Google Issues Global Warning Over Mass Exploitation of Critical Oracle PeopleSoft Vulnerability

The level of access obtained by the group is particularly alarming. Google’s analysis indicates that approximately one-quarter of the commands executed by the threat actor were run with the highest possible privileges, such as "root" on Linux or "NT AuthoritySYSTEM" on Windows. This grants the attackers total control over the operating system. The remaining commands were typically executed under the service accounts for PeopleSoft or WebLogic, which still provide significant latitude for data theft and internal movement.

The scope of the targeting has also expanded significantly since the June 2026 zero-day attacks. While higher education remains a primary target, the latest activity has been observed hitting the technology sector, IT services, healthcare, agriculture, transportation, and various government agencies. In dozens of confirmed cases, the attackers have successfully deployed web shells, which serve as permanent backdoors for future access.

The ShinyHunters Connection and the FBI Breach

The resurgence of PeopleSoft exploitation coincides with a high-profile confrontation between the ShinyHunters group and U.S. federal law enforcement. Recently, the group claimed responsibility for a massive breach of the Federal Bureau of Investigation’s FBIJobs.gov portal. As of late September 2026, the portal remains inaccessible to the public.

ShinyHunters claims to have exfiltrated between two and three terabytes of sensitive data from the FBI’s systems. However, in a surprising turn, a spokesperson for the group stated that the attack was not motivated by financial gain. Instead, the group claims the breach was a direct response to a May 2026 alert issued by the FBI, which they believe unfairly tarnished their reputation.

"We want to reiterate and emphasize that we are NOT extorting the FBI," a ShinyHunters spokesperson told The Hacker News. "This is NOT financially motivated. This is NOT a ransom or extortion. All we seek to do is set the record straight and protect the image of our organization."

Interestingly, the group asserts that the FBI portal was breached using a different zero-day vulnerability within Oracle PeopleSoft, distinct from the CVE-2026-35273 flaw currently being mass-exploited. This suggests that the group may possess a sophisticated research capability, allowing them to maintain a stockpile of undisclosed vulnerabilities in widely used enterprise software.

The group also provided insight into their history, confirming that they originally operated under the name GnosticPlayers before rebranding to ShinyHunters in 2020. This lineage connects them to some of the most significant data breaches of the last decade, reinforcing their status as a tier-one threat to global enterprises.