ShinyHunters says it used an unpatched vulnerability in Oracle PeopleSoft, the human-resources and payroll platform, to get into FBI systems and pull data on bureau employees. The group posted the claim alongside what it says are internal service screenshots and employee records, first reported by BleepingComputer and 404 Media. No CVE number has been assigned, and no PeopleSoft patch is out. The FBI has not confirmed a breach occurred.

Oracle PeopleSoft runs HR, payroll and benefits administration for organizations that need to keep that data behind something more locked-down than a public website. If ShinyHunters actually has a zero-day, not a stolen credential or a misconfigured instance already public, this is the kind of software normally invisible to the outside. The same week, CISA added a Dassault Systèmes DELMIA Apriso flaw, CVE-2025-6205, to its Known Exploited Vulnerabilities list, a separate enterprise platform now under active exploitation. Two unrelated back-office systems, two live incidents, in the same seven days.

ShinyHunters has run a string of extortion campaigns this year built on stolen access rather than novel exploits, so an actual zero-day would be a change in tooling, not just targets. The bureau has not published an incident notice, and Oracle has not issued a security alert for PeopleSoft tied to this claim. Until one of those two things happens, what's public is a claim, a screenshot set, and a named platform still running unpatched in whoever else uses it.