A vulnerability in a popular line of products from Oracle is being used in a new campaign by the prolific ShinyHunters hacking group, which recently claimed credit for an attack on the FBI’s jobs site.

The Google-owned security firm Mandiant published a blog on Friday about CVE-2026-35273 — a vulnerability disclosed in June that impacts Oracle’s PeopleSoft. PeopleSoft is used widely across government, education and healthcare for a variety of business tasks like managing invoices, projects and staffing. 

Mandiant reported in June that ShinyHunters was exploiting the bug as a zero-day between May 27 and June 9 in attacks on academic institutions. Oracle eventually released a patch on June 10 and Mandiant provided guidance on how organizations could either install the patch or institute workarounds. 

In its blog on Friday, Mandiant warned that ShinyHunters had restarted its exploitation of the bug and “adapted to published defensive guidance, targeting organizations that implemented [workarounds] but did not patch the vulnerability.”

“Our analysis indicates that the threat actor expanded their targeting in this recent campaign, deploying web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government,” Mandiant said. 

Last week, ShinyHunters took credit for an attack on the FBI that saw the group deface a jobs website run by the agency and allegedly steal troves of sensitive data on FBI operations and agents.