khunt Weaponizes Oracle's Embedded JVM to Run Post-Exploitation Toolkit from Inside the Database

On **August 5, 2026**, **Huntress** researchers documented an attack where the **khunt** toolkit was compiled and executed **inside an Oracle database** via SQL injection on an **Apache Tomcat** endpoint. Attackers abused Oracle's **embedded JVM** to run OS commands with **SYSTEM** privileges, steal Windows hashes, and map the network. The message to DBAs is clear: your database is a full Java runtime — treat it like one.