Oracle disclosed a security vulnerability that a cybercrime gang had already been weaponizing against enterprise targets before the warning arrived.
The flaw was actively exploited as part of a coordinated mass-hacking campaign while Oracle customers remained unaware. Google identified more than 100 organizations running potentially vulnerable servers and notified them directly. Oracle confirmed the bug and issued an advisory, though it did not disclose how long the vulnerability had existed before attackers found it or what systems are affected. The 100-plus figure reflects only the organizations Google could identify and reach — not the full scope of exposure.
The sequencing is the story. When defenders learn about a vulnerability after attackers have already deployed it at scale, patching becomes triage. Equally notable is who carried the notification burden: Google alerting Oracle's customers rather than Oracle itself suggests the company's own disclosure pipeline was lagging, a recurring knock on a vendor that has historically been guarded about publishing security details.
Oracle's enterprise footprint makes it a rich target for exactly this kind of campaign. Expect the confirmed breach count to rise as organizations finish auditing their logs.