ShinyHunters Expands Oracle PeopleSoft Attacks as Google Warns of Renewed Exploitation

The cybercrime group known as ShinyHunters has expanded its attacks against organizations running Oracle PeopleSoft, according to Google’s cybersecurity units, reviving a campaign that first emerged as a zero-day operation earlier this year.

Google Threat Intelligence Group and Mandiant said the group, tracked as UNC6240, has resumed mass exploitation of CVE-2026-35273, a critical vulnerability in Oracle PeopleSoft PeopleTools. The renewed campaign has moved beyond its earlier focus on higher education and now spans sectors including technology, IT services, healthcare, agriculture, transportation and government.

The development matters for businesses because PeopleSoft is used for important enterprise functions, including human resources and other administrative operations. It also highlights a broader cybersecurity problem: applying a defensive rule around a vulnerable application may not be enough when the underlying software remains unpatched.

What Happened in the ShinyHunters PeopleSoft Attack?

Mandiant said it observed renewed exploitation after ShinyHunters modified its approach to bypass some web application firewall (WAF) protections that organizations had deployed following the earlier attacks.

The vulnerability, CVE-2026-35273, affects Oracle PeopleSoft PeopleTools versions 8.61 and 8.62. Oracle rates it at 9.8 out of 10 under CVSS, indicating a critical security risk. The flaw can be exploited remotely without authentication and can result in remote code execution, meaning an attacker may be able to make a vulnerable system execute unauthorized commands.

Mandiant's latest investigation found that the attackers had deployed web shells on dozens of systems worldwide. The affected organizations were no longer concentrated in one industry, demonstrating a substantial expansion of the campaign's potential reach.

Reuters reported that the renewed campaign followed the group's ability to get around defenses introduced after the attacks earlier in the summer.

Why the Vulnerability Is Particularly Serious

PeopleSoft sits inside the technology infrastructure of many large organizations. It can support functions such as employee information, payroll-related processes, finance and other enterprise operations.

That makes a vulnerability in PeopleSoft different from a security flaw in an isolated consumer application.

If attackers gain control of an exposed enterprise application, the potential consequences can include unauthorized access to information, disruption of business processes and further compromise of connected systems.

Oracle's own advisory describes CVE-2026-35273 as remotely exploitable without authentication and says successful exploitation may result in remote code execution. Oracle has urged customers to address the exposure immediately and remain on supported software versions.

The June 2026 Oracle Critical Security Patch Update included fixes for the PeopleSoft security alert. Oracle has also repeatedly warned customers that attackers can successfully exploit vulnerabilities after patches have already been released when organizations fail to apply them.

ShinyHunters Adapted After Organizations Added Defenses

One of the most important aspects of the latest campaign is that attackers did not simply repeat the original operation.

According to Google, some organizations had implemented WAF rules designed to block access to the vulnerable PeopleSoft endpoint after the June attacks. ShinyHunters modified its exploit so that those defenses could be bypassed in certain configurations.

The lesson for corporate security teams is straightforward: a compensating control is not necessarily a replacement for fixing the vulnerable software itself.

Mandiant specifically recommends that organizations running affected PeopleSoft versions apply Oracle's security patch. It also recommends disabling or removing the vulnerable Environment Management Hub functionality where appropriate and reviewing systems for signs of compromise.

This distinction is important for investors as well. The existence of a security patch does not mean every customer has already installed it.

The Campaign Has Become Broader

The initial PeopleSoft campaign observed in May and June 2026 primarily targeted higher education institutions.

Mandiant said the earlier activity occurred between May 27 and June 9, before Oracle publicly issued its June 10 security alert. That meant the vulnerability was being exploited as a zero-day — a vulnerability being actively exploited before a fix or public disclosure was available.

The September campaign is different in scale and targeting.

Google said the latest activity has affected organizations across multiple sectors, including:

• Higher education

• Technology

• IT services

• Healthcare

• Agriculture

• Transportation

• Government

The presence of government and critical business organizations among the targets increases the potential consequences of successful compromises, although the scale of actual data theft or operational disruption will vary by victim.

What Does This Mean for Oracle?

The incident puts additional attention on Oracle's enterprise software security, but it is important to distinguish a vulnerability in a product from evidence of a broader compromise of Oracle itself.

The available reporting describes attacks against customer PeopleSoft environments using a vulnerability in PeopleSoft PeopleTools. It does not establish that Oracle's own corporate infrastructure has been compromised.

For Oracle, the immediate issue is therefore likely to center on customer security, patch adoption and confidence in its enterprise software ecosystem.

Oracle has already issued the relevant security alert and incorporated the fix into its June security update. The company also published additional PeopleSoft security updates as part of its September 2026 Critical Security Patch Update.

For investors, future disclosures about customer impact, security incidents and enterprise software demand will be more informative than treating the existence of the vulnerability itself as proof of material financial damage.

Why Cybersecurity Is Becoming an Investor Issue

Cybersecurity incidents can affect companies through several channels.

The most obvious is the direct cost of investigating and containing an incident. Companies may also face legal expenses, regulatory scrutiny, customer compensation, business interruption and higher cybersecurity spending.

There can be a less visible cost as well: damage to customer confidence.

Enterprise software vendors depend heavily on long-term relationships with large organizations. When a critical vulnerability is actively exploited, customers may demand faster security updates, stronger controls and additional assurances before expanding deployments.

At the same time, incidents like this can reinforce demand for cybersecurity products and services. Organizations may increase spending on vulnerability management, endpoint protection, monitoring, identity security and incident response after seeing how attackers can adapt to defensive measures.

That creates a more complicated investment picture across the technology sector. A major vulnerability can be negative for the affected software ecosystem while simultaneously increasing demand for security providers.

The FBI Connection Adds to the Attention

The renewed PeopleSoft campaign comes shortly after ShinyHunters claimed it had breached systems associated with the FBI and stolen information on employees.

Reuters reported on September 22 that the group made the claim, although the FBI had not immediately confirmed the alleged breach or disclosed the extent of any stolen information.

That claim should therefore be treated separately from the confirmed technical findings in Google's PeopleSoft investigation.

What is established is that Google has identified renewed exploitation of the PeopleSoft vulnerability and expanded targeting. Claims made by threat actors about individual victims require independent confirmation before being treated as established facts.

What Businesses and Investors Should Watch

The next stage of the incident will depend heavily on how quickly affected organizations patch vulnerable PeopleSoft installations.

Businesses using the affected versions should monitor Oracle's security guidance and Google's threat-intelligence findings rather than relying solely on network-level blocking.

For investors, several developments are worth watching:

Patch adoption: Whether organizations broadly remediate CVE-2026-35273 or whether additional compromises emerge from unpatched systems.

Customer impact: Whether major organizations disclose data theft, operational disruption or other material consequences.

Oracle disclosures: Any comments from Oracle concerning the vulnerability, customer remediation or security-related demand.

Cybersecurity spending: Whether enterprises increase budgets for vulnerability management and monitoring.

Further ShinyHunters activity: Whether the group shifts toward additional enterprise platforms or expands its current campaign.

The broader lesson is that cybersecurity risk is increasingly tied to software supply chains and widely deployed enterprise applications. A vulnerability can become economically important not because every customer is compromised, but because the software is deeply embedded across many organizations.

Conclusion

Google's latest threat-intelligence report shows that ShinyHunters has renewed and expanded exploitation of a critical Oracle PeopleSoft vulnerability first abused as a zero-day in May and June.

The campaign has now reached multiple sectors and demonstrated that attackers can adapt when organizations rely on defensive measures without fully patching vulnerable systems. Oracle has already issued fixes and security guidance for CVE-2026-35273, making remediation a key factor in determining how far the latest campaign spreads.

For investors, the episode is a reminder that cybersecurity can become a business and valuation issue when vulnerabilities affect widely deployed enterprise software. The key indicators from here will be confirmed customer impact, Oracle's disclosures, patch adoption and whether ShinyHunters expands its activity further.

Follow the blog for more cybersecurity, technology, business and global market updates.

This article is for informational and educational purposes only and should not be considered investment advice.