The ShinyHunters extortion group has launched a new mass-exploitation campaign against Oracle PeopleSoft, using a simple URL-encoding trick to get around web application firewall rules, Google Threat Intelligence Group and Mandiant said, SecurityWeek reported Monday. The attacks target CVE-2026-35273, a flaw the group first exploited as a zero-day in June.

What Happened

CVE-2026-35273 allows unauthenticated remote code execution in PeopleSoft's Environment Management Hub component. Google tracks the group behind the attacks as UNC6240.

In the June campaign, ShinyHunters hit more than 100 PeopleSoft customers, mostly in education, according to SecurityWeek. Confirmed victims from that wave include the University of Nottingham, the National Association of Insurance Commissioners and Nissan. The Record reported that the group exploited the bug as a zero-day from late May until early June, before Oracle released a fix.

RelatedFrance Widens Fridge-Hack Alert to More Controllers as Store Count Passes 350

The new wave reaches further, into agriculture, government, healthcare, IT services, technology and transportation as well as higher education. BleepingComputer reported that dozens of systems have been compromised.

How the Bypass Works

After the June attacks, one recommended stopgap was to block external access to the /PSEMHUB/ path. The new exploit defeats that rule by replacing the P with %50, its URL-encoded form.

According to Mandiant, many WAFs and reverse proxies compare the literal request path before decoding it, so the encoded version does not match a rule written for /PSEMHUB/. Oracle WebLogic, which serves PeopleSoft, decodes the path first and then sends the request to the vulnerable servlet. The attack arrives intact.

Mandiant said the group had adapted to published defensive guidance, going after organizations that applied the workaround but never installed the patch, The Record reported.

Why It Matters

The campaign shows the limits of mitigations that depend on string matching. Encoding-based evasions are an old class of bypass, but they keep working wherever a security device and the application behind it interpret the same request differently. For PeopleSoft customers, the practical lesson is that the patch, not the firewall rule, is the fix.

Once inside, the attackers moved quickly, according to Google. They dropped JSP web shells on dozens of systems, deployed the SideEye backdoor, which can steal credentials, manage files and open a reverse shell, and used the Neo-reGeorg tunneling toolkit for internal discovery and lateral movement. They also installed the MeshCentral remote management platform and abused PeopleSoft and WebLogic service accounts.

PeopleSoft often holds payroll, student and personnel records, which makes it a valuable target for a group whose model is data theft followed by extortion. The Record quoted Mandiant as describing a well-established pattern of stealing data and threatening to publish it on a leak site unless victims pay.

Related Activity

ShinyHunters has also claimed a breach of the FBI's jobs website, BleepingComputer and The Record reported, with the group alleging it stole sensitive operational and agent information. The Record reported that an internal FBI memo expressed concern that employees' personal information had been taken.

What to Watch

Google and Mandiant advise PeopleSoft customers to install Oracle's June update, hunt for signs of compromise and prepare for extortion demands. BleepingComputer reported that Mandiant also recommends searching WebLogic access logs for /PSEMHUB/ requests and encoded variants, and not relying on WAF rules alone. Given the size of the June wave, further victim disclosures and leak-site postings are likely in the coming weeks.