ShinyHunters calls its FBI ultimatum a marketing campaign
ShinyHunters says it will never publish or sell the 2TB to 3TB of FBI data it claims to hold and calls its one-week ultimatum a marketing campaign. The pledge leaves standing its unverified claim that an Oracle PeopleSoft zero-day got it in.
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap+45
- Incentives70
- Confidence40
One URL-encoded letter gets ShinyHunters past PeopleSoft WAF rules on unpatched servers
ShinyHunters is again exploiting Oracle PeopleSoft flaw CVE-2026-35273, getting past WAF rules by URL-encoding one letter of the path, Mandiant reported. The servers now in reach are the ones whose operators filtered the endpoint and never applied Oracle's patch.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives70
- Confidence55
The FBI says it is investigating unauthorized activity affecting FBIjobs.gov. 404 Media reports the intruders came in through an Oracle PeopleSoft applicant server and then reached a government cloud holding agent data.
Perspective Coverage
4 publishers
- Builder
- Builder 19%
- Operator
- Operator 69%
- Investor
- Investor 12%
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+35
- Incentives75
- Confidence60
The extortion crew defaced apply.fbijobs.gov on September 22 and told reporters it got remote code execution from a new Oracle PeopleSoft flaw, the same one it says it is now using against Fortune 500 targets. No technical details are public.
Perspective Coverage
14 publishers
- Builder
- Builder 20%
- Operator
- Operator 67%
- Investor
- Investor 13%
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+40
- Incentives75
- Confidence60
The bureau has not confirmed a breach and says it cannot yet tell whether its own systems or a third-party provider were the way in, while Reuters and 404 Media report that sample records match real personnel.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 63%
- Investor
- Investor 15%
Reality
- Evidence55
- Adoption45
- Hype gap+30
- Incentives80
- Confidence60
buildOne report1 publisher Every cross-account role in an AWS landing zone stops at the aws-eusc partition line
AWS's landing zone guidance for the European Sovereign Cloud starts at the partition boundary. Credentials in aws-eusc cannot reach resources in aws, so the centralisation an operator already runs gets built a second time inside the new partition.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives78
- Confidence66