Breaking-Alert

Published Thursday, June 11, 2026 at 03:55 PM PT BLUF: Mandiant and Google Threat Intelligence Group have confirmed an active compromise and extortion campaign by ShinyHunters (tracked as UNC6240) targeting Oracle PeopleSoft infrastructure in the education sector. Organizations running Oracle PeopleSoft should treat this as an active threat and audit systems immediately. DETAILS Mandiant and Google Threat Intelligence Group (GTIG) jointly attributed the campaign to UNC6240, a threat actor publicly known as ShinyHunters, a group with a documented history of large-scale data theft and extortion operations. The campaign specifically targets Oracle PeopleSoft application infrastructure — widely deployed across universities and higher education institutions for HR, finance, and student data management. The activity involves both compromise and extortion, indicating data exfiltration is likely occurring or has occurred prior to ransom demands being issued. NOTE: Specific CVE identifiers, exploit technical details, and confirmed victim count have not been confirmed in available source material at this time — treat those details as pending. ShinyHunters has previously been linked to high-volume credential theft and data broker activity; education sector targeting aligns with the group’s history of pursuing large repositories of PII. IMPACT Primary targets: Higher education institutions and universities running Oracle PeopleSoft for ERP, HCM, or student information systems. Data at risk: Student records, employee PII, financial data, and authentication credentials stored within PeopleSoft environments. Scope: Confirmed active campaign — not a historical or theoretical threat. Extortion component suggests victims may face public data exposure or sale if demands are not met. Secondary risk: Institutions using PeopleSoft in healthcare, government, or enterprise contexts should also elevate monitoring posture pending further scope clarification. RECOMMENDED ACTIONS Immediately audit Oracle PeopleSoft internet-facing instances for signs of unauthorized access, anomalous queries, or privilege escalation. Review and restrict external access to PeopleSoft portals — enforce MFA where not already in place. Check Oracle patch status — ensure all available PeopleSoft security patches are applied; prioritize any recent Critical Patch Update (CPU) advisories. Hunt for indicators — engage threat intelligence feeds for UNC6240/ShinyHunters IOCs; Mandiant customers should query GTIG directly for campaign-specific indicators. Activate incident response protocols if anomalous access is detected — do not delay pending full investigation. Notify legal and compliance teams proactively given the extortion component and likely PII exposure. SOURCES Mandiant / Google Threat Intelligence Group (GTIG) — active campaign attribution Source detail on specific exploit mechanism and full victim scope: PENDING — monitor Mandiant and Oracle Security Advisories for updates

Published Thursday, June 11, 2026 at 03:54 PM PT BLUF: Threat actor ShinyHunters is actively exploiting a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft to breach university networks. All higher education institutions running Oracle PeopleSoft should treat this as an active threat requiring immediate action. No patch status confirmed at time of publication. DETAILS ShinyHunters — a financially motivated threat actor with a documented history of large-scale data theft and extortion — has been attributed to active exploitation of CVE-2026-35273 in Oracle PeopleSoft. The vulnerability is described as a zero-day, meaning exploitation is occurring without a publicly available patch at the time of reporting. Patch availability has not been independently confirmed in the source material provided. Confirmed targets are universities; the number of affected institutions, specific names, and volume of data compromised are not confirmed in available reporting. The nature of the vulnerability (e.g., authentication bypass, RCE, SQL injection) is not specified in source material — treat all PeopleSoft attack surfaces as potentially in scope until Oracle publishes an advisory. ShinyHunters has previously exfiltrated and auctioned stolen data; data exposure for affected institutions should be assumed until ruled out. IMPACT Who: Higher education institutions globally running Oracle PeopleSoft — commonly used for student information systems (SIS), HR, and financial data. Data at risk: Potentially includes student PII, financial records, employee data, and academic records — scope unconfirmed. Breadth: Number of breached institutions unknown at this time. Assume threat is ongoing and opportunistic. RECOMMENDED ACTIONS Immediately audit Oracle PeopleSoft internet-facing instances for signs of unauthorized access, unusual queries, or lateral movement. Restrict external access to PeopleSoft portals where operationally feasible pending patch availability. Monitor Oracle’s security advisory portal (https://www.oracle.com/security-alerts/) for an emergency patch or mitigation guidance for CVE-2026-35273. Review logs for indicators of compromise associated with ShinyHunters TTPs, including bulk data staging and exfiltration activity. Notify incident response teams and legal/compliance functions now — student and employee PII exposure may trigger regulatory notification obligations (FERPA, GDPR, state breach laws). Do not wait for Oracle confirmation before initiating defensive measures. ⚠️ UNCERTAINTY FLAGS Patch availability, vulnerability class, and full victim list are unconfirmed in source material. CVE-2026-35273 is a future-dated identifier — verify against Oracle’s official CVE registry before finalizing internal reporting. SOURCES The Hacker News — ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities Additional context: Broader active exploitation trend across enterprise platforms (Cisco SD-WAN, PAN-OS, Oracle WebLogic) suggests elevated threat environment for unpatched infrastructure.

Published Thursday, June 11, 2026 at 03:54 PM PT BLUF: Oracle has mitigated a zero-day vulnerability in PeopleSoft that threat actors actively exploited to steal data. Organizations running PeopleSoft should apply Oracle’s mitigation immediately and audit systems for signs of unauthorized data access. DETAILS Oracle has confirmed a zero-day vulnerability in PeopleSoft was exploited in the wild prior to mitigation, resulting in confirmed data theft incidents. Oracle has issued a mitigation — note: it is not confirmed at this time whether a full patch is available or whether the mitigation is a workaround only; organizations should verify patch status directly with Oracle support. The vulnerability was exploited before Oracle could issue a fix, classifying this as a true zero-day exploitation event. Specific technical details of the vulnerability (CVE assignment, attack vector, authentication requirements) are not confirmed in available reporting at this time. Threat actor identity, campaign scope, and volume of affected organizations are currently unknown. IMPACT Directly affected: Organizations running Oracle PeopleSoft — commonly deployed in higher education, government, and large enterprise environments for HR, finance, and student information systems. Data at risk: PeopleSoft environments typically contain sensitive HR records, payroll data, financial data, and personally identifiable information (PII) — high-value targets for data theft and extortion. Scope: Unknown at this time. Active exploitation confirmed; breadth of victim organizations has not been publicly disclosed. RECOMMENDED ACTIONS Apply Oracle’s mitigation immediately. Access Oracle Support (My Oracle Support) for the specific mitigation guidance relevant to your PeopleSoft version. Audit access logs on PeopleSoft systems for anomalous queries, bulk data exports, or unauthorized API calls — particularly in the period prior to mitigation deployment. Restrict external-facing PeopleSoft access where operationally feasible until a full patch is confirmed available and applied. Engage your incident response process if any indicators of compromise are identified; assume data exfiltration may have occurred if systems were internet-accessible during the exploitation window. Monitor Oracle’s security advisories for CVE assignment and additional technical indicators. SOURCES BleepingComputer — Oracle mitigates PeopleSoft zero-day exploited in data theft attacks ⚠️ UNCERTAINTY FLAG: Technical specifics including CVE identifiers, affected version ranges, attack vectors, and threat actor attribution are unconfirmed in available reporting. This alert will require update as Oracle releases formal advisory documentation.

BLUF: Microsoft has patched a zero-day vulnerability in Exchange Server (CVE-2026-42897) that was actively exploited in the wild prior to the patch release on May 14. All organizations running on-premises Microsoft Exchange Server should apply the patch immediately. DETAILS Microsoft disclosed and patched CVE-2026-42897 on May 14, confirming active zero-day exploitation was underway at time of disclosure. The vulnerability affects Microsoft Exchange Server — specific versions affected have not been confirmed in available reporting at this time. Microsoft explicitly warned of zero-day attacks exploiting this flaw, meaning threat actors were leveraging it before a fix was available. Technical details regarding the attack vector, exploit mechanism, and whether authentication is required are not yet confirmed in available source material. Attribution of active exploitation to a specific threat actor or campaign has not been confirmed at this time. IMPACT Who is affected: Organizations running on-premises Microsoft Exchange Server deployments. Cloud-hosted Exchange Online customers may have reduced or no exposure — confirm with Microsoft guidance. Scope: Exchange Server is widely deployed across enterprise, government, and critical infrastructure environments globally. Historical Exchange zero-days (e.g., ProxyLogon, ProxyShell) have resulted in mass exploitation within hours of public disclosure. Risk level: HIGH. Active exploitation confirmed prior to patch availability elevates urgency significantly. RECOMMENDED ACTIONS Apply Microsoft’s patch immediately — do not wait for standard patch cycles. Audit Exchange Server logs for anomalous activity, particularly around the May 14 disclosure date and any period prior. Isolate or restrict external access to Exchange Server interfaces if patching cannot be completed immediately. Review Microsoft’s official advisory for affected version specifics, workarounds, and indicators of compromise (IoCs) — details not fully available in current reporting. Notify incident response teams and elevate monitoring on Exchange infrastructure now. SOURCES SecurityWeek: Microsoft Patches Exploited Exchange Server Vulnerability (May 14) ⚠️ UNCERTAINTY FLAG: Affected Exchange Server versions, exploit technical details, attack vector, and threat actor attribution are unconfirmed in available reporting. Monitor Microsoft’s Security Response Center (MSRC) advisory for CVE-2026-42897 for authoritative details. This alert will require updating as information develops. ...

BLUF: An unpatched critical vulnerability in Langflow (CVE-2026-5027) is being actively exploited in the wild, enabling unauthenticated remote code execution. Organizations running Langflow instances — particularly internet-exposed deployments — should treat this as an immediate priority. No patch is confirmed available at time of publication. DETAILS CVE-2026-5027 affects Langflow, an open-source visual framework widely used for building and deploying AI/LLM-powered workflows and pipelines. The vulnerability permits unauthenticated remote code execution (RCE), meaning attackers require no valid credentials to exploit the flaw — significantly lowering the barrier to attack. Active exploitation has been confirmed in the wild per reporting from The Hacker News; however, specific technical details of the exploit mechanism, affected version range, and CVSS score have not been confirmed in available source material and should be treated as pending. No patch is confirmed available at time of this alert. Remediation options beyond mitigation measures are currently unclear. This alert arrives in a broader threat context: multiple AI/LLM-adjacent platforms have faced active exploitation in 2026, including LiteLLM (CVE-2026-42271) and Marimo (CVE-2026-39987), suggesting sustained adversary interest in AI development tooling. IMPACT Who is affected: Organizations and individuals running Langflow instances, particularly those exposed to the public internet or accessible without network-layer access controls. Scope: Unauthenticated RCE represents maximum-severity exposure — successful exploitation could result in full system compromise, data exfiltration, lateral movement, or deployment of malicious agents within AI pipelines. Broader risk: Langflow is commonly used in enterprise AI development environments. Compromise of a Langflow instance may provide attackers access to connected LLM APIs, data sources, and internal infrastructure. ⚠️ Uncertainty flag: Exact affected versions, exploitation scale, and threat actor attribution are not confirmed in available source material. RECOMMENDED ACTIONS Immediately audit your environment for any Langflow deployments, including development, staging, and production instances. Restrict network access to Langflow instances — place behind VPN or firewall rules; remove any public internet exposure until a patch is available. Enforce authentication controls at the network perimeter level as a compensating control. Monitor Langflow instances for anomalous activity, unexpected process execution, or outbound connections. Track vendor communications from Langflow/DataStax for patch availability and apply immediately upon release. Do not assume internal-only deployments are safe — assess lateral movement risk if Langflow is networked to sensitive systems. SOURCES The Hacker News — Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE Related context: The Hacker News reporting on LiteLLM CVE-2026-42271 and Marimo CVE-2026-39987 exploitation ⚠️ Note: Source material for this alert contains limited technical detail. CVSS score, affected version range, and exploitation methodology are unconfirmed. Monitor vendor advisories and CISA KEV catalog for updates.

BLUF: Microsoft has released a patch for a zero-day vulnerability in Exchange Server that has been actively exploited in attacks. Organizations running on-premises Exchange Server should apply the patch immediately. DETAILS Microsoft has issued a security update addressing a zero-day vulnerability in Exchange Server that was being exploited in the wild prior to patch availability. The vulnerability was confirmed as actively exploited at time of disclosure — this is not a theoretical risk. Huntress researchers have separately documented investigation into zero-day vulnerabilities in Microsoft Exchange, suggesting ongoing threat actor interest in Exchange as an attack surface. NOTE: Specific CVE identifier(s), technical exploitation mechanism, and confirmed threat actor attribution are not confirmed in available source material at this time. Details should be verified directly against Microsoft’s Security Update Guide and BleepingComputer’s full reporting. Exchange Server has been a high-value target in prior campaigns (e.g., ProxyLogon, ProxyShell); threat actors routinely weaponize Exchange flaws rapidly after disclosure. IMPACT Affected systems: On-premises Microsoft Exchange Server installations (specific versions not confirmed in available data — verify against Microsoft advisory). Cloud/Exchange Online: Microsoft-managed Exchange Online is not believed to require customer action, but this should be confirmed against official guidance. Scope: Any organization running unpatched on-premises Exchange Server should treat this as high-priority. Exchange servers are frequently internet-facing, increasing exposure. Risk: Active exploitation prior to patch release means some organizations may already be compromised. Patching alone does not remediate a breach that has already occurred. RECOMMENDED ACTIONS Apply Microsoft’s patch immediately via Windows Update or the Microsoft Security Update Guide — do not delay. Audit Exchange Server logs for indicators of compromise covering the period prior to patch application. Look for anomalous authentication, unusual mailbox access, or unexpected process execution. Verify Exchange Online vs. on-premises exposure — confirm which deployment model your organization uses. Restrict external access to Exchange where operationally feasible until patching is confirmed complete. Monitor Microsoft’s Security Update Guide and CISA advisories for CVE details, IOCs, and updated guidance as they become available. Assume breach posture if Exchange was internet-facing and unpatched during the exploitation window — initiate incident response procedures accordingly. SOURCES BleepingComputer: Microsoft patches Exchange Server zero-day exploited in attacks Huntress: New 0-Day Vulnerabilities Found in Microsoft Exchange Microsoft Security Update Guide (verify directly for CVE details and affected versions) ⚠️ UNCERTAINTY FLAG: CVE number, affected Exchange Server versions, exploitation method, and threat actor identity are not confirmed in available source material. Treat scope details as preliminary. Verify all technical specifics against Microsoft’s official advisory before communicating internally.

BLUF: Microsoft has released its June 2026 Patch Tuesday update addressing 206 vulnerabilities, including 6 zero-days — at least 3 of which are confirmed actively exploited in the wild. All Windows environments are affected. Apply updates immediately. DETAILS Scale: Microsoft patched 206 total vulnerabilities in the June 2026 Patch Tuesday release, one of the larger monthly update cycles on record. Zero-days: 6 zero-days addressed in total; corroborating sources (CrowdStrike, Qualys) confirm at least 3 were publicly disclosed prior to patching. Active exploitation status of all 6 has not been uniformly confirmed across sources — treat all 6 as high-priority pending clarification. Named vulnerabilities: Three zero-days have been assigned public identifiers: YellowKey, GreenPlasma, and MiniPlasma — Microsoft has patched all three. Specific CVE numbers, affected components, and exploitation details for these are not confirmed in available source material at this time. Scope of affected products: Specific product families affected beyond the Windows ecosystem are not fully confirmed from available source data. Adobe also released security updates in conjunction with this Patch Tuesday cycle (per Qualys). ⚠️ UNCERTAINTY FLAG: Discrepancy exists between sources — one BleepingComputer reference cites 3 zero-days, another cites 6. The 6-zero-day figure appears to be the most current reporting. Treat the lower figure as potentially outdated. IMPACT Who is affected: All organizations and individuals running unpatched Microsoft Windows and associated products. Enterprise environments are at elevated risk given the confirmed public disclosure of multiple zero-days prior to patch release. Scope: Global. 206 vulnerabilities across Microsoft’s product stack represents broad attack surface exposure. Threat actor interest: Publicly disclosed zero-days attract rapid weaponization. The window between patch release and exploit deployment is historically short — often hours to days. RECOMMENDED ACTIONS Patch immediately — Deploy June 2026 Patch Tuesday updates across all Windows endpoints and servers. Prioritize YellowKey, GreenPlasma, and MiniPlasma patches. Audit exposure — Identify any internet-facing or high-value systems running affected Microsoft products; prioritize those for emergency patching. Monitor for exploitation — Increase logging and alerting on Windows systems for anomalous behavior consistent with zero-day exploitation while patching is in progress. Check Adobe updates — Adobe also released patches this cycle; review and apply as applicable. Verify patch deployment — Confirm update rollout via endpoint management tooling; do not assume automatic updates have completed. SOURCES BleepingComputer — Microsoft June 2026 Patch Tuesday coverage CrowdStrike — June 2026 Patch Tuesday analysis (206 vulnerabilities, 3 publicly disclosed zero-days confirmed) Qualys Threat Research — Microsoft and Adobe Patch Tuesday, June 2026 Security Update Review BleepingComputer — Microsoft patches YellowKey, GreenPlasma, MiniPlasma zero-days

BLUF: Microsoft has released patches addressing three zero-day vulnerabilities tracked as YellowKey, GreenPlasma, and MiniPlasma. All Microsoft users and administrators should apply available updates immediately. DETAILS Microsoft has issued patches for three distinct zero-day vulnerabilities designated YellowKey, GreenPlasma, and MiniPlasma — specific CVE identifiers, affected product versions, and exploitation status for each are not confirmed in available source material at this time The vulnerabilities are named in a naming convention consistent with prior Microsoft zero-days (cf. RoguePlanet, which granted SYSTEM-level privileges via Microsoft Defender) — nature and severity of these three flaws is currently unconfirmed Whether any or all of these vulnerabilities have been actively exploited in the wild prior to patching is not confirmed from available reporting Patches are available via Microsoft’s standard update channels; specific Patch Tuesday cycle association is not confirmed at this time Attribution of exploitation or discovery to any threat actor or researcher is not confirmed IMPACT Scope: Potentially broad — specific affected Microsoft products (Windows, Office, Defender, Exchange, etc.) are not confirmed from available source material Who is at risk: All Microsoft product users and enterprise environments should treat this as high priority pending full disclosure of affected components Severity: Unknown pending CVE scoring — treat as critical until confirmed otherwise given zero-day classification RECOMMENDED ACTIONS Apply Microsoft patches immediately via Windows Update, Microsoft Update Catalog, or enterprise patch management systems Prioritize internet-facing and privileged systems for immediate patching Monitor Microsoft Security Response Center (MSRC) at msrc.microsoft.com for full CVE details and affected product lists Review endpoint detection logs for anomalous activity, particularly on systems that may have been unpatched or delayed in update cycles Do not wait for full technical details — patch now, investigate scope in parallel ⚠️ UNCERTAINTY FLAGS Source material contains headline-level information only. CVE identifiers, CVSS scores, affected product versions, exploitation-in-the-wild status, and threat actor involvement are all unconfirmed. This alert will require update as Microsoft publishes full advisory details. ...

BLUF: A public proof-of-concept exploit dubbed “RoguePlanet” has been released targeting an unpatched Windows zero-day vulnerability. The exploit abuses a race condition in Microsoft Defender to achieve local privilege escalation (LPE) to SYSTEM. All Windows systems running Microsoft Defender are potentially affected. Organizations should implement compensating controls immediately pending a Microsoft patch. DETAILS Exploit type: Local Privilege Escalation (LPE) to SYSTEM-level access via race condition in Microsoft Defender Attack vector: Local — an attacker requires existing low-privileged access to the target machine to execute the exploit; this is not a remote code execution vulnerability Public availability: Exploit code has been publicly released under the name “RoguePlanet,” significantly lowering the barrier to exploitation by less sophisticated threat actors Patch status: No CVE assignment or Microsoft patch has been confirmed at time of publication — treat as unpatched until Microsoft issues official guidance Uncertainty flagged: Technical depth, affected Windows versions, and whether in-the-wild exploitation is occurring are not yet confirmed from available reporting IMPACT Scope: Broad — Microsoft Defender ships as the default endpoint protection solution across Windows 10, Windows 11, and Windows Server environments; organizational exposure is likely widespread Risk elevation: Public exploit release means any threat actor with local access — via phishing, initial access brokers, or insider threat — can now trivially escalate to SYSTEM Compounding risk: Active threat groups including Lazarus and nation-state actors (see Dragon Weave activity) are currently operating at elevated tempo; LPE tools of this nature are routinely incorporated into post-exploitation chains rapidly RECOMMENDED ACTIONS Monitor Microsoft Security Response Center (MSRC) for CVE assignment and emergency patch release — treat as Priority 1 when issued Audit privileged access — reduce attack surface by enforcing least-privilege principles; limit local logon rights on sensitive systems Increase EDR telemetry sensitivity on Microsoft Defender process activity, particularly around race condition indicators and unexpected SYSTEM-level process spawning Do not disable Microsoft Defender as a mitigation — doing so removes existing detection capability and increases overall exposure Alert SOC teams to monitor for LPE activity patterns consistent with post-exploitation behavior on Windows endpoints SOURCES SecurityWeek: “New Windows Zero-Day Exploit ‘RoguePlanet’ Released” Related context: The Hacker News — Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal (indicates active tension around public disclosure practices) ⚠️ UNCERTAINTY NOTE: CVE identifier, affected Windows version list, and in-the-wild exploitation status are unconfirmed at time of this alert. Reassess as Microsoft and independent researchers publish additional technical analysis.

BLUF: A zero-day vulnerability dubbed “RoguePlanet” in Microsoft Defender has been publicly disclosed, reportedly granting SYSTEM-level privileges on fully patched Windows systems. All Windows users and enterprise administrators running Microsoft Defender should treat this as an active threat until Microsoft issues a patch or mitigation guidance. DETAILS A zero-day vulnerability identified as “RoguePlanet” has been disclosed affecting Microsoft Defender, Microsoft’s built-in endpoint protection component present on all modern Windows installations. The flaw reportedly enables local privilege escalation to SYSTEM, the highest privilege level on a Windows machine — meaning an attacker who gains initial access at any user level could fully compromise the host. Critically, the vulnerability is reported to affect fully updated Windows systems, meaning standard patch compliance does not currently protect against exploitation. ⚠️ UNCERTAINTY FLAG: Source detail at time of alert is limited to headline-level reporting from The Hacker News. CVE assignment, technical exploitation mechanism, proof-of-concept availability, and active in-the-wild exploitation status are not confirmed at this time. Context note: Microsoft has recently taken a public stance against unsanctioned zero-day disclosures, including removing a researcher’s GitHub account — the disclosure environment around this vulnerability may be contested. IMPACT Scope: Potentially all Windows endpoints running Microsoft Defender — consumer and enterprise — including fully patched systems. Severity: SYSTEM-level access represents full host compromise: credential theft, persistence, lateral movement, and ransomware deployment all become trivially achievable post-exploitation. Affected populations: Enterprise SOC teams, Windows system administrators, managed service providers, and end users globally. Defender is enabled by default on Windows 10/11 and Windows Server environments, making the attack surface extremely broad. RECOMMENDED ACTIONS Monitor Microsoft Security Response Center (MSRC) and official advisories immediately for CVE assignment and patch availability. Audit endpoint detection logs for anomalous privilege escalation events or unexpected SYSTEM-level process spawning. Restrict local user access and enforce least-privilege principles as a compensating control pending patch release. Do not rely on patch status alone as a protection indicator until Microsoft confirms a fix. Watch for out-of-band emergency patch release from Microsoft — subscribe to MSRC alerts if not already active. SOURCES The Hacker News — “Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows” Related context: Microsoft’s recent posture on zero-day disclosures (The Hacker News) ⚠️ This alert is based on limited initial reporting. Treat unconfirmed details as preliminary. Reassess as technical specifics are published.