FBI Removes Accenture Contractor After Patch Failure Led to Shiny Hunters Breach
Summary: The FBI removed an Accenture contractor after a security failure at a third-party-managed platform, which the FBI said occurred when the contractor failed to implement an explicitly issued security patch, leading to a ShinyHunters breach that stole personal details of thousands of bureau employees. Reuters reported the platform was Oracle PeopleSoft, which ShinyHunters said it exploited to breach the FBI's job portal, and Mandiant assessed the group bypassed a web application firewall rule for the PSEMHUB endpoint using a URL-encoding trick to exploit CVE-2026-35273.
What you should know: A patch that was explicitly issued and simply not applied exposed the personal details of thousands of FBI employees, and the group behind it, ShinyHunters, has already had two members arrested while the FBI warns more are likely.
Read the original at The Hacker News ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2026-35273
- Related
- Shiny Hunters Renewed Mass Exploitation Campaign Targeting Oracle People Soft Cyber Risks · Sep 25, 2026CVE-2026-35273: Oracle People Soft Enterprise People Tools Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Jun 12, 2026