FBI job portals remain offline after ShinyHunters claims PeopleSoft zero-day breach

September 28, 2026 at 06:56 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

The FBI's online job application portals remain offline after the ShinyHunters cyber extortion group claimed to have breached them using an Oracle PeopleSoft zero-day vulnerability. The group says it stole personnel files of current, former, and aspiring FBI employees from FBI-managed servers on AWS GovCloud. The FBI confirmed last week it is investigating the claims.

Key Facts

The FBI's job applicant portal at apply.fbijobs.gov and special agent applicant portal at fbijobs.gov/special-agents remain offline.
ShinyHunters claims to have stolen personnel files of current, former, and aspiring FBI employees from FBI-managed servers on AWS GovCloud.
The group says it accessed FBIJobs, FBI BEAST, FBI MedLink, and FBI BICS platforms, according to the BBC.
ShinyHunters exploited Oracle PeopleSoft vulnerability CVE-2026-35273, which was initially used as a zero-day in May and June 2026 against academic institutions.
The FBI confirmed last week it is investigating ShinyHunters' claim of compromising personal information of FBI employees.

Portal Outage

The FBI's online portals for job applicants at apply.fbijobs.gov and special agent applicants at fbijobs.gov/special-agents are still unavailable. The outage follows what appears to be successful compromises by the ShinyHunters cyber extortion group. Last week, the FBI confirmed it was investigating ShinyHunters' claim of having compromised personal information of FBI employees.

ShinyHunters Claims

ShinyHunters told The Register they leveraged a currently unspecified and unconfirmed Oracle PeopleSoft zero-day vulnerability to breach the portals. They also claimed to have breached FBI's managed servers on AWS GovCloud and stole personnel files of current, former, and aspiring FBI employees. The group claims to have obtained personal information of tens of thousands of FBI agents and prospective FBI employees, as well as medical information of the former. According to the BBC, the group claims to have gained access to multiple platforms: FBIJobs, FBI BEAST, FBI MedLink, and FBI BICS. ShinyHunters threatened to release the stolen information if the FBI does not retract what they call false allegations.

Vulnerability Exploitation

On Friday, Google Cloud and Mandiant analysts published a technical rundown of how ShinyHunters are once more exploiting Oracle PeopleSoft vulnerability CVE-2026-35273. The group initially exploited the vulnerability as a zero-day in May and June 2026 to target mostly academic institutions. Oracle advised implementing the emergency patch or applying temporary mitigations such as restricting network access to PeopleSoft application and web servers. Mandiant noted that relying solely on Web Application Firewall body-inspection rules is insufficient, as these controls can be bypassed.