Oracle PeopleSoft zero-day CVE-2026-35273 hits 100+ orgs
Oracle ships an out-of-band Security Alert for an unauthenticated RCE in PeopleTools 8.61/8.62. Mandiant ties exploitation since May 27 to ShinyHunters (UNC6240).
Stories tagged: #shinyhunters
Canvas LMS breach: ShinyHunters claims 275M records; Instructure says it paid for deletion
ShinyHunters exfiltrated 3.65 TB from Instructure's Canvas LMS, defaced login pages at 330 schools, then accepted a payment in exchange for 'returning' the data. The data is still out there.