"This allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure," Mandiant explains.
The percent-encoding trick that reopened PeopleSoft servers
Attackers tracked as the ShinyHunters extortion gang have resumed exploiting Oracle PeopleSoft by sending percent-encoded URL paths that evade common web application firewall (WAF) rules. Rather than requesting the literal vulnerable path, /PSEMHUB/, attackers are requesting an encoded variant such as /%50SEMHUB/. The '%50' sequence is the percent-encoded representation of the letter 'P'.
Google's Mandiant and Threat Intelligence Group (GTIG) report that many WAFs and reverse proxies perform rule matching on the literal request path before any decoding. Oracle WebLogic, however, decodes the encoded 'P' and routes the request to the vulnerable endpoint, effectively bypassing the WAF block and reaching the PSEMHUB endpoint on systems that administrators believed were mitigated.
How the exploit workflow operates in practice
According to Mandiant and Google's reporting, attack sequences begin with reconnaissance POST requests. Before attempting full exploitation, ShinyHunters typically sends between five and 15 POST requests to /%50SEMHUB/hub containing serialized Java objects. On vulnerable systems these probe requests return host operating system information without writing files or disrupting service, which lets the attackers quietly determine whether a server is exploitable.
Once vulnerability is confirmed, the actors either execute commands directly in memory or deploy JSP web shells to gain persistent control and perform follow-on operations.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDeployed tools and the data-theft chain
Google says the new attack wave has resulted in web shells on dozens of systems worldwide across higher education, technology, IT services, healthcare, agriculture, transportation, and government organizations. The actors generally deploy an x.jsp web shell for command execution and u.jsp/u2.jsp shells for uploading larger files.
On compromised Windows servers, attackers dropped an executable named Ple64.exe that masquerades as a Light Alloy media player installer but installs a backdoor Google tracks as SIDEEYE. Google describes SIDEEYE as used to steal credentials, perform process and file management, create interactive reverse shells, and provide reverse proxy functionality. Attackers also deployed the open-source Neo-reGeorg tunneling toolkit via tunnel.jsp and tunnel.jspx to carry SOCKS5 proxy traffic over HTTP/HTTPS, enabling lateral movement.
Mandiant observed the threat actors using legitimate MeshAgent remote management software to maintain access to compromised Linux systems.
Claims about an FBI Jobs breach and the broader impact
These new PeopleSoft attacks follow a ShinyHunters claim — reported to BleepingComputer on September 22 — that the group breached FBI systems using a PeopleSoft vulnerability and accessed the FBI Jobs platform, then moved into AWS GovCloud infrastructure. ShinyHunters told BleepingComputer they stole between 2TB and 3TB of data related to FBI employees, applicants, and other internal systems.
BleepingComputer said it could not independently verify the alleged zero-day, the lateral movement, or the amount of stolen data. The FBI confirmed it was investigating claims of unauthorized activity affecting FBIjobs.gov but did not confirm that its systems had been breached or that data was stolen. ShinyHunters has confirmed to BleepingComputer that they used the WAF bypass against FBI Jobs and continue to claim they exploited a "NEW unknown vulnerability in the same PSEMHUB component."
Earlier in June, BleepingComputer reported that the gang had used a zero-day to steal data from 100 organizations; Google and Oracle reporting that followed documented active exploitation of CVE-2026-35273, which Oracle described as allowing unauthenticated remote code execution.
Mandiant's immediate steps and detection guidance
- Mandiant urges organizations running Oracle PeopleSoft to install the latest security update for CVE-2026-35273 rather than relying on WAF rules that block the literal /PSEMHUB/ path.
- Where immediate patching is not possible, Mandiant previously advised blocking external access to the vulnerable /PSEMHUB/* endpoint; Google warns attackers may use other percent-encoded, mixed-case, or alternative variations to bypass literal-path WAF rules.
- Organizations are advised to search WebLogic access logs for requests to the literal '/PSEMHUB/' and encoded variants such as '/%50SEMHUB/' to detect signs of exploitation.
The technical lesson here is narrow and stark: defenses that match only the literal request string can be trivial to circumvent when the application stack decodes URLs differently than edge protections. For operators of Oracle PeopleSoft, the definitive mitigation in the reporting is simple and specific — apply the vendor security update for CVE-2026-35273. For investigators and defenders, the evidence trail is also specific: look for percent-encoded requests to PSEMHUB endpoints and the presence of known web shells, SIDEEYE artifacts, Neo-reGeorg tunneling files, MeshAgent installations, and Ple64.exe on Windows hosts.
Source: BleepingComputer
