Oracle released an emergency patch for the flaw on June 10, but the current campaign targets organizations that relied on firewall mitigations instead of updating. Google has provided indicator of compromise data and a technical remediation guide, while warning affected victims to prepare for extortion. ShinyHunters has previously claimed to have accessed FBI data using a vulnerability in PeopleSoft.
Tuesday, October 20, 2026
Story
ShinyHunters Bypasses Firewalls to Breach Dozens of Oracle PeopleSoft Systems
Cybersecurity25 days ago
Mandiant and Google Threat Intelligence Group have detected a new wave of attacks launched by the UNC6240 hacking group against Oracle PeopleSoft PeopleTools. The group, known as ShinyHunters, is exploiting a vulnerability (CVE-2026-35273) with a CVSS score of 9.8 to plant web shells and a backdoor called SIDEEYE on dozens of systems globally. These breaches have affected the government, healthcare, transportation and technology sectors, with 25% of observed commands executed with root or SYSTEM privileges. The attackers bypassed Web Application Firewall rules by encoding characters in requests to the /PSEMHUB/ endpoint to circumvent defenses.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.