Security5 publishers2 min readPublished
ShinyHunters slips past PeopleSoft firewall rules by encoding one character
ShinyHunters is again mass-exploiting Oracle PeopleSoft flaw CVE-2026-35273, defeating firewall rules by URL-encoding a single character. Anyone who filtered the endpoint instead of applying Oracle's June 10 patch should assume exposure.
The Watch · Security desk
What happened
- Google's Mandiant says ShinyHunters, tracked as UNC6240, has renewed mass exploitation of Oracle PeopleSoft, compromising dozens of systems across sectors from higher education to government.
- Oracle patched the flaw on June 10, but the group retooled to target organizations that filtered the endpoint with firewall rules instead of installing the update.
- ShinyHunters defeats the firewall rules by URL-encoding a single character in the request path, sending /%50SEMHUB/ in place of the blocked /PSEMHUB/.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision For teams that filtered the path instead of patching, the encoding trick voids the only control they had in place, leaving Oracle's update and removing the Environment Management Hub as the working options.
- exposure Servers protected only by path filtering have been reachable since the group started encoding the request, so those environments should be treated as potentially compromised and their credentials rotated.
- capability A single PeopleSoft foothold now reaches employee records and the wider network, because SIDEEYE steals stored credentials and proxies traffic inward.
- precedent This is the second time the group has reworked its attack to beat published guidance on this one flaw, so expect further encoding variants rather than a retreat.
The bypass works because the firewall and the application read the same URL differently. A WAF rule set to block /PSEMHUB/ inspects the request as it arrives. ShinyHunters sends /%50SEMHUB/ instead, where %50 is the URL-encoded letter P, and some firewalls do not match it against the blocked path. [6] The PeopleSoft application then decodes %50 back to P and processes the request against /PSEMHUB/ as usual. [7]
Oracle's fix has been out since June 10. [4] Mandiant's guidance is to install it and stop relying on filtering, disable or remove the Environment Management Hub where the endpoint is not needed, and search logs for both /PSEMHUB/ and its encoded forms. [14] Any credential reachable from a server found compromised should be rotated. [15] PeopleSoft runs HR, payroll, recruiting and finance for large organizations, so a foothold there reaches employee records and the internal network. [22]
Where the group got in, it left more than a web shell. It deployed JSP shells named x.jsp and u.jsp for command execution and further uploads. [9] On Windows it installed Ple64.exe, a 5.2MB binary Mandiant tracks as SIDEEYE, which can steal browser and application credentials, run a reverse shell, and proxy traffic into internal networks. [10] It kept access with the Neo-reGeorg tunneling tool and MeshAgent, a legitimate remote-management product. [11]
ShinyHunters said on September 22 that it reached FBI infrastructure through a PeopleSoft server. [12] The FBI said on Wednesday it was "aggressively investigating" the reported breach [19], and has not confirmed the group's claim to have taken 2TB to 3TB of data. [13] Reuters said it could not corroborate the claim, and Oracle did not respond to its requests for comment. [20] Reuters previously reported that the group exposed the names of personnel in sensitive FBI units and obtained medical and psychiatric records. [21]
This is the second pass at the same flaw. ShinyHunters used CVE-2026-35273 as a zero-day from May 27 to June 9, mainly against universities [3][17], then adapted to the defensive guidance that followed, going after organizations that added WAF rules but did not apply the update. [18]
What to watch
- Whether the FBI confirms or rules out the alleged 2TB to 3TB theft and identifies which units were exposed.
- Whether Oracle responds with WAF guidance or comment, having so far not replied to requests.
- Whether more CVE-2026-35273 victims surface or additional endpoint-encoding variants appear in the wild.