FBI Removes Contractor Over an Unapplied PeopleSoft Patch

The FBI has removed a contractor whose failure to apply an Oracle PeopleSoft security patch opened the bureau's job applicant portal to the extortion group ShinyHunters. Brett Leatherman, assistant director of the FBI's cyber division, said the bureau's review found the incident followed a security failure at a platform managed by an outside organisation, after "a contractor failed to implement a security patch explicitly issued to secure the platform".

Reuters reported on 5 October 2026, citing two people familiar with the matter whom it did not name, that the contractor worked for Accenture and that the platform was Oracle's PeopleSoft. The FBI identified neither. Accenture told Reuters it was "proud to support the mission of the FBI and will continue to do so" and did not answer questions about the contractor. Oracle did not immediately reply to the agency.

A single encoded letter

The technical detail matters to anyone running the same software. Mandiant, the Google-owned incident response firm, has documented ShinyHunters defeating web application firewall rules written to block the vulnerable PeopleSoft Environment Management Hub endpoint. The rules looked for requests to /PSEMHUB/. The group sent requests to /%50SEMHUB/, substituting the percent-encoded value for the letter P. A firewall matching on the literal path saw something else and passed the request along; PeopleSoft then decoded it and handed it to the vulnerable application. Mandiant found web shells on dozens of PeopleSoft servers worldwide, including ones whose operators had deployed the firewall rules without installing Oracle's update.

Mandiant has not publicly linked its own observations to the FBI breach, and that distinction matters. The connection between the technique and this intrusion rests on reporting and the attacker's account, not on published forensics.

Four months of warnings

CVE-2026-35273 is a pre-authentication remote code execution flaw in PeopleSoft's Environment Management component, rated 9.8 out of 10. Mandiant and Google's Threat Intelligence Group published research on 9 June 2026 showing that ShinyHunters had been exploiting it as a zero-day since 27 May against more than 100 organisations, most of them universities. Oracle issued an out-of-band security alert the following day, and both companies told customers to apply every available patch without delay. Later waves reached technology, healthcare, transport and government targets.

What the group says against what is established

ShinyHunters has claimed it took between two and three terabytes of data, moved laterally from PeopleSoft into FBI-managed AWS GovCloud systems, and affected about 38,000 people. None of that is independently confirmed, and Reuters has said the full scale of the breach has not been established. What Reuters did report, from a sample the group circulated, is that the material included granular descriptions of named employees' counterintelligence assignments, street addresses of human intelligence operatives, and medical and psychiatric records of bureau staff. The group said it acted in retaliation for an FBI advisory describing its extortion tactics, then said last week it would not publish the data.

It has also claimed a second, undocumented pre-authentication flaw in PeopleSoft, separate from CVE-2026-35273. No CVE has been assigned to it, it does not appear in CISA's Known Exploited Vulnerabilities catalogue, and Oracle has not commented. That claim rests on the attacker's word alone.

Jordanian authorities have detained a suspected member, Saif al-Din Khader, known online as Rey, Reuters reported on 3 October, again citing two unnamed sources. They said he is helping the FBI identify others.

Why the firewall rule made it worse

The honest reading is that the web application firewall did not simply fail here. It stood in for the fix. An organisation that writes a rule against a known bad path and treats the job as finished has built a second parser that disagrees with the application behind it, and that disagreement is not a security control. Oracle's patch was available from 10 June. The mitigation deployed in its place was beaten by one character.

The pattern is not confined to PeopleSoft. The Cisco Catalyst SD-WAN Manager bypass that CISA put on a three-day clock, which Parallax Nexus reported on 1 October, also turned on improper handling of URL encoding.