ShinyHunters is using a URL-encoding trick to bypass WAF rules and keep exploiting Oracle PeopleSoft CVE-2026-35273 on unpatched servers. The group is deploying web shells and backdoors to steal data, move laterally, and maintain access across multiple sectors, including higher education and government. #ShinyHunters #UNC6240 #OraclePeopleSoft #CVE-2026-35273 #SIDEEYE #Neo-reGeorg #MeshAgent

Mandiant and GTIG report renewed mass exploitation of CVE-2026-35273 in Oracle PeopleSoft by UNC6240 (ShinyHunters), using a URL-encoded WAF bypass to reach the vulnerable PSEMHUB endpoint and deploy web shells worldwide. The campaign expanded beyond education into technology, IT services, healthcare, agriculture, transportation, and government, and also involved SIDEEYE, Neo-reGeorg, and MeshCentral infrastructure. #CVE-2026-35273 #UNC6240 #ShinyHunters #OraclePeopleSoft #SIDEEYE #Neo-reGeorg #MeshCentral

Mandiant and GTIG report renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), which bypasses WAF rules by using a percent-encoded /%50SEMHUB/ path to reach Oracle PeopleSoft’s vulnerable PSEMHUB endpoint. The campaign spans multiple sectors worldwide and uses web shells, SIDEEYE via a trojanized Ple64.exe installer, Neo-reGeorg tunnels, and MeshAgent for persistence and lateral movement. #UNC6240 #ShinyHunters #CVE-2026-35273 #OraclePeopleSoft #SIDEEYE #Ple64.exe #Neo-reGeorg #MeshAgent

The FBI investigated a hacking group’s claim of unauthorized access as its hiring website and applicant portal were unavailable.

ShinyHunters claims it breached FBI systems by exploiting an unpatched Oracle PeopleSoft zero-day, then moved into FBI-managed AWS GovCloud infrastructure and stole sensitive employee and applicant data. The group also says it defaced the FBI Jobs site, targeted additional organizations with the same flaw, and framed the intrusion as retaliation over an FBI FLASH report. #ShinyHunters #OraclePeopleSoft #FBI #AWSGovCloud #KashPatel

Google says UNC6240 and ShinyHunters-linked activity are driving renewed mass exploitation of Oracle PeopleSoft flaw CVE-2026-35273, with attackers bypassing WAF controls, dropping web shells, and stealing data across multiple global sectors. The campaign has affected higher education, healthcare, government, technology, and other organizations, while separate ShinyHunters claims mention a breach of...

Le groupe de cybercriminels ShinyHunters revendique publiquement une intrusion dans plusieurs services liés au FBI, affirmant détenir des données sur l'ensemble des employés et candidats du FBI. Selon un représentant du groupe, l'attaque a été réalisée via une vulnérabilité zero-day dans Oracle PeopleSoft.

Daily Recap, U.S. export controls compelled Anthropic to take Fable 5 and Mythos 5 offline for foreign nationals, underscoring tighter access to advanced AI models. Elsewhere, Chinese-linked actors showed long-running stealth in an authentication hijack and Linux backdoor campaigns, while Arch Linux AUR package hijacking pushed an infostealer and eBPF rootkit. #Anthropic #Fable5 #Mythos5 #Fable5 #Mythos5 #AuthHijack #LinuxBackdoor #ArchLinuxAUR #eBPF #Conti #ShinyHunters #OraclePeopleSoft #Coupang #23andMe #phpBB #FISA #DeepfakePornSite

Nissan has confirmed a data breach tied to a zero-day campaign against Oracle PeopleSoft customers, with attackers suspected of stealing employee records across the US, Canada, Mexico, and Brazil. The campaign is widely linked to ShinyHunters, and other known targets include the University of Nottingham, the NAIC, Illinois Central College, and...

Nissan says a data breach exposed current and former employee information after attackers exploited an Oracle PeopleSoft vulnerability in theft attacks linked to ShinyHunters. The incident may have affected employees in the United States, Canada, Mexico, and Brazil, while Oracle and Mandiant have confirmed widespread exploitation of CVE-2026-35273 across hundreds of organizations. #Nissan #OraclePeopleSoft #ShinyHunters #CVE-2026-35273

NAIC says ShinyHunters accessed its systems through an Oracle PeopleSoft zero-day, but the stolen data was limited to publicly available reports, outdated logs, and configuration files. The organization says no PII or financial data was exposed, and it has remediated affected systems after the extortion attempt and leak. #ShinyHunters #NAIC #OraclePeopleSoft #CVE-2026-35273

Researchers say ShinyHunters exploited an Oracle PeopleSoft zero-day, CVE-2026-35273, to potentially breach more than 100 organizations, with higher education accounting for most of the exposed victims. Oracle has issued mitigation guidance but no patch yet, while victims such as the University of Nottingham have confirmed student data theft. #ShinyHunters #OraclePeopleSoft #CVE-2026-35273 #UniversityofNottingham

Mandiant and GTIG identified an active extortion campaign by UNC6240 (ShinyHunters) exploiting CVE-2026-35273 as a zero-day against Oracle PeopleSoft Environment Management Hub endpoints. The attackers used MeshCentral staging servers, masquerading Azure-related binaries, and a propagation script to move laterally and leak stolen data to the ShinyHunters Data Leak Site. #UNC6240 #ShinyHunters #OraclePeopleSoft #CVE-2026-35273 #MeshCentral

Mandiant and GTIG attributed an active extortion and compromise campaign against Oracle PeopleSoft infrastructure to UNC6240 (ShinyHunters), using CVE-2026-35273 as a zero-day to target Environment Management Hub endpoints. The attackers used MeshCentral staging servers, custom propagation scripts, and data theft that culminated in leaks on the ShinyHunters Data Leak Site. #UNC6240 #ShinyHunters #OraclePeopleSoft #CVE-2026-35273 #MeshCentral #PSEMHUB

Oracle PeopleSoft servers are being hit by ongoing data theft attacks linked to the ShinyHunters extortion gang, which claims to have stolen data from more than 100 organizations and 300 instances. Investigators found exposed tooling and indicators tied to the campaign, including scripts, staging files, and IP addresses, while Nottingham University has acknowledged a cybersecurity incident. #ShinyHunters #OraclePeopleSoft #NottinghamUniversity

NAIC says most operations resumed after a PeopleSoft incident, but insurer investment designations and online payments remain affected.