#shinyhunters

Analysis · Jun 20, 2026 · Colten Anderson

ShinyHunters had 13 days inside PeopleSoft before Oracle said anything

CVE-2026-35273 is a CVSS 9.8 unauthenticated RCE in PeopleTools 8.61-8.62 that ShinyHunters exploited as a zero-day against 100+ organizations. The June 10 advisory arrived after the data was already on the leak site.