopleSoft before Oracle's public advisory, conducting rapid automated exploitation against US higher-education PeopleSoft instances, exfiltrating data and pursuing extortion; the report provides attribution evidence, remediation recommendations (immediate patching, log review, persistence checks), and forensic queries to hunt for indicators of compromise.