ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

Researchers revealed that the critical Oracle PeopleSoft vulnerability exploited by ShinyHunters since May 2026 is actually three chained flaws, patched under one CVE in June. The bug, involving server-side request forgery, allowed unauthenticated remote code execution and was actively exploited before the patch. The flaw affected PeopleSoft Enterprise PeopleTools 8.61 and 8.62 and targeted multiple sectors worldwide.