A security advisory from Oracle has raised alarms for its corporate clients regarding a serious vulnerability in PeopleSoft software. This warning follows a cybercrime group's admission of exploiting the flaw in a recent mass-hacking initiative. The group, known as ShinyHunters, has reportedly compromised over 100 organizations utilizing PeopleSoft servers.
The vulnerability, classified as a zero-day, allows attackers to exploit the flaw via the internet without authentication. Mandiant, a cybersecurity firm owned by Google, corroborated that this is the same flaw being weaponized by ShinyHunters. In their efforts to mitigate the risk, Mandiant contacted more than 100 organizations, primarily in the United States, two-thirds of which are in higher education.
Oracle has not yet issued a patch for this vulnerability, but has advised its customers to implement recommended mitigations to safeguard their systems. Some organizations have managed to neutralize the threat, while others have faced data breaches, with sensitive information surfacing on the ShinyHunters data leak website. Oracle has not responded to inquiries regarding the situation.