ShinyHunters Probes Oracle EBS and Exploits PeopleSoft Zero-Day

Key points

• ShinyHunters is conducting reconnaissance against Oracle E-Business Suite.
• The group is actively exploiting a zero-day in PeopleSoft.
• Three vulnerabilities have been linked, producing four separate issues.
• Activity was observed on October 28, 2026, as Cybersecurity Awareness Month closed.
• No CVE identifiers were provided in the available facts.

ShinyHunters has moved beyond simple discovery into active abuse against Oracle enterprise applications, according to the available facts. The group is probing a weakness in Oracle E-Business Suite while exploiting a zero-day in PeopleSoft. It has also connected three vulnerabilities, an effort that produced four separate issues. The activity was observed on October 28, 2026, coinciding with the close of Cybersecurity Awareness Month. No CVE identifiers were included in the facts.

The immediate concern is for organizations running Oracle EBS and PeopleSoft, especially government and K-12 environments where these platforms support finance, HR, payroll, and student services. Even probing matters: it maps exposed services, reveals patch levels, and can precede exploitation. A PeopleSoft zero-day is more urgent because no vendor patch may exist at the time of abuse, and linked flaws can expand access beyond a single application.

The timing is notable. Security teams often use Cybersecurity Awareness Month for training and hygiene, but attackers do not pause at the calendar boundary. ShinyHunters' combination of EBS probing and PeopleSoft exploitation suggests a campaign that blends discovery with direct compromise. The absence of CVE numbers means defenders should rely on vendor advisories, product telemetry, and anomalous behavior rather than signature-only tracking.

Watch for unusual requests to EBS and PeopleSoft endpoints, failed authentication clusters, unexpected job or report execution, and new accounts or configuration changes. Treat internet-facing instances as priority. Confirm whether Oracle has published guidance, limit exposure, and preserve logs for investigation. Because the facts tie three flaws to four issues, incident responders should look for chained activity rather than isolated alerts.

What to do now

1. Inventory every internet-facing Oracle EBS and PeopleSoft instance, confirm versions and patch levels, and assign an owner today.
2. Remove direct public access where possible; place EBS and PeopleSoft behind VPN, a zero-trust proxy, or allowlisted ranges.
3. Check Oracle advisories and apply all available EBS and PeopleSoft mitigations; if no PeopleSoft fix exists, use compensating controls and restrict affected modules.
4. Hunt logs for probing patterns, failed logins, unusual report or job runs, new accounts, and configuration changes across both platforms.
5. Segment EBS and PeopleSoft from broad corporate networks and enforce least privilege on service and administrative accounts.
6. Preserve evidence, escalate suspected zero-day exploitation to incident response, and notify leadership given the high severity and sensitive government and K-12 data.

Original source

The Register — Security