One character in the path was encoded, and the WAF rule stopped matching

Mandiant says the campaign has restarted

Google Cloud Threat Intelligence, through its Mandiant team, published "ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft" on September 26, 2026. The research says the actor it tracks as UNC6240, publicly known as ShinyHunters, is still exploiting CVE-2026-35273 in the Environment Management Hub component of Oracle PeopleSoft, known as PSEMHUB. Mandiant reports finding JSP web shells on dozens of systems worldwide, spanning higher education, technology, IT services, healthcare, agriculture, transportation and government. The research dates the initial zero-day exploitation to May 27 through June 9, 2026, with Oracle's patch released on June 10, 2026.

BleepingComputer covered the research the same day, September 26, 2026, in a report by Lawrence Abrams filed at 03:03 PM. The two publications do not diverge on the core findings. Both report that the group also used the legitimate MeshAgent remote management software to keep access to compromised Linux systems.

The same request, read two different ways

What makes this campaign notable is not the flaw but the way the defence around it is sidestepped. The attacker percent-encodes one character of the path and slips past path-based blocking, requesting /%50SEMHUB/ rather than /PSEMHUB/, where %50 is the encoded letter P. According to Mandiant, many WAFs and reverse proxies match the literal request path before URL decoding happens. The application server decodes that same path afterwards and routes the request to the vulnerable servlet. The filter finds no match, and the application runs the request anyway.

The payloads are named individually in the research. x.jsp provides cross-platform command execution, u.jsp and u2.jsp handle chunked file upload and execution, and tunnel.jsp together with tunnel.jspx is used for Neo-reGeorg tunnelling. On Windows, a trojanised installer called Ple64.exe deploys the SIDEEYE backdoor, written in C++.

A filter is not a patch

The first item in Mandiant's remediation guide ends on a single line: "WAF rules and path-based blocking are not a substitute for patching". That is not an abstract principle but a finding that falls straight out of how the campaign works. If a blocking rule keys on the way a path is spelled, changing the spelling voids the rule. As long as the underlying flaw stays open, the filter in front of it holds only until the attacker finds another way to spell the path.

The recommended actions follow the same order of priority. Apply Oracle's Security Alert patch for CVE-2026-35273 first, and where possible disable the EMHub service or remove the PSEMHUB application altogether. Then search PIA WebLogic access logs for both /PSEMHUB/ and its percent-encoded variants, inspect the PSEMHUB.war directory for unauthorised files, rotate any credentials the PeopleSoft service account can read, and monitor outbound traffic against the published indicators. Patch first, hunt second: the same ordering is why we track individual patch releases such as the WordPress 7.1.1 security release separately.

The sources say nothing about Türkiye, so this section is commentary

Neither source contains a single statement about Türkiye. There is no country breakdown of the affected systems, no Turkish organisation running PeopleSoft is named, and no Turkish regulator is quoted. The research lists industry sectors but gives no geographic split, so whether Türkiye sits inside that set of dozens of systems worldwide simply cannot be read out of the sources. What follows is therefore not a fact drawn from the reporting but explicitly UNALSOFT commentary.

What the research does say deserves to be carried over in full first: Mandiant notes UNC6240's established pattern of stealing data and demanding a ransom under threat of leaking it, and advises affected organisations to prepare for extortion contact. The unknowns can then be listed one by one. The sources do not give: the country and organisation breakdown of affected systems, the exact number behind the word dozens, whether any organisation in Türkiye was hit, which versions Oracle's patch covers and how widely it has been applied, which WAF or reverse proxy products miss this encoding, which organisations had data taken in this wave, or what notification duties local rules such as KVKK would create in an incident of this kind. Putting a Turkish number or percentage on any of that before those gaps close would be invention. The one thing worth saying as commentary is narrower: an organisation running PeopleSoft gets a faster answer from its own access logs than from waiting for a global breakdown.

Sources

Google Cloud Threat Intelligence (Mandiant), ShinyHunters PeopleSoft campaign · BleepingComputer, ShinyHunters uses a WAF bypass in PeopleSoft attacks