TL;DR

This week saw three distinct threats that every business owner should understand: a critical Oracle PeopleSoft zero-day was exploited to breach over 100 organizations, a social engineering campaign called ClickFix is stealing credentials through compromised WordPress sites, and bad actors figured out they can file fake breach reports on government portals to manipulate stock prices and reputations. Here is what happened, what it means for your business, and what you should do before Monday.

Oracle PeopleSoft Zero-Day (CVE-2026-35273) — ShinyHunters Breaches 100+ Organizations

The biggest incident this week is the active exploitation of CVE-2026-35273, a critical remote code execution vulnerability in Oracle PeopleSoft Enterprise PeopleTools. The flaw carries a CVSS score of 9.8 out of 10 and requires no authentication, no user interaction, and nothing more than HTTP network access to fully compromise a server. In other words, if your PeopleSoft instance faces the internet, an attacker can own it with a single request.

The threat group ShinyHunters (tracked by Mandiant as UNC6240) exploited this unpatched flaw between May 27 and June 9, 2026, breaking into enterprise systems, exfiltrating data, and demanding payment to keep it quiet. Mandiant confirmed it notified more than 100 global organizations — primarily universities — that their PeopleSoft instances were compromised. Oracle did not publish an advisory until June 10, meaning the flaw was a true zero-day throughout the entire attack window.

How bad was it? Over 300 PeopleSoft instances across 100+ organizations were breached. ShinyHunters exfiltrated sensitive records including student data, employee information, and financial records, then demanded Bitcoin ransoms. The full financial impact is still being tallied, but the average cost of a data breach in 2025 was $4.88 million according to IBM's annual report, and university breaches tend to run higher due to the breadth of personal data involved.

How could it have been prevented? The attack surface was the PeopleSoft Environment Management Hub (/PSEMHUB/) and the HTTP Listening Connector (/PSIGW/HttpListeningConnector). Oracle's own mitigation guidance recommends disabling or removing the PSEMHUB application entirely and blocking external access to both paths at the perimeter. Organizations that had network-segmented their PeopleSoft deployments or placed them behind a VPN — rather than exposing them directly to the internet — would have been unaffected.

Your action item this weekend: If your organization runs Oracle PeopleSoft, apply the emergency mitigations immediately. Block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at your web application firewall or reverse proxy. If you do not run PeopleSoft, audit every enterprise application with an internet-facing admin console — those are the exact profile of targets ShinyHunters hunts.

ClickFix Campaign Distributes Vidar Stealer via Compromised WordPress Sites

Australia's Cyber Security Centre (ASD ACSC) issued an advisory on May 7, 2026, warning that threat actors are using the ClickFix social engineering technique to distribute Vidar Stealer malware through compromised WordPress websites. This is not a hypothetical — it is actively targeting Australian infrastructure and businesses right now.

What happened? Attackers compromised WordPress sites and injected fake Cloudflare verification or CAPTCHA prompts. When a visitor lands on the site, they see a message telling them to copy and run a PowerShell command to "verify" their browser. The command downloads and installs Vidar Stealer, a mature malware-as-a-service tool that harvests browser passwords, cookies, cryptocurrency wallets, autofill data, and system information. The entire attack relies on the user voluntarily pasting a command into their own terminal — no exploit, no vulnerability, just clever deception.

How bad is it? Vidar Stealer has been a top-tier info-stealer since 2018 and is sold as a service for as little as $150–$300 per month on underground markets. A single infection can yield credentials for dozens of corporate accounts, banking sessions, and cloud services. The downstream cost — from hijacked accounts to business email compromise — can easily reach hundreds of thousands of dollars per victim organization.

How could it have been prevented? This attack exploits human behavior, not software. Technical controls that would help include: restricting PowerShell execution via Group Policy (constrained language mode), deploying endpoint detection and response (EDR) that flags suspicious PowerShell downloads, and using web filtering to block newly compromised domains. On the WordPress side, site owners should keep all plugins, themes, and core installations updated and deploy a Web Application Firewall.

Your action item this weekend: Remind your team — via a short email or Slack message — that no legitimate website will ever ask them to copy and paste a command into PowerShell or Terminal. If your business runs WordPress sites, verify that all installations are fully patched and that admin access uses multi-factor authentication.

Maine Breach Portal Abused to File Fake Disclosures Against Discord and VRChat

In a twist that breaks new ground for misinformation, someone discovered that Maine's official state data breach notification portal can be submitted to by anyone — not just the affected company. Over the past week, fraudulent breach disclosures were filed against Discord (claiming 10 million affected users) and VRChat (claiming 2.4 million affected users). Both companies publicly denied the claims. The VRChat filing was submitted under a fictitious employee name, and the Discord filing came from a Gmail address listing the submitter as a "Data Subject / Reporter" — not a company representative.

Why this matters for your business. State breach portals are public records. A fake filing can show up in news aggregators, Google search results, and social media before anyone verifies it. If your company's name appears in a breach disclosure — even a fake one — your stock price, customer trust, and partner relationships can take an immediate hit. VRChat and Discord had to divert resources to deny the claims publicly. For smaller companies without a PR team, the damage could be far worse.

Your action item this weekend: Set up a Google Alert for your company name plus the word "breach." If you use a breach notification service or legal counsel for compliance, ask them whether they monitor state portals for unauthorized filings bearing your company's name. Early detection of a fake disclosure is the difference between a quick correction and a multi-day reputational fire.

FAQ

Q: My organization doesn't use Oracle PeopleSoft. Should I still be worried about CVE-2026-35273? A: Not about this specific vulnerability, but the attack pattern should concern you. ShinyHunters systematically scans for internet-facing enterprise applications with known flaws. If you expose any ERP, CRM, HR, or financial system to the public internet without a VPN or zero-trust access layer, you are playing the same game. Audit your external attack surface this week.

Q: How do I stop ClickFix-style attacks if they rely on user behavior? A: Layer your defenses. Technical controls like PowerShell constrained language mode, application whitelisting, and EDR tools can catch the payload even when the user is tricked. But the most effective single measure is awareness — a 60-second reminder to your team that no website will ever ask them to run a terminal command beats a $50,000 security tool that nobody configures properly.

Q: Can anyone really file a breach report on a state portal? A: Yes, in several states including Maine, the submission process does not require verified corporate credentials. The portal is designed for legal compliance speed, not authentication. This gap is now being exploited. Monitor your brand actively and have a rapid-response communications plan ready.

Q: What should I prioritize first — patching PeopleSoft, warning staff about ClickFix, or monitoring breach portals? A: If you run PeopleSoft, that is your number one priority today — the vulnerability is being actively exploited. If you do not, start with the ClickFix staff warning (it takes five minutes to draft and send), then set up brand monitoring. Both can be done before the weekend is over.

Conclusion

This week's incidents share a common thread: they all exploit gaps between technical exposure and human process. PeopleSoft instances should never face the open internet without strict access controls. ClickFix succeeds because employees have never been told that a website might ask them to run a terminal command. And the Maine portal abuse works because no one at those companies was watching for their name to show up in a government database they did not file with.

Your weekend action list: patch or mitigate any internet-facing enterprise applications, send a one-paragraph ClickFix warning to your team, and set up brand monitoring for breach-related mentions. Three actions that take less than two hours total and could save you from being next week's headline.

Visit consult.lil.business for a free cybersecurity assessment — we will identify your external attack surface, review your incident response readiness, and give you a prioritized remediation plan tailored to your business.

References

  1. ASD ACSC Advisory: ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure
  2. NVD CVE-2026-35273 Detail — Oracle PeopleSoft Enterprise PeopleTools Remote Code Execution
  3. Oracle Security Alert CVE-2026-35273 — PeopleSoft Enterprise PeopleTools
  4. BleepingComputer: Maine breach portal abused to publish fake data breach disclosures
  5. BleepingComputer: Australia warns of ClickFix attacks pushing Vidar Stealer malware