💥 BREACHES & INCIDENTS
- FBI removes Accenture contractor after unpatched PeopleSoft flaw enabled ShinyHunters breach
The FBI removed an Accenture contractor who failed to apply a security patch, allowing ShinyHunters to breach the FBI's job site via Oracle PeopleSoft and steal personal data of thousands of employees.- Applies to the FBI and organizations running Oracle PeopleSoft, whose job portal was breached last month via the third-party-managed platform.
- Exposed data includes counterintelligence job descriptions of named employees, street addresses of human intelligence operatives, and medical and psychiatric records of bureau workers.
- The breach stemmed from a contractor failing to implement a security patch explicitly issued for the platform; ShinyHunters credited a PeopleSoft vulnerability for the intrusion.
- Mandiant assesses ShinyHunters exploits a bypass for CVE-2026-35273 using URL encoding to evade a WAF rule blocking the Environment Management Hub (PSEMHUB) endpoint.
- Two ShinyHunters members have been arrested, and a key suspect detained in Jordan is reportedly cooperating with the FBI.
📋 ADVISORIES
📄 Source for Atlassian patches CVE-2026-21589 (CVSS 9.3): unauthenticated file read in 8 Data Center products — confluence.atlassian.com
📄 Source for Sitemovr WordPress plugin <= 1.0.1 exposes sensitive data to unauthenticated attackers (CVE-2026-41563) — patchstack.com