ShinyHunters has resumed widespread exploitation of the Oracle PeopleSoft flaw CVE-2026-35273 after developing a URL-encoding trick that slips past web application firewalls, according to Google's Mandiant and Threat Intelligence Group. The extortion gang, which Google tracks as UNC6240, is now reaching servers whose operators had not installed Oracle's security updates and had instead relied on WAF rules to block the vulnerable PSEMHUB endpoint. Google says the modified exploit lets the attackers bypass defenses that many organizations believed had mitigated their exposure.
Mandiant and GTIG report that the new technique hinges on a percent-encoded path. By requesting /%50SEMHUB/, where %50 stands for the letter P, the attackers evade WAF rules written to block the literal string /PSEMHUB/. According to Mandiant, many WAFs and reverse proxies compare the request path before decoding it, so a rule aimed at /PSEMHUB/ never matches the encoded form. Oracle WebLogic, by contrast, decodes the P and routes the request to the vulnerable endpoint anyway. Google warns the gang may rotate to other percent-encoded, mixed-case, or alternative variations of the path.
The activity follows the June disclosure of the PeopleSoft zero-day. BleepingComputer reported on June 10 that ShinyHunters was exploiting the flaw to steal data from 100 organizations, and Oracle fixed it the next day as CVE-2026-35273, which permits unauthenticated remote code execution. Google confirmed the same day that UNC6240 was targeting the education sector. At that point, Mandiant advised organizations that could not immediately patch or disable the Environment Management Hub to block external access to /PSEMHUB/*.
Google says the latest wave has planted web shells on dozens of systems worldwide, hitting higher education, technology, IT services, healthcare, agriculture, transportation, and government organizations. Before exploitation, the attackers typically send five to 15 POST requests to /%50SEMHUB/hub carrying serialized Java objects. On vulnerable hosts, those requests return operating system details without writing files or disrupting service, letting the gang quietly confirm which servers are exploitable.
Once a target is confirmed, the attackers execute commands in memory or drop JSP web shells. Google says they deploy an x.jsp shell for command execution and u.jsp and u2.jsp shells for uploading larger files. On compromised Windows servers, the shells were used to install an executable named Ple64.exe, which poses as a signed Light Alloy media player installer but delivers a backdoor Google tracks as SIDEEYE. That malware steals credentials, manages processes and files, opens interactive reverse shells, and provides reverse proxy capability.
The gang also placed the open-source Neo-reGeorg tunneling toolkit on victims via tunnel.jsp and tunnel.jspx, letting SOCKS5 proxy traffic ride over ordinary HTTP and HTTPS connections so a compromised PeopleSoft server can be used to move laterally into internal networks. Mandiant's guidance is to install the latest security update rather than depend on a WAF, and to review WebLogic access logs for /PSEMHUB/ and encoded variants such as /%50SEMHUB/ as signs of exploitation.
More cybersecurity news from TechManNews.
