ShinyHunters Extorted Boeing‑Spun‑Off Unit After Exploiting Oracle PeopleSoft Zero‑Day
What Happened — The ShinyHunters extortion gang leveraged a newly disclosed Oracle PeopleSoft vulnerability (CVE‑2026‑35273) to steal data from a business unit recently divested by Boeing. The stolen information was used to pressure the unit for ransom before the alleged gang leader was detained in Jordan.
Why It Matters for Trust & Control Assurance
- Demonstrates how a single unpatched third‑party SaaS flaw can cascade into a supply‑chain breach, underscoring the need for continuous third‑party risk monitoring.
- Highlights the importance of maintaining real‑time evidence that SaaS providers have applied critical patches—a core element of a control‑assurance program.
- Shows that a robust vendor‑oversight capability can provide defensible audit trails when external attackers exploit supplier vulnerabilities.
Who Is Affected – Aerospace & defense manufacturers, SaaS‑dependent enterprises, and any organization that relies on Oracle PeopleSoft for HR/payroll functions.
Recommended Actions
- Map the PeopleSoft patch‑management gap to your “vendor security and patch monitoring” control area and collect evidence of remediation.
- Incorporate continuous third‑party risk assessments into your audit‑readiness workflow, documenting vendor patch status and remediation timelines.
Technical Notes – ShinyHunters used a zero‑day exploit of CVE‑2026‑35273 in Oracle PeopleSoft, a SaaS HR platform, and later bypassed suggested WAF rules with a URL‑encoding trick. Oracle released a fix shortly after disclosure. Source: Krebs on Security