Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #7

◆ cyber 80% high

a group calling itself shinyhunters exploited an unpatched oracle peoplesoft remote-code flaw (cvss 9.8) to breach more than 100 organizations between may 27 and june 9, with 68% of victims being us universities. the breach window lasted 13 days with no vendor advisory or patch available. mass exploitation of a zero-day against a single sector before any fix exists is a clean, high-impact intrusion event.

north america, intrusion reporting

#zero-day#oracle#universities#ransomware-group

Signals that echo this — the machine's nearest readings, by meaning

the shinyhunters group exploited a critical oracle peoplesoft remote-code-execution flaw (cve-2026-35273, severity 9.8) across more than 100 organizations before the vulnerability was publicly disclosed, with 68 percent of victims in higher education and student billing and campus data stolen. mass exploitation of a zero-day ahead of disclosure, heavily concentrated on universities, is a notably targeted and well-timed campaign. 98%
a group tracked as shinyhunters exploited an unpatched oracle peoplesoft flaw (cve-2026-35273, severity 9.8) between late may and june 9, breaching over 100 organizations — about 68 percent of them universities. as of june 10 oracle had released no patch. a single zero-day reaching this many institutions while no fix exists is an unusual concentration on the education sector. 98%
a critical oracle peoplesoft vulnerability — cvss score 9.8, allowing unauthenticated remote code execution — was actively exploited in over 100 breaches between may 27 and june 9 before oracle published any warning, a two-week unwarned exploitation window. affected systems include universities, hospitals, and government agencies running peoplesoft for payroll and records. google mandiant confirmed the active exploitation timeline. the two-week gap between known exploitation and vendor disclosure is the structurally anomalous element here. 94%
oracle e-business suite cve-2026-46817 (cvss 9.8) affecting payment systems entered active exploitation. separately, shinyh hunters claimed data theft from the national association of insurance commissioners via an oracle peoplesoft zero-day, publishing allegedly stolen files after a failed ransom. two distinct oracle vulnerabilities in active use simultaneously, targeting financial and insurance regulatory infrastructure, is a notable concentration. 94%
the cl0p crew chained a flexplm info-disclosure flaw with a critical windchill login-servlet vulnerability for unauthenticated remote code execution, deploying webshells and stealing engineering data from manufacturing, automotive and aerospace firms. separately shinyhunters used an oracle peoplesoft zero-day for a two-week undetected window across 300+ servers at 100 organizations, mostly universities. both cases show extended dwell time before defenders or the fbi were engaged. 93%
a single extortion group, shinyhunters, breached over one hundred organizations through oracle peoplesoft servers and separately compromised enterprise saas platforms through oauth and vendor integrations, while claiming ten million records from match group. at the same time, defenders report attackers using ai agents to automate lateral movement inside networks, shrinking the time from first access to full compromise. one crew operating at industrial scale plus machine-speed intrusion is a structural shift in how fast breaches unfold, not just how many. 93%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms