Oracle PeopleSoft (Product): news timeline & CVEs

Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

UNC6240 bypasses WAFs to mass-exploit Oracle PeopleSoft CVE-2026-35273 and deploy web shells and SIDEEYE.

Google-owned Mandiant warns that ShinyHunters-linked UNC6240 is again mass-exploiting CVE-2026-35273, a CVSS 9.8 unauthenticated remote-code-execution flaw in Oracle PeopleSoft. The group bypasses web-application firewalls by URL-encoding a single character in the PSEMHUB path, then uses Java deserialization to plant JSP web shells, a signed Ple64.exe loader for the SIDEEYE backdoor, MeshAgent, and Neo-reGeorg tunnels. The flaw was first used as a zero-day against academic institutions; Mandiant previously notified more than 100 organizations, mostly in the United States, and the new wave hits education, technology, healthcare, government, and other sectors. Separately, ShinyHunters claim they breached FBIJobs.gov with a different PeopleSoft zero-day and took about 2-3 TB of data, saying it was not for ransom.

The Hacker Newsupdated Sep 26, 19:03 UTC · 13h agofirst Sep 26, 11:46 UTC · 20h agoExploit / PoC in the wild 21 sources CVE-2026-352732· 1 read

ShinyHunters tells The Reg: We hacked the FBI to 'protect our business'

ShinyHunters says it stole FBI personnel files via an Oracle PeopleSoft zero-day to rebut an FBI bulletin.

ShinyHunters told The Register it breached FBIJobs.gov through an Oracle PeopleSoft zero-day, then accessed FBI-managed servers on AWS GovCloud and stole thousands of files on current, former, and prospective employees. Sample files reviewed by journalists reportedly include home addresses, phone numbers, emails, Social Security numbers, job titles, field offices, and emergency contacts. The FBI said it is investigating a claimed compromise of FBIJobs.gov and possible employee PII exposure, and that the entry point is still undetermined. The group said it sought no extortion payment and framed the intrusion as a response to a May 2026 FBI FLASH report.

The Register · Securityupdated Sep 26, 19:03 UTC · 13h agofirst Sep 25, 18:23 UTC · 1d agoData breach in the wild 21 sources

ShinyHunters claims FBI breach after alleged PeopleSoft zero-day attack

ShinyHunters claims to have breached the FBI via a PeopleSoft zero-day, stealing employee data as retaliation for a prior law enforcement advisory.

The ShinyHunters cybercrime group claims to have breached the U.S. FBI, allegedly using an Oracle PeopleSoft zero-day to steal 2-3 TB of data, including employee and applicant PII. The FBI is investigating the claim but has not confirmed a compromise. ShinyHunters states the attack was a response to a May 2026 FBI advisory, using the alleged breach as leverage to demand a retraction.

Security Affairsupdated Sep 26, 19:03 UTC · 13h agofirst Sep 23, 13:56 UTC · 3d agoData breach 21 sources CVE-2026-35273

ShinyHunters Claims FBI Breach Exposed Data of All Employees and Applicants

ShinyHunters claims it stole FBI employee and applicant data via an unverified PeopleSoft zero-day; the FBI is investigating.

ShinyHunters claims it breached FBI-linked systems and stole personal data on nearly all employees and applicants, including names, addresses, phone numbers, dates of birth, and spouse details. The group showed a sample of about 5,000 purported personnel records; some matched public records, but that does not confirm an FBI origin or the full claim. It alleged an unverified Oracle PeopleSoft zero-day and later access to an Amazon-hosted government cloud, plus defacement of FBIjobs.gov. The FBI says it is investigating unauthorized activity on that site and has not verified the theft, its scope, or the entry method.

GBHackersupdated Sep 26, 19:03 UTC · 13h agofirst Sep 23, 05:06 UTC · 4d agoData breach 21 sources

ShinyHunters Allegedly Claims Breach of FBI Jobs Site and Stolen Agents’ Data

ShinyHunters claims it breached FBI jobs systems, defaced the portal, and stole personnel records; the FBI is investigating.

The FBI said it is investigating claims of unauthorized activity affecting FBIjobs.gov after apply.fbijobs.gov briefly showed a ShinyHunters seizure notice and the bureau took the jobs application service and Special Agent Applicant Portal offline. ShinyHunters told reporters it exploited an undisclosed unauthenticated remote-code-execution flaw in Oracle PeopleSoft, moved into FBI-managed AWS GovCloud, and downloaded two to three terabytes, including HR and medical-related data. A sample of 5,000 purported employee records included names, addresses, phone numbers, Social Security numbers, assignments, dates of birth, and relative details; Reuters partially matched at least 10 cases, but neither Reuters nor 404 Media proved the sample came from FBI systems. Oracle, AWS, and the FBI have not validated that account, and the wider breach remains unproven.

Cyber Security Newsupdated Sep 26, 19:03 UTC · 13h agofirst Sep 23, 02:43 UTC · 4d agoData breach in the wild 21 sources

Hacking group ShinyHunters claims it breached the FBI, stole agents’ and applicants’ data

ShinyHunters says it stole FBI agent and applicant data via PeopleSoft and a government cloud.

ShinyHunters claimed on its leak site that it stole sensitive data on almost all FBI agents and people who applied for FBI jobs. 404 Media reviewed a sample of names, home addresses, and phone numbers for agents and their spouses and verified part of it against public records. The hackers said they breached an Oracle PeopleSoft server, pivoted into an Amazon-hosted government cloud, took terabytes of data, and defaced the FBI jobs portal, demanding removal of an FBI report rather than payment. The FBI had not commented; the report also notes an earlier intrusion into an FBI wiretap system and a separate Handala leak of Director Kash Patel's email.

TechCrunch · Securityupdated Sep 26, 19:03 UTC · 13h agofirst Sep 22, 18:40 UTC · 4d agoData breach 21 sources

ShinyHunters claims FBI hack: 'This is NOT financially motivated'

ShinyHunters claims an Oracle PeopleSoft zero-day let it steal 2–3 TB of FBI employee data.

ShinyHunters told The Register it exploited an Oracle PeopleSoft pre-authentication remote-code-execution zero-day on the FBI jobs website, defaced the page, and moved laterally to FBI systems on AWS GovCloud. The group claims it took about 2 to 3 terabytes on current, former, and prospective employees, including human resources, MedLink, and Criminal Justice Information Services. It says it is not seeking payment and instead wants the FBI to retract a May 15 bulletin alleging harassment, swatting, and false extortion claims. The FBI, Oracle, and AWS had not responded or confirmed the allegations at publication.

The Register · Securityupdated Sep 26, 19:03 UTC · 13h agofirst Sep 22, 17:24 UTC · 4d agoData breach 21 sources

Oracle PeopleSoft

Timeline7 articles

Related CVEsby mentions

Appears with