Controversies

Google says ShinyHunters hackers expanded attacks on Oracle's PeopleSoft

Issue disclosure

In September 2026, Google reported that the hacking group ShinyHunters had expanded its attacks to Oracle's PeopleSoft software. The event, dated September 26, 2026, concerns Oracle's PeopleSoft product and was described in a report attributed to Google. According to the event information, the ShinyHunters group broadened its targeting to include PeopleSoft. No additional details about the scope of the attacks, affected parties, data involved, or Oracle's response were provided in the available material. The note records the reported expansion of attacks as a security-related controversy involving Oracle's PeopleSoft software.

Google reported that the ShinyHunters hacking group has expanded its attacks to Oracle's PeopleSoft software.

Oracle discloses high-severity Java vulnerability

Issue disclosure

Oracle issued a security notice disclosing a high-severity vulnerability affecting Oracle Java SE and Oracle GraalVM products. According to the notice, Oracle provided patches for products covered by advanced or extended support. The disclosure identifies the affected product lines and the availability of patches for supported products; no further details on the vulnerability's nature, exploitation, or impact were included in the notice as summarized.

Oracle adds Secure Backup to PHP2Shell affected-product list

Issue disclosure

Oracle added Secure Backup to its list of products affected by PHP2Shell and urged customers to apply available patches for the PHP vulnerabilities. The update places Secure Backup among the products the company identifies as affected by the PHP2Shell issue. Oracle's guidance to customers is to install the patches that are available for the relevant PHP vulnerabilities.

Oracle Health alleged data breach

A threat actor claimed to have stolen millions of records from legacy systems associated with Oracle Health. Oracle said Oracle Cloud Infrastructure was not breached and did not confirm the claimed number of records. Reports indicated that unauthorized access may have involved legacy Cerner servers, prompting warnings for customers to secure their environments.

The Privacy Collective brings GDPR claims against Oracle and Salesforce

Lawsuit filed

The Privacy Collective brought class action claims against Oracle and Salesforce in Dutch, English and Welsh courts, alleging that their processing and sharing of personal data collected by third-party cookies for targeted advertising breached the GDPR. Oracle denied the claims and said it would defend against them; Salesforce also disputed the allegations and said it intended to demonstrate they were without merit.

ByteDance clarifies reports about TikTok's proposed U.S. cooperation

Company response

ByteDance issued a clarification addressing rumors about the proposed TikTok cooperation, including claims that ByteDance would lose control of TikTok Global and that Oracle might take possession of TikTok's source code. ByteDance said TikTok Global was wholly owned by ByteDance and that the proposal involved no transfer of algorithms or technology.

Court rules in Oracle–Rimini Street copyright litigation

Ruling

A Nevada district court ruled on motions for partial summary judgment in the copyright litigation between Oracle and Rimini Street. The court found that certain past Rimini Street support practices and certain practices described as new infringed Oracle copyrights. The court also dismissed various claims and defenses asserted by Rimini Street. The ruling addressed only the motions before the court and did not set out further relief or final resolution of the litigation.

Cover Oregon website failure and litigation

Oracle was contracted to develop the Cover Oregon health-insurance exchange website, which failed during its planned October 2013 launch. Oracle and the State of Oregon later brought competing legal claims involving contract performance, fraud, false claims, and related allegations. The dispute settled in 2016 for more than $100 million to the state and an agreement for Oracle to continue modernizing state software.

GSA contracting dispute and False Claims Act settlement

Oracle settled a U.S. General Services Administration False Claims Act case for $199.5 million in 2011. In 2012, the GSA banned Oracle from its main contract-bidding portal for undisclosed reasons. The episode raised questions about Oracle’s government-contracting practices and compliance.

Sun acquisition and open-source concerns

Oracle’s acquisition of Sun Microsystems drew opposition from open-source advocates and other stakeholders concerned about the future of MySQL, OpenSolaris, StarOffice, and related projects. Oracle later discontinued some Sun open-source initiatives and pursued litigation involving Java technology acquired from Sun.

Oracle Corporation v. SAP AG and TomorrowNow

Oracle sued SAP over allegations that employees of SAP subsidiary TomorrowNow improperly downloaded Oracle support materials and software-related documents. SAP acknowledged inappropriate downloads, while disputing the scope and legal consequences. A jury initially awarded Oracle $1.3 billion in 2010, but the judgment was later vacated as excessive. The companies ultimately agreed in 2012 to a $306 million damages judgment, with SAP having separately paid Oracle’s legal fees.