ShinyHunters Beat a WAF With One Percent Sign, and the FBI Found Out the Hard Way

Some breaches come down to a genuinely novel exploitation chain. This one comes down to a single percent sign. ShinyHunters, the extortion group Google's Mandiant tracks as UNC6240, resumed attacks on Oracle PeopleSoft systems this month using a WAF bypass so simple it barely reads like a technique: request /%50SEMHUB/ instead of /PSEMHUB/, and a firewall rule written to block the second string never fires on the first. Among the organizations hit was the FBI's own job application infrastructure, which went offline as a result. The vulnerability underneath it had already been patched for three months.

The vulnerability this all sits on top of

CVE-2026-35273 is an unauthenticated remote code execution flaw in the Environment Management Hub, a component of Oracle PeopleSoft PeopleTools versions 8.61 and 8.62, scoring a 9.8 out of 10 on CVSS. Reported through Trend Micro's Zero Day Initiative, it was first exploited as a genuine zero-day around June 10, 2026, hitting roughly 100 organizations, mostly higher-education institutions running PeopleSoft for student and HR systems. Oracle shipped a patch the very next day, June 11. For anyone who applied it, this entire story is already over. The renewed campaign only touches organizations that, for whatever reason, didn't.

Why "didn't patch" doesn't mean "did nothing"

This is the part worth sitting with. A lot of the organizations still exposed weren't ignoring the problem, they were mitigating it the way security teams do when a patch can't go in immediately: a WAF rule blocking requests to the known vulnerable path, /PSEMHUB/. That's a reasonable stopgap. It's also exactly the kind of stopgap that only works as long as the attacker requests the path the same way the defender wrote the rule.

ShinyHunters didn't request it the same way. They sent /%50SEMHUB/hub instead, where %50 is nothing more exotic than the URL-encoded representation of the capital letter P. Most WAF rule sets, especially simpler string-match rules rather than fully normalizing ones, compare the request path as literal text. /%50SEMHUB/ is not the literal text /PSEMHUB/, so the rule doesn't match, and the request sails through. Then it hits Oracle WebLogic, which does what web servers are supposed to do with percent-encoded characters: decodes them back to their real value before deciding where to route the request. WebLogic sees PSEMHUB, exactly as before, and hands it straight to the same vulnerable component the June patch was written for.

Nothing about the underlying vulnerability changed. What changed is that the firewall and the application server disagreed about what the URL actually said, and the application server's opinion is the one that matters, because it's the one running the code.

What ShinyHunters did once they were in

The reconnaissance phase looked almost quiet by design: 5 to 15 POST requests carrying serialized Java objects sent to /%50SEMHUB/hub, enough to fingerprint a vulnerable system without much noise. Once confirmed, the group dropped small JSP web shells, files named things like x.jsp, u.jsp, and u2.jsp, giving them command execution and file upload through nothing more than a web browser. On Windows hosts they went further, deploying a binary called Ple64.exe disguised as media player software, which installs a backdoor researchers are calling SIDEEYE: credential theft, file and process management, and reverse shell capability. Internal movement leaned on the Neo-reGeorg tunneling toolkit and MeshAgent remote management software, and some of the commands they ran executed with root or SYSTEM privileges, the ceiling for what a compromised host can hand over.

Dozens of organizations across higher education, technology, IT services, healthcare, agriculture, transportation, and government were hit in this renewed wave. The one that made headlines is the FBI's own job application infrastructure, apply.fbijobs.gov and fbijobs.gov/special-agents, both taken offline. ShinyHunters claims to hold records on tens of thousands of current, former, and prospective employees, including medical information, and is using the claim as leverage against a public FBI statement discouraging organizations from paying ransom demands. Whatever the final scope turns out to be, an extortion group using a law enforcement agency's own hiring pipeline as a pressure point is not a subtle message.

What actually fixes this, versus what only looked like it did

The fix was always the June update, not the firewall rule. Mandiant's own guidance says as much: install the patch rather than lean on WAF mitigation as a long-term answer. If you're still working through your own exposure, check WebLogic and web server logs for both the literal /PSEMHUB/ path and encoded variants like /%50SEMHUB/, look for the JSP web shell filenames above sitting in web-accessible directories, and treat any command shell spawned as a child of the WebLogic Java process as an incident until proven otherwise.

The part worth remembering past this one CVE

I think about compensating controls the same way I thought through the ten fixes in the vulnerability management program I built: a mitigation you put in place because you can't patch yet is a real thing worth doing, but it's borrowing time, not paying off the debt. A WAF rule that blocks one exact string is doing pattern matching, and pattern matching only holds up against attackers who send the pattern you expected. URL encoding, case changes, extra slashes, any of a dozen ways to say the same path differently at the wire level, are the oldest tricks in the book for exactly this reason. None of that is a knock on WAFs generally, a well-tuned one with proper normalization catches this specific trick easily. It's a reminder that a compensating control is a clock running down to the actual fix, not a replacement for it, and ShinyHunters just showed, very publicly, what happens when an organization forgets which one it was relying on.

Frequently asked questions

Who is ShinyHunters?

ShinyHunters is a financially motivated extortion group that Google's Mandiant and Threat Intelligence Group track internally as UNC6240. They specialize in stealing data at scale rather than deploying ransomware, then threatening to leak it unless paid. This PeopleSoft campaign and the earlier attacks against Salesforce customers are both associated with the same group.

What is CVE-2026-35273?

It is a critical, unauthenticated remote code execution vulnerability in the Environment Management Hub component of Oracle PeopleSoft PeopleTools, versions 8.61 and 8.62. It carries a CVSS score of 9.8. Oracle patched it on June 11, 2026, after it was first exploited as a zero-day against roughly 100 organizations, mostly universities.

How did ShinyHunters bypass the WAF if the vulnerability was already patched?

The bypass does not defeat the patch. It defeats organizations that chose not to apply the patch and relied on a web application firewall rule blocking the literal path /PSEMHUB/ instead. ShinyHunters requested /%50SEMHUB/, where %50 is the URL-encoded form of the letter P, which many WAFs compare as plain text and therefore never recognized as the blocked path, while Oracle WebLogic decoded it back to PSEMHUB before routing the request to the same vulnerable component.

Was the FBI actually hacked through this vulnerability?

ShinyHunters claims to have accessed the FBI's job application infrastructure, apply.fbijobs.gov and fbijobs.gov/special-agents, both of which went offline, and says it obtained records on tens of thousands of current, former, and prospective employees, including medical information. The group is using the claim to pressure the FBI over a public service announcement discouraging ransom payments. The FBI has not published a detailed technical confirmation as of this writing.

How do I check if my organization was targeted by this technique?

Search WebLogic and web server access logs for requests to both /PSEMHUB/ and encoded variants such as /%50SEMHUB/, particularly a burst of 5 to 15 POST requests to a path ending in /hub. Check for unexpected JSP files with names like x.jsp, u.jsp, or u2.jsp in web-accessible directories, and alert on any command shell spawned as a child process of the WebLogic Java process.

What is the actual fix, if a WAF rule isn't enough?

Apply Oracle's June 2026 security update for PeopleTools 8.61 and 8.62. A WAF rule blocking a specific string was only ever a stopgap for organizations that could not patch immediately, and this campaign is the exact scenario that stopgap was never going to survive. Disabling external access to the Environment Management Hub entirely is a reasonable interim step, but the patch is what actually closes CVE-2026-35273.