ShinyHunters breaks into PeopleSoft systems that chose firewall rules over Oracle's patch
Mandiant says ShinyHunters has planted web shells on dozens of Oracle PeopleSoft systems by URL-encoding one character to get past firewall rules. Employers that treated June's stopgap as the fix now have to patch and also look for any access the attackers left behind.
The Board Room · Leadership desk
What happened
- ShinyHunters first exploited the PeopleSoft flaw, CVE-2026-35273, as a zero-day between May 27 and June 9, 2026.
- Oracle released an out-of-band security alert on June 10, 2026, the day after that zero-day window closed.
- According to HRD, most victims of the new wave had answered the first attacks with a temporary workaround instead of installing Oracle's fix.
- After the first wave, Nissan told employees in the US, Canada, Mexico and Brazil that their Social Security numbers and bank details may have been stolen.
- ShinyHunters also claimed it took payroll and medical records from the Council of Europe.
Why it matters
- Who's exposed exposure Systems that ran only the workaround need a compromise check as well as the patch, and a check that looks only for new JSP files would miss the fileless method Mandiant observed.
- What it sets up precedent Attackers can now be expected to study and test any interim control described in a public advisory, so a filter buys less time than a patch schedule may assume.
- Who has to decide decision A status of 'mitigated' on a risk register now has to say whether it means patched or filtered, and HRD advises HR to get IT's answer in writing and ask payroll vendors running PeopleSoft the same.
- What it costs cost Employees bear the loss when stolen bank details are used to redirect wages, and HR ends up adding controls such as Nissan's rule that deposit details change only from company networks.
Next story · Security · 5d ago
Contractor's missed PeopleSoft patch let attackers into FBI employee dataConfirmed2 publishers
The bypass works because two systems read the same request in a different order. Many firewall and reverse proxy rules compare the literal path before decoding it, while the PeopleSoft application server decodes the path first and then routes the request [7]. A rule written to block /PSEMHUB/ does not match /%50SEMHUB/, where %50 is the encoded letter P, and the server still passes the request to the vulnerable servlet [7]. Mandiant now advises enforcing the block on the normalized path and assuming attackers will try any percent-encoded or mixed-case variant [19].
The board-deck version of the June response would have been one word: mitigated. Mandiant wrote that the bypass reaches systems "whose operators may have believed their WAF rules had mitigated the exposure" [20]. On the new wave, Mandiant said workarounds "are not a substitute for patching" [8].
The trade-off in June was speed against coverage. Mandiant's June guidance put patching first. It offered the perimeter block only where patching or disabling EMHub was not immediately possible, and it warned that WAF body-inspection rules alone were insufficient [6]. An operations lead could fairly say the filter was what the guidance allowed. It was, as a fallback [6]. In Mandiant's account, the group then adapted to that published guidance and went after organizations that had the WAF rules but not the patch [2].
Patching is this quarter's decision. Whether the attackers are already inside decides next quarter's, and in my view the two jobs need separate owners. Before exploiting a server, the group typically sent it five to 15 probe requests, and unpatched servers answered with their operating system without writing any files [9]. Mandiant says hosts that were confirmed but not yet exploited may show those probes in logs with nothing after them [9]. Where the group did go in, it deployed two web shells for persistent access and follow-on payloads [12]. It also sent bursts of requests, which Mandiant says likely put a copy on each node behind a load balancer, and it advises checking every WebLogic node, not only the first one found [10].
Mandiant and HRD did not identify the organizations hit in the new wave, and neither account shows they are the employers breached in June. The first wave was mostly higher education [4]. The new one also reaches technology, IT services, healthcare, agriculture, transportation and government [1]. The second wave found organizations that stopped at the workaround, whether or not they had been hit before [2][3].
Being on this group's list costs more than the data. The FBI warned in May that the group sometimes harasses victims and their relatives with threatening calls and texts, and in some cases has used swatting [18]. Days before Mandiant's warning, ShinyHunters said it had hacked the FBI's recruitment website and taken data on agents and job applicants. The bureau said it was "actively and aggressively investigating" [17].
What to watch
- Whether Mandiant or affected employers name second-wave victims or confirm what data left the compromised PeopleSoft servers.
- Breach notices to current staff, former staff and applicants from organizations that ran only the workaround, as Nissan sent after June.
- Ransom demands or harassment directed at second-wave victims, of the kind the FBI warned about in May.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+8
- Incentives20
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
ShinyHunters (UNC6240) deployed web shells on dozens of Oracle PeopleSoft systems globally in the renewed campaign, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government.
- [2]
The current campaign demonstrates that UNC6240 adapted to published defensive guidance, targeting organizations that implemented WAF rules but did not patch the vulnerability.
- [3]
Most of the victims had responded to the first attacks with a temporary workaround rather than Oracle's fix, and the hackers found a way around it.
- [4]
In June 2026 UNC6240 exploited CVE-2026-35273 as a zero-day between May 27 and June 9, 2026, predominantly against higher education institutions.
- [5]
Oracle released an out-of-band Security Alert on June 10, 2026.
- [6]
Mandiant's June guidance recommended patching and, where patching or disabling EMHub was not immediately possible, blocking external access to /PSEMHUB/* at the perimeter, noting that WAF body-inspection rules alone were insufficient.
- [7]
The threat actor bypassed string-based WAF rules by URL-encoding a single character, requesting /%50SEMHUB/ in place of /PSEMHUB/. Many WAF and reverse proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet. %50 is the encoded form of P.
- [8]
Mandiant said such workarounds "are not a substitute for patching."
- [9]
Before exploitation, targeted servers typically received five to 15 POST requests to /%50SEMHUB/hub; unpatched servers respond with the host operating system without writing files or disrupting the service. Hosts validated but not yet exploited may show this request in logs with no follow-on activity.
- [10]
The threat actor sent bursts of POST requests before creating JSP web shell files; the repetition likely ensures every node behind a load balancer receives a copy, so organizations should check all WebLogic nodes, not only the first one identified.
- [11]
A second method, fileless command execution, returns command output directly in the HTTP response with no file written to disk; detections that rely on JSP file creation will not identify it.
- [12]
The threat actor deployed two web shells to establish persistent access and stage follow-on payloads.
- [13]
After the first wave, Nissan told employees in the US, Canada, Mexico and Brazil that their Social Security numbers and bank details may have been stolen.
- [14]
ShinyHunters claimed it took payroll and medical records from the Council of Europe.
- [15]
Stolen bank details are often used to redirect wages; Nissan now lets staff change direct deposit details only from company networks.
- [16]
HRD advises HR to ask IT whether the organization installed Oracle's fix or relied on a workaround, get the answer in writing, and ask payroll and benefits vendors that run PeopleSoft the same.
- [17]
Days before Mandiant's warning, ShinyHunters said it had hacked the FBI's recruitment website and taken data on agents and job applicants; the FBI said it was "actively and aggressively investigating."
- [18]
In May, the FBI warned that the group sometimes harasses victims and their relatives with threatening calls and texts, and in some cases has used swatting.
- [19]
Defenders should assume threat actors may use any percent-encoded, mixed-case, or otherwise non-normalized variant of /PSEMHUB/, and should enforce blocking on the normalized path.
- [20]
The bypass allows the threat actor to reach the endpoint on systems "whose operators may have believed their WAF rules had mitigated the exposure."
Sources
2 independent publishers whose own reporting we read for this story.
- cloud.google.comShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | Google Cloud Blog
1 article · September 24, 2026
- hcamag.comMajor HR system hacked again as criminals slip past summer fixes
1 article · September 27, 2026
Topics and entities
Topics
- Web application firewall bypass
- HR and payroll system security
- Data Extortion