Oracle PeopleSoft flaw under mass attack as attackers bypass WAFs

A patched PeopleSoft bug becomes an emergency again

Oracle PeopleSoft flaw under mass attack is the headline security teams should be using for this incident: Google’s Mandiant and Google Threat Intelligence Group say UNC6240, the cluster associated with ShinyHunters, has renewed mass exploitation of CVE-2026-35273 against Oracle PeopleSoft environments [1]. The vulnerability is rated critical at CVSS 9.8 and can enable unauthenticated remote code execution, according to reporting that summarized Google’s findings and the Oracle-linked flaw [2].

The new campaign matters because it is not simply a rerun of the May-June activity. In the first wave, the attackers used the flaw as a zero-day mainly against academic institutions; in the latest wave, Google says the targeting has expanded globally across higher education, technology, IT services, healthcare, agriculture, transportation and government [1]. Reuters, carried by CNA, likewise reported that the latest activity affected dozens of systems globally and that the attackers focused on organizations that added web application firewall rules but had not applied Oracle’s update [3].

That is the uncomfortable lesson of the day: perimeter filtering bought time, not safety. Mandiant says the operators modified the exploit to reach the vulnerable Environment Management Hub, or PSEMHUB, even where defenders believed WAF rules were blocking access [1]. The result is a “patch-right-now” problem for any organization that still has exposed or insufficiently remediated PeopleSoft infrastructure.

The one-character WAF bypass

The bypass described by Mandiant is technically simple and operationally effective. Instead of requesting the literal /PSEMHUB/ path, the attackers used a percent-encoded variant, /%50SEMHUB/, where %50 represents the letter “P” [1]. Many WAF and reverse proxy rules compare the raw path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet [1].

That mismatch is enough to break a brittle control. Google says defenders should assume that attackers may use percent-encoded, mixed-case or otherwise non-normalized variants of the PSEMHUB path and should enforce blocking on the normalized path, not just on one literal string [1]. The Hacker News’ account of the campaign presents the same attack chain: verification requests to /%50SEMHUB/hub, WAF bypass using the encoded “P,” then exploitation of Java deserialization in the PSEMHUB hub servlet [2].

The verification phase is also notable. Mandiant observed targeted servers receiving five to 15 POST requests to /%50SEMHUB/hub containing a serialized Java object before exploitation; unpatched servers could return the host operating system without creating files, giving the attacker a low-noise way to confirm exposure [1]. For defenders, that means “no web shell found” is not the same as “not targeted.”

Web shells, fileless execution and persistence

Once the attackers confirm a target, Google says they have used two exploitation styles: dropping web shells and executing commands without writing files to disk [1]. The web shell route involves repeated POST requests to the encoded PSEMHUB path and the creation of JSP files such as x.jsp, u.jsp or sequentially numbered files in the PSEMHUB.war directory; Google notes the repetition may help place shells across nodes behind load balancers [1].

The second route is harder for teams that rely on file creation alerts. In fileless command execution, POST requests to /%50SEMHUB/hub return command output directly in the HTTP response, while host telemetry may only show cmd.exe or /bin/sh spawned by the WebLogic Java process [1]. This means detection has to look beyond known filenames and include parent-child process relationships, unusual outbound traffic and encoded-path access logs.

Mandiant also described two complementary JSP shells. x.jsp supports cross-platform command execution, while u.jsp and a variant can upload files in chunks and execute Windows commands after reassembly [1]. The Hacker News reported that the attackers used these shells to stage a signed trojanized installer named Ple64.exe, tracked by Google as the SIDEEYE backdoor [2].

SIDEEYE raises the risk profile beyond a simple web compromise. Google’s analysis says Ple64.exe masquerades as a Light Alloy media player installer, is signed with a valid Extended Validation certificate, and loads a multi-stage C++ backdoor in memory [1]. Google says SIDEEYE supports browser and desktop application credential theft, process and file management, interactive reverse shell capabilities and reverse proxy functions [1]. WhaleAgent’s Hong Kong-based report emphasized the same point for defenders: the toolset observed in this campaign includes SIDEEYE, JSP web shells, Neo-reGeorg tunneling and MeshAgent [4].

Why PeopleSoft compromise can outlive the web server

The strategic concern is not only that a public-facing servlet can be reached. PeopleSoft commonly sits close to human resources, payroll, student, finance or personnel workflows, so a compromised application tier can become a bridge into sensitive data and privileged service accounts. Mandiant warned that commands observed across compromised instances sometimes executed as root or NT Authority\SYSTEM, while other commands ran under PeopleSoft or WebLogic service accounts that could still read PeopleSoft configuration, database connection strings and application data [1].

The campaign also has an extortion shadow. Google says UNC6240 has a pattern of data-theft extortion and advised affected organizations to prepare for extortion communications and monitor for public exposure of stolen data [2]. Reuters reported the renewed campaign days after ShinyHunters claimed it had stolen FBI personnel data, while noting it had not corroborated the claim and that Oracle did not respond to requests for comment [3]. The Hacker News separately reported that a ShinyHunters spokesperson claimed the FBIJobs.gov intrusion used a different PeopleSoft zero-day, not CVE-2026-35273 [2]. That claim should not distract defenders from the confirmed CVE-2026-35273 exploitation wave, but it underscores why PeopleSoft exposure is drawing attacker attention.

What defenders should do now

The first control is patching. Mandiant’s guidance is explicit: apply the Oracle Security Alert patch for CVE-2026-35273, because WAF rules and path-based blocking are not substitutes for remediation [1]. If EMHub is not required, organizations should disable it in multi-server configurations or remove the PSEMHUB application in single-server configurations, according to Google’s recommended hardening steps [1].

The second control is scoping. Security teams should search PIA WebLogic access logs for /PSEMHUB/ and percent-encoded variants such as /%50SEMHUB/, especially POST requests to /hub and requests for unexpected .jsp or .jspx files [1]. They should inspect every WebLogic node, not only the first server identified, because Mandiant says repeated exploit attempts may have been used to reach multiple nodes behind load balancers [1].

The third control is credential and data protection. Google recommends rotating credentials readable by the PeopleSoft application service account, including database connection strings in psappsrv.cfg, Integration Broker credentials and cloud credentials reachable from the web tier [1]. The Hacker News also summarized guidance to review database audit logs for bulk queries or exports against HR, payroll and student-record tables, and to hunt for large archive files in temporary or web-accessible directories [2].

Finally, organizations should tune detections for behavior rather than only for specific indicators. Alerts should cover WebLogic spawning shells, encoded PSEMHUB paths, unexpected files in PSEMHUB.war, outbound connections associated with MeshAgent or SIDEEYE infrastructure, and tunneling behavior consistent with Neo-reGeorg [1]. This incident is a reminder that “blocked at the WAF” can be a dangerous assumption when the application and the perimeter device normalize URLs differently.

The practical conclusion is blunt: if PeopleSoft is internet-reachable and CVE-2026-35273 is not fully remediated, treat the system as potentially probed or compromised. Patch Saturday has arrived.

Sources from the last 72 hours

1. [1]ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoftSep 25, 2026, 12:00 AM UTC
2. [2]Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web ShellsSep 26, 2026, 12:00 AM UTC
3. [3]ShinyHunters hackers expanded attacks on Oracle's PeopleSoft, Google saysSep 26, 2026, 2:05 AM UTC
4. [4]一個字元破防火牆 ShinyHunters 再攻 PeopleSoftSep 26, 2026, 4:49 AM UTC

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.