Oracles silently fixes zero-day exploit leaked by ShinyHunters

Oracle E-Business Suite was found to contain multiple remotely exploitable flaws (CVE-2025-61882 and CVE-2025-61884) that were actively exploited or tied to extortion campaigns; a proof-of-concept exploit was leaked by ShinyHunters and Clop-linked activity led to data theft extortion. Oracle released out-of-band patches addressing the issues, but advisory details and IOCs were confusingly mismatched, prompting researchers to confirm that the SSRF component was fixed only after the CVE-2025-61884 update; customers are strongly advised to install the latest updates or apply temporary mod_security rules.