Security Reports disagree 8 publishers 2 min read Published Sep 26, 2026, 5:20 AM PDT Updated Sep 29, 2026, 4:30 AM PDT

ShinyHunters slips past PeopleSoft firewall rules by encoding one character

ShinyHunters is again mass-exploiting Oracle PeopleSoft flaw CVE-2026-35273, defeating firewall rules by URL-encoding a single character. Anyone who filtered the endpoint instead of applying Oracle's June 10 patch should assume exposure.

The Watch · Security desk

Send a correction

What happened

Google's Mandiant says ShinyHunters, tracked as UNC6240, has renewed mass exploitation of Oracle PeopleSoft, compromising dozens of systems across sectors from higher education to government.
Oracle patched the flaw on June 10, but the group retooled to target organizations that filtered the endpoint with firewall rules instead of installing the update.
ShinyHunters defeats the firewall rules by URL-encoding a single character in the request path, sending /%50SEMHUB/ in place of the blocked /PSEMHUB/.

Why it matters

Who has to decide decision For teams that filtered the path instead of patching, the encoding trick voids the only control they had in place, leaving Oracle's update and removing the Environment Management Hub as the working options.
Who's exposed exposure Servers protected only by path filtering have been reachable since the group started encoding the request, so those environments should be treated as potentially compromised and their credentials rotated.
What's now possible capability A single PeopleSoft foothold now reaches employee records and the wider network, because SIDEEYE steals stored credentials and proxies traffic inward.
What it sets up precedent This is the second time the group has reworked its attack to beat published guidance on this one flaw, so expect further encoding variants rather than a retreat.

Next story · Security · 5d ago

Contractor's missed PeopleSoft patch let attackers into FBI employee data

Confirmed2 publishers

The bypass works because the firewall and the application read the same URL differently. A WAF rule set to block /PSEMHUB/ inspects the request as it arrives. ShinyHunters sends /%50SEMHUB/ instead, where %50 is the URL-encoded letter P, and some firewalls do not match it against the blocked path. ^[4] The PeopleSoft application then decodes %50 back to P and processes the request against /PSEMHUB/ as usual. ^[5]

Oracle's fix has been out since June 10. ^[21] Mandiant's guidance is to install it and stop relying on filtering, disable or remove the Environment Management Hub where the endpoint is not needed, and search logs for both /PSEMHUB/ and its encoded forms. ^[14] Any credential reachable from a server found compromised should be rotated. ^[15] PeopleSoft runs HR, payroll, recruiting and finance for large organizations, so a foothold there reaches employee records and the internal network. ^[17]

Where the group got in, it left more than a web shell. It deployed JSP shells named x.jsp and u.jsp for command execution and further uploads. ^[9] On Windows it installed Ple64.exe, a 5.2MB binary Mandiant tracks as SIDEEYE, which can steal browser and application credentials, run a reverse shell, and proxy traffic into internal networks. ^[11] It kept access with the Neo-reGeorg tunneling tool and MeshAgent, a legitimate remote-management product. ^[13]

ShinyHunters said on September 22 that it reached FBI infrastructure through a PeopleSoft server. ^[19] The FBI said on Wednesday it was "aggressively investigating" the reported breach ^[12], and has not confirmed the group's claim to have taken 2TB to 3TB of data. ^[8] Reuters said it could not corroborate the claim, and Oracle did not respond to its requests for comment. ^[20] Reuters previously reported that the group exposed the names of personnel in sensitive FBI units and obtained medical and psychiatric records. ^[18]

This is the second pass at the same flaw. ShinyHunters used CVE-2026-35273 as a zero-day from May 27 to June 9, mainly against universities ^[7]^[16], then adapted to the defensive guidance that followed, going after organizations that added WAF rules but did not apply the update. ^[10]

What to watch

Whether the FBI confirms or rules out the alleged 2TB to 3TB theft and identifies which units were exposed.
Whether Oracle responds with WAF guidance or comment, having so far not replied to requests.
Whether more CVE-2026-35273 victims surface or additional endpoint-encoding variants appear in the wild.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence78
Adoption: Not scored
Hype gap+8
Incentives58
Confidence74

Perspective Coverage

8 publishers

Builder: Builder 25%
Operator: Operator 58%
Investor: Investor 17%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Google's Mandiant and Threat Intelligence Group observed ShinyHunters launching a renewed mass-exploitation campaign against vulnerable Oracle PeopleSoft servers, compromising dozens of systems across multiple industries.
Reported SupportedView cited source
[2]
Mandiant observed the technique used against organizations in higher education, technology, IT services, healthcare, agriculture, transportation and government.
Reported SupportedView cited source
[3]
Mandiant says ShinyHunters has modified its attacks to bypass organizations that tried to mitigate the vulnerability using web application firewall rules instead of installing the patch.
Reported SupportedView cited source
[4]
Rather than requesting the vulnerable /PSEMHUB/ endpoint directly, attackers replace the letter P with its URL-encoded equivalent and request /%50SEMHUB/.
Reported SupportedView cited source
[5]
Some WAFs inspect the original URL and fail to recognize the blocked path, while the PeopleSoft application decodes it back to /PSEMHUB/ and processes the request normally.
Reported SupportedView cited source
[6]
Google tracks the group as UNC6240; it is exploiting CVE-2026-35273, a critical PeopleSoft vulnerability.
Reported SupportedView cited source
[7]
ShinyHunters previously used CVE-2026-35273 as a zero-day between May 27 and June 9.
Reported SupportedView cited source
[8]
The FBI later acknowledged the group's claims but has not confirmed the alleged theft of 2TB to 3TB of data.
Reported Supported Source: FBIView cited source
[9]
After exploiting systems, ShinyHunters deployed JSP web shells including x.jsp and u.jsp, allowing command execution and additional malware uploads.
Reported SupportedView cited source
[10]
Mandiant said the hackers adapted to defensive guidance published after the May-June attacks and targeted organizations that implemented web application firewall rules but did not apply Oracle's update.
Reported SupportedView cited source
[11]
On Windows the group installed a 5.2MB executable called Ple64.exe, which Mandiant tracks as the SIDEEYE backdoor; it can steal browser and application credentials, manage files and processes, provide a reverse shell, and proxy traffic into internal networks.
Reported SupportedView cited source
[12]
In a statement issued Wednesday, the FBI said it was "aggressively investigating" the reported breach.
Reported Supported Source: FBI statementView cited source
[13]
The attackers used the Neo-reGeorg tunneling tool and the legitimate MeshAgent remote-management software to maintain access to compromised environments.
Reported SupportedView cited source
[14]
Mandiant recommends installing Oracle's CVE-2026-35273 update rather than relying on WAF filtering, disabling or removing the Environment Management Hub where possible, and searching logs for both normal and encoded /PSEMHUB/ requests.
Reported SupportedView cited source
[15]
Organizations should inspect PeopleSoft directories for unexpected JSP or executable files, investigate unusual remote-management agents, and rotate credentials accessible from any server found to be compromised.
Reported SupportedView cited source
[16]
Mandiant said ShinyHunters exploited the PeopleSoft bug in attacks from May 27 through June 9 that mainly affected universities.
Reported SupportedView cited source
[17]
Oracle PeopleSoft is used by large organizations for human resources, payroll, recruiting and finance; compromising a server can expose employee and organizational data and give attackers a foothold in internal networks.
Reported SupportedView cited source
[18]
Reuters previously reported that ShinyHunters exposed the names of personnel working in sensitive FBI units and acquired medical and psychiatric records.
Reported Supported Source: ReutersView cited source
[19]
ShinyHunters claimed on September 22 that it had compromised FBI infrastructure through a PeopleSoft server and subsequently accessed other systems.
Reported Contested Source: ShinyHunters, per CyberInsiderView cited source
[20]
Reuters said it could not corroborate ShinyHunters' claim that it accessed FBI data through PeopleSoft, and Oracle did not respond to requests for comment.
Reported Contested Source: ReutersView cited source
[21]
Oracle issued an emergency security update for the flaw on June 10.
Reported ContestedView cited source

Sources

8 independent publishers whose own reporting we read for this story.

bleepingcomputer.com
3 articles · September 26, 2026
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
cyberinsider.com
1 article · September 26, 2026
Google warns ShinyHunters is mass-exploiting Oracle PeopleSoft flaw
hackread.com
1 article · September 26, 2026
ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks
scworld.com
1 article · September 29, 2026
ShinyHunters targets Oracle PeopleSoft in new campaign amid FBI attack claims
securityweek.com
2 articles · September 28, 2026
Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign
thehackernews.com
2 articles · September 26, 2026
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
therecord.media
1 article · September 28, 2026
ShinyHunters exploiting workarounds for Oracle PeopleSoft bug, Mandiant warns
yahoo.com
1 article · September 25, 2026
ShinyHunters hackers expanded attacks on Oracle's PeopleSoft, Google says

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder25%

For anyone who writes proxy or firewall rules, the lesson is general. Mandiant says many WAF and reverse-proxy rules match the literal request path before URL decoding, while WebLogic decodes %50 back to P and sends the request to the vulnerable servlet. BleepingComputer adds Google's warning that the group could move to other percent-encoded or mixed-case forms of /PSEMHUB/, so blocking one variant leaves the rest open. The Hacker News traces the underlying bug to Java deserialization in the PSEMHUB hub servlet.

Operator58%

This campaign goes after the exact workaround Mandiant offered in June, blocking /PSEMHUB/ at the edge. Sites that filtered instead of patching are the exposed group. Across the coverage the guidance is the same: apply Oracle's CVE-2026-35273 update, disable or remove Environment Management Hub, and search WebLogic logs for both plain and encoded paths. SC World and BleepingComputer give the most usable detection detail, including five to 15 probing POST requests to /%50SEMHUB/hub before exploitation and named files such as x.jsp, u.jsp, tunnel.jsp and Ple64.exe. Google also tells affected organisations to prepare for extortion demands.

Investor17%

Money barely comes up. Reuters frames the risk as institutional, saying the attack will worry organisations that run HR and other critical functions on PeopleSoft, and notes Oracle did not respond to requests for comment. SecurityWeek names confirmed June victims: the University of Nottingham, the insurance regulators' group NAIC and Nissan. No outlet reports costs, ransom amounts or any effect on Oracle's business. The Record adds that Dutch police arrested a 24-year-old suspected member of the group.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence78: 0100
Strong on the exploit, weak on the FBI link
Almost every technical detail traces to a single Mandiant and GTIG report. Eight outlets repeat it closely, so their agreement shows faithful relay more than independent confirmation. The report is unusually checkable, though: the %50 path, file names, a C2 address and a signing certificate are all things defenders can look for. The FBI thread is thinner. Reuters and BleepingComputer both say they could not verify the group's claims.
AdoptionNot scored: Patch uptake unknown
The reporting does not say how many PeopleSoft customers have applied Oracle's June update or still rely on firewall rules alone. Mandiant's 'dozens' of compromised systems and its June notification of more than 100 organisations count incidents. They do not measure patch uptake.
Hype gap+8: −100 understated0 aligned+100 overstated
Headlines track the report
Headlines stay close to what Mandiant documented. The coverage gets ahead of the evidence only on the FBI breach. The Hacker News states the 2–3 TB theft as fact, while Reuters, BleepingComputer and Hackread say they could not verify it or could find no link to this CVE.
Incentives58: 0100
The attacker narrates its own breach
ShinyHunters is the only source for how the FBI was breached and how much data was taken, and it has a stated grievance. SC World reports the group has threatened to release the data unless the FBI retracts an earlier advisory about it. A spokesperson told The Hacker News, "We want to reiterate and emphasise that we are NOT extorting the FBI." Oracle, whose software is at issue, did not respond to Reuters.
Confidence74: 0100
Firm on the mechanism, unsettled on the FBI
The bypass, the tooling and the remediation advice are reported the same way everywhere, with indicators defenders can check. The FBI connection is where confidence drops, because the group's own accounts conflict. It told The Hacker News the portal fell to a different zero-day, and told BleepingComputer it used this WAF bypass there too. Outlets also disagree on the patch date by one day.

Topics and entities

Topics

Web application firewall bypass
Data-theft extortion