Google Warns ShinyHunters Targets Oracle PeopleSoft Flaw

ShinyHunters Retools Exploit for Oracle PeopleSoft Flaw

Google warned on September 28, 2026 that the extortion group ShinyHunters is running a new campaign against Oracle PeopleSoft systems using a modified exploit for the vulnerability tracked as CVE-2026-35273. According to Google, the group changed its exploit code from earlier attacks to target this PeopleSoft flaw in fresh intrusions. PeopleSoft is Oracle's enterprise resource planning and human resources software suite, used by large employers, universities, government agencies, and healthcare systems to manage payroll, benefits, and personnel records. Because PeopleSoft deployments often hold Social Security numbers, banking details, and other sensitive employee data, a successful compromise can expose exactly the kind of information extortion groups use as leverage.

Who Is ShinyHunters and Why the Pattern Matters

ShinyHunters is a financially motivated threat group that researchers have linked to a string of prior data theft and extortion campaigns, including the 2025 wave of attacks against cloud customer environments that multiple security vendors reported at the time. The group typically does not encrypt systems the way a traditional ransomware operator does; instead, it steals data and then pressures victims to pay to prevent public release or sale of stolen records. Google's description of a "modified exploit" for CVE-2026-35273 suggests the group adapted its attack chain after the vulnerability, or a closely related flaw, was first disclosed, a pattern that often appears when defenders patch an initial proof-of-concept but attackers find a working variant. Oracle's own advisory details for CVE-2026-35273 were not included in the material reviewed for this article, so PeopleSoft administrators should treat the flaw as an active, in-the-wild threat until Oracle's Critical Patch Update documentation confirms a fix. Oracle publishes official vulnerability severity ratings and patches through its security alerts program at oracle.com/security-alerts, and administrators should verify patch status there rather than relying on secondhand version numbers.

What PeopleSoft Administrators Should Do Now

• Confirm your PeopleSoft version and patch level against Oracle's latest Critical Patch Update at oracle.com/security-alerts.
• Check whether CVE-2026-35273 has been added to CISA's Known Exploited Vulnerabilities catalog at cisa.gov/known-exploited-vulnerabilities-catalog. Federal civilian agencies must remediate KEV-listed flaws by CISA's stated deadline, and a listing is a strong signal for every other organization to move quickly as well.
• Restrict direct internet exposure of PeopleSoft application and integration broker servers; where remote access is required, place it behind a VPN or web application firewall with logging enabled.
• Review PeopleSoft authentication and integration broker logs for unusual login attempts, unexpected data exports, or new administrator accounts created around the time of this warning.
• Rotate credentials and API keys tied to PeopleSoft integrations, since prior ShinyHunters campaigns have relied on stolen or reused credentials to move from an initial foothold into connected systems.
• Confirm HR and payroll data backups are current, tested, and stored in a location an attacker with PeopleSoft access could not reach.

What This Means for Healthcare, Tax, and Small-Business Readers

Most small and mid-sized organizations do not run PeopleSoft directly, but many outsource payroll, benefits administration, or HR functions to larger employers, universities, or government partners that do. If your practice or business shares employee data, W-2 information, or benefits enrollment details with a partner organization running PeopleSoft, ask that partner directly whether it has reviewed Google's warning on CVE-2026-35273 and applied Oracle's current patches. For healthcare practices and tax professionals, PeopleSoft compromises are worth tracking even when the system is not yours, since exposed HR and payroll databases often contain the same Social Security numbers, dates of birth, and banking details that also appear in patient and client-facing systems. A breach at a shared HR or payroll vendor can trigger state breach notification obligations even when your own systems were never directly touched. Use this incident as a prompt to confirm, in writing, that any third party handling your employee or client payroll data has a documented patch management process and can notify you within days, not weeks, if it is affected by an actively exploited vulnerability like this one.