Oracle warns of critical PeopleSoft bug exploited by hackers

Mandiant, a cybersecurity firm owned by Google, confirmed that the vulnerability being abused by ShinyHunters is the same critical bug affecting PeopleSoft customers. The flaw is classified as a zero-day, meaning it was exploited before Oracle could release a fix. Oracle's advisory stated that the vulnerability can be exploited remotely without any form of authentication.

While Oracle has not yet released a patch, it has recommended that users of PeopleSoft software implement available mitigations to protect their systems. Mandiant has also notified over 100 global organizations, predominantly in the United States and many within the higher education sector, about their potential exposure. Some organizations successfully blocked the attacks or remediated the vulnerability, but others suffered compromises, leading to the publication of stolen data on ShinyHunters' data leak site.

ShinyHunters has a history of targeting organizations that share common vulnerable software, having previously breached companies using platforms like Salesforce, Gainsight, and Instructure. The group typically steals corporate or customer data and then demands a ransom for its non-release.