Cybersecurity entity
PeopleSoft is most often covered alongside Google, which appears in 3 of these 3 stories. The 108-day window averages about 0.2 stories each week. The busiest single day carried 2. Coverage clusters in vulnerability, which accounts for 2 of those 3, with the remainder spread across 1 other category.
Last mentioned: Sep 28, 2026
Entity pulse
Coverage balance Negative coverage leads. Negative coverage exceeds positive coverage by 100 percentage points.
Figures are computed live from our source-verified story record — see our methodology for how impact and sentiment are derived.
PeopleSoft is most often covered alongside Google, which appears in 3 of these 3 stories. The 108-day window averages about 0.2 stories each week. The busiest single day carried 2. Coverage clusters in vulnerability, which accounts for 2 of those 3, with the remainder spread across 1 other category. Source depth averages 2 original sources per story, versus 2.9 across the same-window beat baseline. At 7, the average consequence score sits above the same-window beat average of 6.6. We currently track 3 Cybersecurity stories that mention PeopleSoft, published between June 12, 2026 and September 27, 2026.
Computed from the 3 stories linked to this entity, with beat comparisons drawn from all 516 Cybersecurity stories published in the same date window. Shares are omitted below five stories and comparisons below a twenty-story baseline.
Coverage cohort
Other entities that clear the same relevance threshold in stories also covering PeopleSoft. Shared-story counts are live from our verified record — not editorial picks.
Mandiant reports renewed exploitation
Google's Mandiant says ShinyHunters has skirted defenses and resumed mass exploitation, hitting dozens of systems across six sectors.
FBI confirms investigation
FBI issues statement saying it is aggressively investigating the reported breach after ShinyHunters claims access via PeopleSoft.
Google Confirms Exploitation
Google Threat Intelligence Group publicly confirms zero‑day exploitation by ShinyHunters and notifies over 100 affected organizations.
Google/Mandiant publish findings
Google’s threat intelligence blog details the campaign, attribution, and sector impact.
Oracle Releases Out‑of‑Band Advisory
Oracle publishes mitigations for CVE-2026-35273 and warns customers to apply them immediately, but no full patch is provided.
Campaign window closes
Last observed exploitation activity before Oracle issues its advisory.
First attack wave ends
Initial exploitation window closes; Oracle issues a patch and defensive guidance that emphasizes web application firewall rules.
Campaign begins
ShinyHunters starts active scanning and exploitation of the Oracle PeopleSoft zero-day.
Zero‑Day Exploitation Begins
According to Google and Mandiant, ShinyHunters starts actively exploiting CVE-2026-35273 to compromise PeopleSoft instances.
Attack Campaign Window
ShinyHunters targets ~300 instances across 100+ organizations, focusing on education sector. Deploys MeshCentral agents and lateral movement scripts.
Security teams must treat this as a patch verification crisis: Google's Mandiant confirms ShinyHunters bypassed WAF-only mitigations to resume mass exploitation of an Oracle PeopleSoft vulnerability. The latest wave hit dozens of systems across higher education, technology, healthcare, agriculture, transportation, and government. With the same flaw linked to a claimed FBI data breach, unpatched PeopleSoft instances are an active liability.
Google and Mandiant confirm active exploitation of CVE-2026-35273, a critical unauthenticated RCE flaw in Oracle PeopleSoft. The ShinyHunters group compromised roughly 300 instances, with the higher education sector bearing 68% of the impact. Oracle has only released mitigations, leaving organizations exposed to data theft and extortion.
Source: SecurityWeek · SecurityWeek
An active extortion campaign by ShinyHunters exploited a zero-day vulnerability in Oracle PeopleSoft, with Google notifying over 100 organizations—68% in higher education. The attackers used customized MeshCentral agents for C2, actions occurring before Oracle’s June 10 advisory. This highlights the growing threat of zero-day exploitation in widely used enterprise software and the education sector’s vulnerability.
PeopleSoft is linked from 3 stories on this site, each scored at or above our 35% relevance threshold — see how these pages are built.
See something wrong on this page — a misattributed entity, a wrong stat, a broken source link? Report a data issue.
