Oracle dropped an emergency patch on June 10 for CVE-2026-35273 — a critical flaw in PeopleSoft Enterprise PeopleTools. CVSS score: 9.8. Remotely exploitable, no authentication required. Classic recipe for disaster.
But here’s the thing. Hackers had already been using it for two weeks.
Mandiant reports that active exploitation started on May 27 and ran through June 9. That’s 14 days before Oracle even knew — or at least before they said anything. The vulnerability was reported through TrendAI’s Zero Day Initiative and added to CISA’s Known Exploited Vulnerabilities catalog on June 12.
The attackers? A group called UNC6240, better known as ShinyHunters. These guys are financially motivated — data theft and extortion are their thing. They’ve hit cloud services, SaaS platforms, and telecoms before. This time they went after universities hard — 68% of the more than 100 notified victims were colleges.
How it works: The flaw is a server-side request forgery (CWE-918) in PeopleTools versions 8.61 and 8.62. Two endpoints get targeted — /PSEMHUB/hub and /PSIGW/HttpListeningConnector. The SSRF lets attackers chain into remote code execution. They can also make the server send outbound SMB connections to grab NetNTLM hashes.
Once inside, ShinyHunters deployed MeshCentral agents disguised as Microsoft Azure services. They used them for C2 via wss://azurenetfiles[.]net:443/agent.ashx. Internal recon, lateral movement scripts, zstd compression for exfil — the full playbook.
Update ASAP if you’re on PeopleTools 8.61 or 8.62. Disable EMHub service where possible. Block /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter. Monitor outbound SMB on port 445 from PeopleSoft servers.
And check for signs of compromise even after patching. The IOCs are public now.
