Oracle PeopleSoft Zero-Day Exploited by ShinyHunters in Breach of 100+ Organizations

Executive Briefing

• Reveals critical unpatched PeopleSoft vulnerability exploitable over the internet without authentication
• ShinyHunters cybercrime gang claimed responsibility, targeting payroll and HR systems at 100+ companies
• Mandiant confirmed two-thirds of affected organizations are in higher education, with stolen student records exposed
• Warns that Oracle has not yet released a patch, urging customers to apply available mitigations immediately
• Highlights ShinyHunters' pattern of mass-hacking campaigns targeting shared vulnerable software across multiple sectors