ShinyHunters WAF Bypass Resumes PeopleSoft Zero-Day Attacks

The ShinyHunters extortion gang has found a way to slip past web application firewalls (WAFs) that were meant to stop attacks on PeopleSoft application servers, according to new research from Google’s Mandiant and Threat Intelligence Group (GTIG). By simply encoding the first letter of a vulnerable web address, the attackers are reaching systems whose administrators believed a firewall rule had already closed the door.

The vulnerability at the center of this campaign is CVE-2026-35273, a critical flaw in the Environment Management Hub (PSEMHUB) component of the PeopleSoft platform. It allows unauthenticated remote code execution, meaning an attacker who has not logged in can run commands on the server. The platform's vendor fixed the problem in June 2026, shortly after BleepingComputer first reported that ShinyHunters was actively exploiting it as a zero-day to steal data from at least 100 organizations, many in the education sector. Mandiant, which tracks the group as UNC6240, confirmed the zero-day exploitation and advised organizations that could not immediately patch to block external access to the “/PSEMHUB/” endpoint—a common way to make the vulnerable component unreachable without taking the whole application offline.

That advice led many defenders to write a simple WAF rule: if a request arrives for “/PSEMHUB/”, block it. The new bypass shows why such rules are fragile. Instead of sending the literal path, ShinyHunters now transmits “/%50SEHUB/”. The “%50” sequence is the percent-encoded version of the letter “P”. Many WAFs and reverse proxies inspect the raw request path before any decoding happens, so a rule looking for “/PSEMHUB/” does not trigger on the encoded form. The application server that powers PeopleSoft, however, decodes the “%50” back to “P” and routes the request to the vulnerable endpoint. The result is a clean bypass. Mandiant warns that the group is unlikely to stick to one encoding; attackers could switch to mixed-case spellings or other percent-encoded characters to dodge different firewall signatures.

The renewed attacks have already placed web shells on dozens of servers worldwide, hitting higher education, technology, IT services, healthcare, agriculture, transportation and government organizations. In a typical intrusion, ShinyHunters first sends between five and fifteen POST requests to “/%50SEMHUB/hub” containing serialized Java objects. On vulnerable systems, these test probes return host operating system details without writing any files or causing a crash, letting the attackers quietly confirm a server is exploitable. Once confirmed, the group exploits the flaw to run commands directly in memory or to drop JSP web shells named “x.jsp”, “u.jsp” and “u2.jsp”. On compromised Windows machines, they then deploy an executable called “Ple64.exe”, which disguises itself as a signed Light Alloy media player installer but actually installs a backdoor that Mandiant tracks as SIDEEYE. That malware steals credentials, manages files and processes, and creates interactive reverse shells with reverse proxy capabilities. To tunnel deeper into the internal network, the attackers also install the open-source Neo-reGeorg toolkit (files “tunnel.jsp” and “tunnel.jspx”), which funnels SOCKS5 proxy traffic over normal HTTP and HTTPS connections. On Linux systems, they maintain access through the legitimate remote management software MeshAgent.

ShinyHunters has separately claimed to BleepingComputer that it used a PeopleSoft zero-day—and this very WAF bypass—to break into the FBI Jobs platform and move laterally into the FBI’s AWS GovCloud infrastructure, allegedly stealing between 2 and 3 terabytes of data on current and former employees and job applicants. The FBI confirmed it was investigating reports of unauthorized activity on fbijobs.gov but did not verify that its systems were breached or that data was exfiltrated. BleepingComputer has not independently confirmed the scope of that incident.

Mandiant urges organizations running PeopleSoft to install the latest security update immediately rather than relying on a WAF to block the attack surface. The firm also recommends searching the application server’s access logs for requests to “/PSEMHUB/” and any encoded variants like “/%50SEMHUB/” as indicators of potential exploitation. For any web-facing application, a layered defense approach matters: patching the software is the only reliable countermeasure, while firewall rules and log monitoring provide additional detection layers that can catch an attempted bypass before damage spreads. For organizations managing PeopleSoft or similar platforms, a security-first infrastructure partner like AEU-I provides the disciplined patch management and layered defenses that WAF workarounds alone cannot replace.