Why this week matters for enterprise risk

Data breach analysis is only useful if it changes what a security team does on Monday morning. The June 26 – July 9, 2026 reporting window is a strong case study in three recurring root causes that account for the overwhelming majority of enterprise breaches: unauthenticated remote code execution in internet-facing enterprise software, credential and secrets sprawl in CI/CD platforms, and shared-infrastructure blast radius. If you run PeopleSoft, Azure DevOps, or any multi-tenant platform, the incidents below are not abstract — they are a checklist.

CVE-2026-35273 — Oracle PeopleSoft EMHub RCE Critical · CVSS 9.8

This is the single most consequential vulnerability of the reporting window, with a confirmed blast radius of 100+ organizations, attributed to ShinyHunters, tracked by Google Mandiant / GTIG as UNC6240.

Vulnerability profile

Exploit chain analysis

This wasn't a single-shot exploit — researchers characterize it as a gadget chain: a sequence combining previously known and zero-day vulnerabilities that lets attackers operate within PeopleSoft's own application logic rather than through a direct database exploit, making malicious activity indistinguishable from legitimate application traffic. ShinyHunters is reported to have chained the SSRF/RCE primitive with a second privilege-escalation flaw in PeopleTools, together delivering initial access, elevated privileges, and a direct path into PeopleSoft HCM databases holding HR, payroll, and PII — a chain the group operated for 13 consecutive days.

Threat actor attribution & campaign timeline

• Actor: ShinyHunters, tracked by Google Mandiant / GTIG as UNC6240
• Zero-day window: May 27 – June 9, 2026, confirmed to predate Oracle's June 10 advisory
• Scale: Roughly 300 PeopleSoft instances across 100 organizations, by the threat actor's own claim
• Sector concentration: Higher education hit hardest; regulatory (NAIC) and automotive HR (Nissan) systems also confirmed impacted
• Leak-site correlation: GTIG confirms the activity directly correlates with data leaks published on the ShinyHunters Data Leak Site (DLS) on June 9, 2026

Post-exploitation TTPs

• C2 / persistence: MeshCentral remote-access agents deployed to maintain persistent access after initial RCE via PSEMHUB, customized to masquerade as legitimate cloud endpoints and used to run administrative command queries plus a custom lateral-movement/defacement script.
• Lateral movement: Common administrative and application credentials sprayed over SSH against other PeopleSoft hosts; the attacker read psappsrv.cfg, the application server config file that stores credentials.
• Hash capture: Outbound SMB traffic on TCP port 445 from PeopleSoft servers to external destinations may indicate machine-account NetNTLM hash capture via this chain.

Published indicators of compromise

142.11.200.186 – 142.11.200.190
108.174.202.99
176.120.22.24

Security teams should check PeopleSoft logs immediately for inbound connections from these ranges. Validate against your own environment before blocklisting in production.

MITRE ATT&CK mapping — CVE-2026-35273

KDDI shared email platform breach High

Root cause summary

Analysts have explicitly mapped the technical root cause to MITRE ATT&CK T1190 (Exploit Public-Facing Application), via a vulnerability in unnamed third-party software integrated into KDDI's shared email platform. As of the most recent public reporting, the software vendor was still developing a patch, and no CVE has been assigned — a gap that blocks automated vulnerability-scanner coverage for every other organization running the same underlying software. KDDI's July 6 update confirms the flaw was not recognized by the software vendor as of the June 17 discovery date, formally establishing zero-day status.

Incident timeline

• May 16, 2026Initial access via unpatched third-party software vulnerability
• Jun 17, 2026KDDI detects intrusion, blocks attacker, notifies Japan's PPC and MIC
• Jun 23, 2026First public disclosure: up to 14.22M accounts potentially affected
• Jul 06, 2026Formal regulatory report filed; scope confirmed
• Jul 07, 2026Final numbers: 12,233,087 email addresses, 7,616,173 passwords exposed

Dwell time: roughly one month between compromise and detection, followed by roughly three additional weeks before public disclosure while KDDI completed its regulatory filing — a data point worth benchmarking against your own detection-to-disclosure SLA.

Attribution gap

No security firm or government agency has publicly attributed the KDDI breach to a known threat actor — a notable contrast to faster attribution seen elsewhere in 2026 for groups like Salt Typhoon or ShinyHunters.

MITRE ATT&CK mapping — KDDI

Accenture Azure DevOps credential & source code theft High

Confirmed facts

• Threat actor: Alias "888" — previously linked to an unverified 2024 claim against Accenture.
• Claimed exfiltration volume: Approximately 35GB from Azure DevOps repositories: source code, RSA keys, SSH keys, Azure Personal Access Tokens (PATs), Azure Storage access keys, and configuration files.
• Proof of access: A screenshot showing an in-progress git clone of a repository hosted under a production accenture.com Azure DevOps hostname, preceded by a curl request to a dev.azure.com endpoint.
• Initial access vector: Not disclosed by Accenture. The presence of valid PATs, SSH keys, and storage keys in the leaked sample is consistent with credential-based access rather than a perimeter exploit.
• Vendor statement: Accenture confirmed the incident was isolated, with no impact to operations and service delivery, without disclosing the access method.

Why a credential leak is worse than it sounds

This is not a customer-PII breach — it's a CI/CD supply-chain credential compromise, and each artifact type carries a distinct blast radius:

MITRE ATT&CK mapping — Accenture

Kubota, Medtronic & Nextcloud — secondary incidents

Consolidated MITRE ATT&CK matrix

Remediation checklist

• PeopleSoft admins: confirm patch level matches Oracle's July CPU, not just the June interim mitigation. Retroactively hunt for the published IOCs. Rotate all credentials referenced in psappsrv.cfg.

• Multi-tenant platform operators: audit blast-radius containment between tenants — the KDDI incident demonstrates why perimeter hardening alone is insufficient for shared infrastructure.

• DevOps / platform engineering: audit Azure DevOps PAT scope, expiration, and rotation policy. Treat a leaked PAT with the same urgency as a leaked admin password.

• All organizations: run an external attack-surface scan this week. Misconfigurations like the Nextcloud exposure are reliably found by someone — the only variable is whether it's a researcher or an adversary.

Frequently asked questions