Mandiant and Google Threat Intelligence Group say ShinyHunters has resumed widespread attacks on unpatched Oracle PeopleSoft servers by bypassing web application firewall rules for CVE-2026-35273. Their September 25 investigation found web shells on dozens of systems worldwide across several industries. BleepingComputer reported the new attack method on September 26.

The group, tracked by Google as UNC6240, exploited the same PeopleSoft flaw as a zero-day in May and June, initially focusing on higher education. Oracle issued a security alert in June for the PeopleTools vulnerability, which permits remote code execution without authentication. The renewed campaign targets systems whose operators blocked the vulnerable Environment Management Hub endpoint at a firewall but had not installed the security update, according to Mandiant.

The bypass changes the request path from /PSEMHUB/ to /%50SEMHUB/, replacing the letter P with its percent-encoded form. Mandiant explains that some firewalls compare the path before decoding it, while the application server decodes it and routes the request to the vulnerable servlet. Rules that match only the literal path can therefore miss the attack. Other encoded or mixed-case variations may also evade such rules.

Mandiant observed attackers first sending five to 15 POST requests to the encoded hub path to check whether a server was vulnerable. On exploited systems, the group executed commands in memory or installed JSP web shells, including x.jsp for command execution and u.jsp for file uploads. Researchers also found a trojanized installer named Ple64.exe that delivers the SIDEEYE backdoor on Windows hosts, and MeshAgent remote management software on some Linux hosts.

The affected systems span higher education, technology, IT services, healthcare, agriculture, transportation and government, Mandiant said. Oracle lists PeopleSoft Enterprise PeopleTools 8.61 and 8.62 as affected and provides security updates for CVE-2026-35273. Google advises operators to patch, disable the Environment Management Hub where appropriate, and inspect every application server for unauthorized files.

Defenders should review WebLogic access logs for /PSEMHUB/ and encoded variants such as /%50SEMHUB/, especially POST requests to /hub and unexpected JSP requests. Mandiant also recommends checking for the named web shells and backdoor, rotating credentials accessible to a compromised PeopleSoft service account, and investigating signs of data extraction. The reported bypass means a path-only firewall rule should not be treated as proof that an unpatched server is protected.