AnswersPublished15 sources
How did ShinyHunters expand its exploitation of an Oracle PeopleSoft vulnerability after its May 27–June 9, 2026 attacks, why did web application firewall rules fail to protect organizations that had not installed Oracle’s patch, which sectors and regions were affected, and what
After its May 27–June 9 campaign, ShinyHunters resumed large-scale exploitation of the same Oracle PeopleSoft flaw, CVE-2026-35273, and broadened its targeting from education to multiple sectors worldwide, according to Google’s Mandiant and Threat Intelligence Group. ShinyHunters’ separate claim tha After its May 27...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- After its May 27–June 9 campaign, ShinyHunters resumed large-scale exploitation of the same Oracle PeopleSoft flaw, CVE-2026-35273, and broadened its targeting from education to multiple sectors worldwide, according to Google’s Mandiant and Threat Intelligence Group. ShinyHunters’ separate claim tha
- After its May 27–June 9 campaign, ShinyHunters resumed large-scale exploitation of the same Oracle PeopleSoft flaw, CVE-2026-35273, and broadened its targeting from education to multiple sectors worldwide, according to Google’s Mandiant and Threat Intelligence Group. ShinyHunters
- **How the attacks expanded:** Mandiant tracks the group as UNC6240 and described the later activity as renewed “mass exploitation,” rather than a continuation limited to the original education targets. [7][15]
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: How did ShinyHunters expand its exploitation of an Oracle PeopleSoft vulnerability after its May 27–June 9, 2026 attacks, why did web applic. Article summary: After its May 27–June 9 campaign, ShinyHunters resumed large scale exploitation of the same Oracle PeopleSoft flaw, CVE 2026 35273, and broadened its targeting from education to multiple sectors worldwide, according to G. Topic tags: general web, code, security, marketing, social media. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks
After its May 27–June 9 campaign, ShinyHunters resumed large-scale exploitation of the same Oracle PeopleSoft flaw, CVE-2026-35273, and broadened its targeting from education to multiple sectors worldwide, according to Google’s Mandiant and Threat Intelligence Group. ShinyHunters’ separate claim that it stole sensitive FBI personnel data remains unverified in the evidence available here. 7
15
2
- How the attacks expanded: Mandiant tracks the group as UNC6240 and described the later activity as renewed “mass exploitation,” rather than a continuation limited to the original education targets.
7
- Why firewall rules were insufficient: Reports describe attackers using URL encoding to get around rules intended to recognize the exploit. A rule that missed the altered request did not fix the underlying flaw; organizations that had not installed Oracle’s patch remained exposed.
14
1
- Who was affected: The initial campaign targeted education infrastructure; Mandiant subsequently reported targeting across multiple sectors globally. The evidence available here does not establish a reliable country-by-country or sector-by-sector list of confirmed victims.
- What was said about the FBI: ShinyHunters said it breached the FBI and obtained data on many current and former employees. Reuters reported that a sample appeared to contain some agents’ names, addresses and assignments, but that observation does not verify the claimed scope or establish that the FBI was breached through this PeopleSoft flaw.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "How did ShinyHunters expand its exploitation of an Oracle PeopleSoft vulnerability after its May 27–June 9, 2026 attacks, why did web application firewall rules fail to protect organizations that had not installed Oracle’s patch, which sectors and regions were affected, and what"?
After its May 27–June 9 campaign, ShinyHunters resumed large-scale exploitation of the same Oracle PeopleSoft flaw, CVE-2026-35273, and broadened its targeting from education to multiple sectors worldwide, according to Google’s Mandiant and Threat Intelligence Group. ShinyHunters’ separate claim tha
What are the key points to validate first?
After its May 27–June 9 campaign, ShinyHunters resumed large-scale exploitation of the same Oracle PeopleSoft flaw, CVE-2026-35273, and broadened its targeting from education to multiple sectors worldwide, according to Google’s Mandiant and Threat Intelligence Group. ShinyHunters’ separate claim tha After its May 27–June 9 campaign, ShinyHunters resumed large-scale exploitation of the same Oracle PeopleSoft flaw, CVE-2026-35273, and broadened its targeting from education to multiple sectors worldwide, according to Google’s Mandiant and Threat Intelligence Group. ShinyHunters
What should I do next in practice?
**How the attacks expanded:** Mandiant tracks the group as UNC6240 and described the later activity as renewed “mass exploitation,” rather than a continuation limited to the original education targets. [7][15]