CRITICAL: ShinyHunters Burn Oracle PeopleSoft Zero-Day to Loot Universities (CVE-2026-35273)
ShinyHunters spent two weeks ransacking universities through an unauthenticated RCE in Oracle PeopleSoft's Environment Management Hub. CVE-2026-35273 carries a CVSS of 9.8, hit 100-plus orgs including the University of Nottingham, and Oracle only published a patch on June 10 after the campaign was already done.