S0:E39: FBI Breach, Shiny Hunters' Oracle O-Day, and a PR Fail With Dogs
The Takeaway: Shiny Hunters exploited an Oracle PeopleSoft O-day to pull FBI employee, applicant, and family data out of AWS GovCloud. Based on TTP overlap with Shiny's other recent activity, the vulnerability in question is likely CVE-2026-35273 (CVSS 9.8, unauthenticated RCE), patched June 10. This isn't a "just patch faster" story. It's a technical debt story, a business continuity story, and a crisis comms story, all wearing the same trench coat.
In this episode:
- How Shiny Hunters got in, what they took, and why 404 Media's sourcing on this one is rock solid
- Why the CVE attribution…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.