The extortion group ShinyHunters developed a method to bypass web application firewall (WAF) rules attempting to prevent exploitation of a remote code execution vulnerability in Oracle PeopleSoft servers, enabling attacks to resume against systems that had not yet installed the security update.
Google Mandiant and the Google Threat Intelligence Group said the attackers are targeting the /PSEMHUB/ endpoint using an encoded representation of its first character. Instead of sending the request to the usual path, the attackers use a path such as /%50SEMHUB/, where %50 represents the Latin letter P in percent encoding.
How Did the Bypass Work?
Mandiant believes that many reverse firewalls and traffic proxies compare the literal path before decoding it, so the encoded form may pass through rules that block /PSEMHUB/. Oracle WebLogic, by contrast, decodes the encoding and routes the request to the vulnerable endpoint, making the server accessible despite operators believing that the WAF rule had addressed the exposure.
Google warned that ShinyHunters may use other forms, such as different encodings or a mixture of uppercase and lowercase letters, rather than always relying on %50.
What Happens on the Targeted Servers?
Before executing the exploit, the group typically sends between five and 15 POST requests to /%50SEMHUB/hub containing serialized Java objects. These requests can return information about the operating system without writing files or disrupting the service, allowing the attackers to quietly determine whether the server is exploitable.
After that, the attackers execute commands in memory or plant JSP web shells. Mandiant observed files such as x.jsp for executing commands and u.jsp and u2.jsp for uploading files. On Windows servers, a file named Ple64.exe was used. It masquerades as an installer for the Light Alloy media player, but installs a backdoor that Google tracks as SIDEEYE.
SIDEEYE enables credential theft, process and file management, the creation of reverse shell sessions, and operation as a reverse proxy. The attackers also used the open-source Neo-reGeorg tool through the files tunnel.jsp and tunnel.jspx to tunnel SOCKS5 traffic over HTTP and HTTPS, potentially turning a compromised PeopleSoft server into a point for moving through the network. On Linux systems, the legitimate MeshAgent was observed being used to maintain access.
Why Does This Matter?
The incident confirms that a WAF rule based on literal path matching is not sufficient protection against a remote code execution vulnerability. Mandiant recommends installing the latest security update for CVE-2026-35273 rather than relying solely on network blocking, while searching WebLogic logs for requests to /PSEMHUB/ and encoded forms such as /%50SEMHUB/.
Oracle had fixed the vulnerability on June 11 after reports said it had been exploited to access the data of 100 organizations, while Google said the new wave affected dozens of systems in the higher education, technology, information technology services, healthcare, agriculture, transportation, and government sectors.
What Remains Unresolved
These attacks follow claims by ShinyHunters that it breached systems belonging to the Federal Bureau of Investigation (FBI) and stole between 2 and 3 terabytes of data. The FBI confirmed that it was investigating unauthorized activity linked to the FBIjobs.gov platform, but did not confirm the breach or data theft. The group also claimed to have used a new, unknown vulnerability in the PSEMHUB component, an allegation that the source did not independently verify.