Published 22 hours ago • loading... • Updated 2 hours ago

Clop Hits Oracle E-Business Suite Users with Fresh Zero-Day

On October 4, Oracle rushed an emergency patch for a zero-day in Oracle E-Business Suite versions 12.2.3 through 12.2.14, following active exploitation by Clop.
CVE-2025-61882 is a critical vulnerability with CVSS 3.1 base score 9.8 that enables unauthenticated remote code execution targeting Oracle Concurrent Processing product via HTTP.
Leaked on Telegram, the exploit archive file containing exp.py and server.py automates attacks, while Oracle published indicators of compromise listing IPs, files, and commands to aid detection.
The Clop extortion gang has been sending extortion emails since last Monday claiming stolen EBS files, while Oracle and security firms advise customers to patch immediately and assume compromise.
Mandiant warns that broad mass exploitation has occurred and 'n-day' exploitation may continue, while Clop told BleepingComputer, `Soon all will become obvious that Oracle bugged up their core product and once again, the task is on clop to save the day.

Insights by Ground AI

Podcasts & Opinions

Podcast Mention

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Daily Cyber Security podcast

SANS Stormcast Monday, October 6th, 2025: Oracle 0-Day

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast) discuss Oracle EBS zero-day exploitation by Clop with extortion alerts.

17 hours ago

Listen to Full Episode Full Episode Unlock Timestamp

Get Vantage — Podcasts, Ratings, Timestamps

Podcasts & Opinions

13 Articles

TechCrunch

Center

Clop hackers caught exploiting Oracle zero-day bug to steal executives' personal data

Oracle fixes another security flaw that Clop hackers were using to steal sensitive personal information about executives as part of a mass-extortion campaign.

2 hours ago·United States

Read Full Article

Tech Radar

Center

Oracle forced to rush out patch for zero-day exploited in attacks

A zero-day in Oracle E-Business Suite is being exploited in the wild to steal files from US corporations.

6 hours ago·United Kingdom

Read Full Article

The Register

Center

Clop hits Oracle E-Business Suite users with fresh zero-day

: Big Red rushes out patch for 9.8-rated flaw after crooks exploit it for data theft and extortion

9 hours ago

Read Full Article

BleepingComputer

Reposted by

unsafe.sh

Center

Oracle patches EBS zero-day exploited in Clop data theft attacks

Oracle is warning about a critical E-Business Suite zero-day vulnerability tracked as CVE-2025-61882 that allows attackers to perform unauthenticated remote code execution, with the flaw actively exploited in Clop data theft attacks.

22 hours ago

Read Full Article

Techzine Europe

Oracle patches actively exploited zero-day vulnerability in E-Business Suite

Oracle has patched a critical vulnerability in the E-Business Suite that was actively exploited in data theft attacks by the Clop group.

7 hours ago

Read Full Article

The Hacker News

⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

The cyber world never hits pause, and staying alert matters more than ever. Every week brings new tricks, smarter attacks, and fresh lessons from the field. This recap cuts through the noise to share what really matters—key trends, warning signs, and stories shaping today’s security landscape. Whether you’re defending systems or just keeping up, these highlights help you spot what’s coming

8 hours ago

Read Full Article

Think freely.Subscribe and get full access to Ground NewsSubscriptions start at $9.99/year