Project
Oracle PeopleSoft is an enterprise software suite for HR and finance, built on PeopleTools and used by large organizations and governments.
The FBI confirmed a contractor's failure to apply a critical Oracle PeopleSoft patch, CVE-2026-35273, led to a breach affecting thousands of employees. Any organisation that outsources PeopleSoft operations is exposed in the same way wherever its operator has not installed the fix.
Reality
FBI dropped Accenture last week for failing to patch the Oracle PeopleSoft platform ShinyHunters breached, Reuters reported. Google separately says attackers hijacked the .as, .gh and .sl registries.
Reality
FBI Director Kash Patel says agents arrested another ShinyHunters suspect, at least the third detained in two weeks since the FBIjobs.gov breach. The group says it is leaving Telegram as members are arrested, and it has promised not to publish the FBI staff data it stole.
Perspective Coverage
14 publishersReality
Unauthorized users stole data on about 3 million service members from the Defense Manpower Data Center and went undetected for nine months until July. A separate FBI breach surfaced weeks apart. Only the Pentagon case has a stated dwell time.
Reality
Alleged ShinyHunters member Saif al-Din Khader, detained in Jordan on Tuesday, is helping the FBI find other members, two sources told Reuters. A new ShinyHunters leak site went up two days later, suggesting other members still run the extortion.
Perspective Coverage
13 publishersReality
FBI said a contractor's failure to apply a security patch on a third-party platform let ShinyHunters steal personal details of thousands of bureau employees. The patch had already been issued, so the breach came down to one missed update on a platform the Bureau did not manage itself.
Perspective Coverage
11 publishersReality
FBI's Brett Leatherman urged ShinyHunters members to surrender after the Dutch arrest of an alleged leader of a group tied to $70 million in extortion. Dutch police have not ruled out more arrests, though the public record so far shows one suspect in custody.
Perspective Coverage
9 publishersReality
FBI told staff in an internal memo to assume hacking group ShinyHunters stole data on every employee after a claimed 2 to 3 terabyte breach of FBIjobs.gov. Until the bureau confirms the scale, staff and the job applicants the hackers say are also in the files have reason to treat their home addresses as exposed.
Reality
ShinyHunters is again mass-exploiting Oracle PeopleSoft flaw CVE-2026-35273, defeating firewall rules by URL-encoding a single character. Anyone who filtered the endpoint instead of applying Oracle's June 10 patch should assume exposure.
Perspective Coverage
8 publishersReality
ShinyHunters says it will never publish or sell the 2TB to 3TB of FBI data it claims to hold and calls its one-week ultimatum a marketing campaign. The pledge leaves standing its unverified claim that an Oracle PeopleSoft zero-day got it in.
Reality
Mandiant says ShinyHunters has planted web shells on dozens of Oracle PeopleSoft systems by URL-encoding one character to get past firewall rules. Employers that treated June's stopgap as the fix now have to patch and also look for any access the attackers left behind.
Reality
ShinyHunters is again exploiting Oracle PeopleSoft flaw CVE-2026-35273, getting past WAF rules by URL-encoding one letter of the path, Mandiant reported. The servers now in reach are the ones whose operators filtered the endpoint and never applied Oracle's patch.
Reality
ShinyHunters says the two to three terabytes it took from the FBI include psychiatric and medical evaluations of bureau staff. Beside a Reuters sample tying named staff to counterintelligence jobs, those files are exposure no password reset can fix.
Reality
ShinyHunters is exploiting an unpatched CVSS 9.8 pre-login flaw in Oracle PeopleSoft, encoding one URL character to slip past WAF rules matching the raw path. Mandiant has confirmed JSP web shells on dozens of systems.
Reality
ShinyHunters claims 623GB from a July social-engineering campaign and leaked part of it. Have I Been Pwned confirmed 1.6 million account records. Both the vendor and the crew can be telling the truth.
Perspective Coverage
3 publishersReality
ShinyHunters is mass-exploiting PeopleSoft systems that added firewall rules after the summer breaches but skipped Oracle's patch, Mandiant said. For operators that wrote a filter and stopped, the remedy in the report is the patch Oracle already shipped.
Reality
The FBI says it is investigating unauthorized activity affecting FBIjobs.gov. 404 Media reports the intruders came in through an Oracle PeopleSoft applicant server and then reached a government cloud holding agent data.
Perspective Coverage
4 publishersReality
The extortion crew defaced apply.fbijobs.gov on September 22 and told reporters it got remote code execution from a new Oracle PeopleSoft flaw, the same one it says it is now using against Fortune 500 targets. No technical details are public.
Perspective Coverage
14 publishersReality
The bureau has not confirmed a breach and says it cannot yet tell whether its own systems or a third-party provider were the way in, while Reuters and 404 Media report that sample records match real personnel.
Perspective Coverage
3 publishersReality
The group told The Register it took more than 2TB of HR records and wants a retraction from the FBI, not a ransom. Everyone else running self-hosted PeopleSoft HCM has an extortion group's word and no Oracle advisory.
Reality