By Amar Ćemanović
Publication Date: 2026-09-26 10:42:00
Google’s Mandiant and Threat Intelligence Group (GTIG) have observed ShinyHunters launching a renewed mass-exploitation campaign against vulnerable Oracle PeopleSoft servers, compromising dozens of systems across multiple industries.
The activity supports recent claims from the cybercrime group that it had resumed exploiting PeopleSoft environments against a broader range of targets.
The threat group, tracked by Google as UNC6240, is again exploiting CVE-2026-35273, a critical PeopleSoft vulnerability it previously used as a zero-day between May 27 and June 9.
Oracle issued an emergency security update for the flaw on June 10. However, Mandiant says ShinyHunters has now modified its attacks to bypass organizations that attempted to mitigate the vulnerability using web application firewall (WAF) rules instead of installing the patch.
The bypass is remarkably simple. Rather than requesting the vulnerable /PSEMHUB/ endpoint directly, attackers replace the letter…