KrebsOnSecurity names the man the FBI arrested over the ShinyHunters probe as Edward Dubrovsky, co-founder of ransomware-negotiation firm Cypfer. The FBI has not confirmed the identification.
FBI Director Kash Patel says agents arrested another suspected ShinyHunters co-conspirator tied to the FBIjobs.gov breach. The New York Times reports a Canadian national held in Pennsylvania.
The FBI says a contractor failed to apply a patch for the Oracle PeopleSoft flaw CVE-2026-35273, leading to the ShinyHunters theft of employee data. The contractor was removed.
Reuters reports Jordanian authorities detained Saif al-Din Khader, alias 'Rey', who is cooperating with the FBI to locate other ShinyHunters members. He is a suspect, not charged.
Oracle ships an out-of-band Security Alert for an unauthenticated RCE in PeopleTools 8.61/8.62. Mandiant ties exploitation since May 27 to ShinyHunters (UNC6240).
ShinyHunters exfiltrated 3.65 TB from Instructure's Canvas LMS, defaced login pages at 330 schools, then accepted a payment in exchange for 'returning' the data. The data is still out there.