ShinyHunters Went Back for the PeopleSoft Servers That Got a WAF Rule Instead of the Patch. Google Has Notified Over 100 More Organizations

Google Threat Intelligence has notified more than 100 organizations that their Oracle PeopleSoft servers are being exploited again through CVE-2026-35273, a flaw Oracle patched on 10 June. The unpatched-server part is not the news. The news is which unpatched servers: according to Google, the group is selecting for operators who read June's advisory, deployed the recommended web application firewall rule, and stopped there.

The flaw, and what it sits on top of

CVE-2026-35273 is a CVSS 9.8 vulnerability in the Environment Management Hub (PSEMHUB) component of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62. Oracle's own description is the short version of why it scores that high: it is reachable over HTTP with no authentication, and a successful attacker takes over the server. Oracle issued an out-of-band Security Alert on 10 June after Mandiant confirmed exploitation in the wild, closing a zero-day window that had been open since 27 May.

The first wave landed almost entirely on universities: more than 100 organizations notified, roughly two thirds of them US higher education. The University of Nottingham confirmed exposure of around 455,000 unique email addresses along with names, addresses, phone numbers, passport numbers and disability information. That is the right way to think about the blast radius. PeopleSoft is HR and student administration, so one server is a personnel file for an entire institution.

The mitigation turned into a target list

Oracle's June advisory, and Mandiant's guidance alongside it, offered the usual pairing: patch, and in the meantime restrict access to the vulnerable endpoint. That was reasonable. PeopleTools patching is genuinely slow — change windows, regression testing against years of local customization — and a filtering rule buys time.

Three and a half months is not "in the meantime." Google's follow-up report, published on 25 September, is blunt about what happened to organizations that never got past the stopgap:

UNC6240 adapted to published defensive guidance, targeting organizations that implemented WAF rules but did not patch the vulnerability.

The group modified its requests so that rules keyed to the vulnerable endpoint's path no longer match them. This is the structural weakness of virtual patching stated plainly: a path-matching rule is a promise about strings, not about the code behind them. When the attacker controls how the string is written, the promise lapses. Google's conclusion is a single sentence worth putting on a wall:

WAF rules and path-based blocking are not a substitute for patching.

There is a second, quieter failure here. A virtual patch does not just leave the hole open — it closes the ticket. The vulnerability moves to "mitigated" on the risk register, stops competing for a change window, and drops out of the reporting that would otherwise escalate it. The organizations being compromised now are, in a sense, the ones with functioning security programs that trusted their own status field.

What is on the servers now

The renewed campaign is broader than the education-sector wave. Google describes web shells deployed on "dozens of systems globally," with victims in higher education, technology, IT services, healthcare, agriculture, transportation and government.

It also documents a new implant, SIDEEYE: a multi-stage Windows backdoor delivered as a fake media player installer, signed with a certificate that has since been revoked. Google reports it can steal credentials, manage files and processes, open reverse shells and proxy traffic through the compromised host. That last function is the one to sit with. A PeopleSoft application server is not an edge box; it holds database connection strings and usually sits well inside the network. A proxy there is a foothold in the part of the estate that perimeter controls were built to protect.

What to do about it

• Apply Oracle's Security Alert patch for CVE-2026-35273. Nothing short of it closes the vulnerability.
• Disable the Environment Management Hub service in multi-server configurations; remove the PSEMHUB application entirely in single-server ones. Most production deployments do not need it.
• If the server was internet-reachable and unpatched at any point since June, treat it as compromised until proven otherwise: review the PeopleSoft web server access logs and the PSEMHUB application directory against the indicators in Google's advisory, and rotate every credential the PeopleSoft service account can read, including database connection strings and cloud credentials.
• Do not read a quiet WAF log as evidence of anything.

ShinyHunters spent this week making a separate, louder claim — that it holds data on FBI personnel, with a deadline attached. Whatever that turns out to be worth, it does not change the arithmetic on PeopleSoft: a 9.8 with a patch available since June, an actor running it at scale, and a mitigation that has stopped working as a defence and started working as a way to find people who thought they were done.

Sources: Google Threat Intelligence: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft · Google Threat Intelligence: ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit · BleepingComputer: ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks · Cybersecurity Dive: ShinyHunters linked to exploitation of critical flaw in Oracle PeopleSoft · The Hacker News: ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities · Cybernews: ShinyHunters targets PeopleSoft again with Oracle zero-day attacks · Reuters via U.S. News: ShinyHunters Hackers Expanded Attacks on Oracle's PeopleSoft, Google Says