🛡️ Oracle PeopleSoft Victim Expands, 🇷🇺 $10M Russian Bounty, 🤖 OpenAI/Anthropic Restrictions, 🧠 GPT-5.6 Sol Debuts, 🔐 PQC Deadlines

The Nissan Americas PeopleSoft breach is the day's defining story. Nissan confirmed to California regulators that Social Security numbers, bank account details, and payroll records for current and former employees may have been stolen through the Oracle PeopleSoft zero-day (CVE-2026-35273) that ShinyHunters has been exploiting since June 10. Oracle told Nissan the campaign hit hundreds of companies, so every PeopleSoft operator should treat the June patch as an emergency and assume credentials and configuration data are already compromised. Nissan PeopleSoft breach

The State Department's $10 million bounty for the UNC5792 and UNC4221 operators pairs with an escalation in their tradecraft. The Russia-linked groups, which pose as automated support accounts on Signal and WhatsApp, now phish for Backup Recovery Keys rather than just verification codes. A stolen recovery key exposes historical message history and remains valid for re-compromising any new account on the same phone number, so affected users must generate a fresh key and assume the attacker already holds the backup data. Bounty and recovery-key phishing

In policy, OpenAI and Anthropic restricted their most capable models, GPT-5.6 Sol and Mythos 5, to roughly 20 administration-approved customers under the new frontier AI review framework. The effect worth tracking is that the strongest defensive models are unavailable to most defenders at the moment they matter most, and Fable 5, pitched as the safer alternative, remains locked down.

Watchlist: PeopleSoft patch verification and credential rotation, backup recovery key regeneration wherever staff were phished, and any access to frontier models for defensive teams.