# ShinyHunters hackers expanded attacks on Oracle's PeopleSoft, Google says

> **Open Intelligence Dossier** · First detected: 2026-09-27 23:20 UTC · Category: Business

## Executive Summary
ShinyHunters expanded attacks on Oracle's PeopleSoft by bypassing WAFs.

## Intelligence Brief
Recent coverage from Reuters, The Hacker News, BleepingComputer, hcamag.com, and tech-insider.org details an escalating cybersecurity incident involving the ShinyHunters hacking group. According to reporting from Reuters, Google states that the hackers have expanded their attacks targeting Oracle's PeopleSoft system. Further details from BleepingComputer and The Hacker News indicate that the threat actors utilized a web application firewall, or WAF, bypass trick to exploit a critical flaw. Specifically, tech-insider.org identifies the vulnerability as a CVSS 9.8 PeopleSoft bug. Coverage from The Hacker News specifies that attackers successfully bypassed WAFs to exploit this vulnerability and subsequently deploy web shells within the compromised environments.


The reporting emphasizes the severe impact on human resources infrastructure, with hcamag.com describing the incident as a major HR system being hacked again as criminals slip past previous summer fixes. Outlets such as BleepingComputer and The Hacker News focus heavily on the technical mechanisms of the breach, highlighting the WAF bypass technique used against the Oracle software. Reuters brings a corporate and threat-intelligence angle by incorporating Google's assessment that the ShinyHunters group has broadened the scope of its operational targets. The collective coverage paints a picture of a persistent threat actor exploiting high-severity flaws despite earlier remediation efforts deployed during the summer months. This unfolding situation follows earlier attempts to secure vulnerable platforms, as noted by hcamag.com regarding fixes applied over the summer that criminals have now managed to slip past.


As the situation develops, coverage does not yet specify the full roster of newly affected organizations or the precise remediation steps recommended following the latest expansion of attacks. Observers and affected entities will need to monitor updates from Google, security researchers, and outlets like Reuters and BleepingComputer for further technical indicators of compromise. Future reporting is expected to clarify whether additional patches or emergency mitigations will be issued to address the persistent WAF bypass methods utilized by ShinyHunters against the PeopleSoft vulnerability.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| tech-insider.org | ShinyHunters Bypass WAF on CVSS 9.8 PeopleSoft Bug [2026] | [Source Link](https://news.google.com/rss/articles/CBMifEFVX3lxTE9ZUWl6MEcwajJhV0lDV0pSbDRlT2FfMEMxT3J3UE1IbnFlXzRCdUxRNzAtYkQwSldMVnp6bHZLTXZRdXNxNlpRcTE4Z25BeGtoa0FpWGdfNGgzX2RBenQyU3hKdWpnWVlWRHd3dHV6R3lPRG5vdUFLV3lXVzc?oc=5) |
| hcamag.com | Major HR system hacked again as criminals slip past summer fixes | [Source Link](https://news.google.com/rss/articles/CBMixAFBVV95cUxOX21Ud05SQ3l1Z0V0UmNTZXd2SkhxbjZTLVdJMlBTVUlSR2xtS19kR2tXbkJMc1FlREh2bHRCeFFFWWJyR2xoYlZpaWxlVXpHU19qNEJSbDFLUHFFdXpTMm5menowTnRRRHlqdE1QWXV6cFhPcUR0cHZUWUphQ24yYV9FZ2ZMdHl6STBiYlN2bEVwTU50SUlTWDd6MGR4dklJWnpaREJHRDFfcVBRdTliUTk5dUFTQzN5bDRvZXR4aFgwc1lV?oc=5) |
| BleepingComputer | ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks | [Source Link](https://news.google.com/rss/articles/CBMisAFBVV95cUxOQmRDU1p5Q3ZIZUtiRUMzRi10ZWI0RjliZUV2aVB0TXF6YVJmdnhZY0w5azkwNTZ1djQzNVlsR3ZudFF2MkVzWHZOdkg2bjZUbVZNMTk0SUdpdXVvODRqa1NzU1hUS2p5bjYyd19qb21XaXE2LXM0a0M2ejV4Ynh3TlRGejR1Uk43TW1sUmpmSjJwZUN6eWM0cEVRMHlMcHczLV9vcDhtRVFvc21oUEpOZtIBtgFBVV95cUxNN2FkRGRYem5TWEZtcHdiOEJVbThpbWFBemVtbVBnSTczZmFZR2ktbEtsWlZQd2FTUk9TamtUa0ZReGZ6UXhCUnFENmVQVUVtcmJTVTJiaUJ0VnVhd3dpdGgtZXZmNEVRQ0pxYUJXSUtOOFMwQVBTMmlGMG9lLXZ5eVZmVmRqZUl3MkZGeVdTaS03dkJ2VE1CaXFlbmt4bHYzblp) |
| The Hacker News | Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells | [Source Link](https://news.google.com/rss/articles/CBMihAFBVV95cUxPbXlHUkc4bmNJY1BnN0RKZjI0WHRzMFBLV1NIb2VHNlI0MktJOTE1ZVNGN3lvT19yWHMzazBPUUg5MUx2S2RIM29VLWxEUW1zUktUeDlvd28tbG1xUWR0WHNkbmtwS0xZWHdkb2E1OXp4SWNQNGphSHhDR0pWRDIxT0ZHZDc?oc=5) |
| Reuters | ShinyHunters hackers expanded attacks on Oracle's PeopleSoft, Google says | [Source Link](https://news.google.com/rss/articles/CBMivgFBVV95cUxQc0kwNk9oLVg5bWdrdkJfUXVSNkFYT2o5ODZpU3RaMjJpM0pKb19QTnM0Zlk4d2xURlJZZVF6blp1ZEk5T1ZnMEM3RmN1STc1RnFTZXpDSGRuWWpBY2NwZGZUVzJET29UY0lLYzFxU0NOQjNTV25lRUpkSzRPQTgtQlVkMVRSLWJ1TkROb0ZqaU9sa0ZtSGJ4ZWNtak9pQTQ3dUtmZXdXdWpFSGZHNlpJdGQ4QU1SNm9mYlhwd2t3?oc=5) |

---
*Canonical Source: https://pulse.byoaiapps.com/trend/2026-09-27/shinyhunters-hackers-expanded-attacks-on-oracle-s-peoplesoft-google-says*