Cybersecurity
ShinyHunters bypasses PeopleSoft firewall rules
Google said ShinyHunters altered its Oracle PeopleSoft exploit to evade web application firewall rules, then used the access for web shells, credential theft and proxy tooling on vulnerable systems.
- Google's Mandiant said ShinyHunters used percent-encoded PeopleSoft paths to avoid firewall rules that blocked the vulnerable PSEMHUB endpoint.
- Oracle WebLogic decoded the encoded request and routed it to the same endpoint, which let the traffic through where literal-path filters did not.
- Google said the attackers deployed web shells, Ple64.exe, SIDEEYE, Neo-ReGeorg and MeshAgent during the campaign.
- ShinyHunters told BleepingComputer it used the bypass against FBI Jobs, while the FBI said it was investigating activity affecting FBIjobs.gov and had not confirmed a breach or theft.
Google said ShinyHunters changed its PeopleSoft exploit so that requests used an encoded path rather than a literal one. Mandiant said rules written to block access to the vulnerable PSEMHUB endpoint could miss that form of request.
Oracle WebLogic then decoded the path and sent it to the same endpoint. Mandiant said this could leave operators believing their firewall had reduced exposure when it had not.
Google warned that the group might use other encoded or mixed-case variants as well. Mandiant advised organisations to apply the latest update and to review WebLogic access logs for requests to the endpoint and similar encodings.
Google said the latest attacks placed web shells on dozens of systems worldwide across higher education, technology, IT services, healthcare, agriculture, transport and government. Before exploitation, the attackers typically sent five to 15 POST requests carrying serialised Java objects, which could reveal operating system details without breaking service.
After that, the attackers ran commands in memory or installed JSP shells. On Windows servers they used Ple64.exe, which posed as a Light Alloy installer and installed SIDEEYE, while Neo-ReGeorg and MeshAgent were also used to keep access and move through networks.
The article also revisited earlier claims about FBI systems. ShinyHunters had told BleepingComputer on 22 September that it had used a PeopleSoft zero-day against FBI Jobs, while the FBI said it was investigating but had not confirmed a breach or stolen data.
Named in this story
Companies
- published the report through its security teams
- Mandiant
- said the bypass let attackers reach the vulnerable endpoint
- Oracle
- patched the PeopleSoft flaw as CVE-2026-35273
Organisations
- ShinyHunters
- used an encoded URL path to bypass PeopleSoft firewall rules
- Google Threat Intelligence Group (GTIG)
- said the campaign had resumed against exposed servers
Governments and agencies
- FBI
- said it was investigating claims affecting FBIjobs.gov
Products and systems
- Oracle PeopleSoft
- was the application targeted in the attacks
- Oracle WebLogic
- decoded the encoded request and routed it to the endpoint
- FBI Jobs
- was named as a target in ShinyHunters' claim
- AWS GovCloud
- was cited in ShinyHunters' claim of lateral movement
- SIDEEYE
- was the backdoor Google said was installed on Windows servers
- Neo-ReGeorg
- was used as a tunnelling toolkit on compromised systems
- MeshAgent
- was used to maintain access on Linux systems
- Light Alloy
- was used as the disguise for Ple64.exe
How the source tells it
The article read as a technical security report with advisory language and close attribution, without a distinct emotive frame.
No emotive framing was found in the original.