A zero-day, or a flaw on the list since June

ShinyHunters has given the FBI a week. The extortion group says it holds "very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job", taken through FBIJobs.gov, and it has demanded that the bureau "correct or simply remove" passages about the group in a public advisory it issued in May. "This is not a ransom, coercion, or extortion," the group added, according to the Associated Press. The demand was published in the middle of last week, which puts its deadline in this one.

The FBI's own account is narrower. "The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information," the bureau said. "While the point of breach is still undetermined—whether a third-party or the FBI's enterprise—we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk." The group has handed about 5,000 sample records to reporters, The Record reports. The bureau has not confirmed that any data was taken.

The detail worth holding onto is the route in. ShinyHunters told reporters it used a zero-day: a flaw in Oracle's PeopleSoft human-resources software that nobody else knew about. That is possible. It is also the most flattering account available to both parties, because a zero-day is the one kind of breach for which nobody is at fault for failing to patch.

The PeopleSoft flaw the group is already known to exploit is not a zero-day. Oracle published a Security Alert for CVE-2026-35273 in June: a vulnerability in PeopleSoft PeopleTools, versions 8.61 and 8.62, that is "remotely exploitable without authentication" and "may result in remote code execution". CISA added it to its Known Exploited Vulnerabilities catalogue on 12 June, described it as allowing "an unauthenticated attacker to obtain takeover", and marked its use in ransomware campaigns as known. Cybersecurity Dive reports that ShinyHunters had already exploited it before the FBI incident.

The date on that entry matters. CISA issued Binding Operational Directive 26-04 on 10 June, replacing the regime that had governed the catalogue since 2021, which in practice gave agencies 21 days, with timelines as short as three days. The PeopleSoft entry went into the catalogue two days later with a due date of 15 June. It was among the first flaws federal civilian agencies were required to fix under the new clock. The same clock now runs out on two Citrix flaws on Wednesday.

So the two possibilities are these. If ShinyHunters has a genuinely new PeopleSoft flaw, it is not in the catalogue, no deadline applies to it anywhere, and every PeopleSoft installation in government and on campus is exposed to a group that has shown it will use one against the FBI. If the flaw is CVE-2026-35273, then a system handling FBI applicant files was running a vulnerability that federal agencies were ordered to remove more than three months ago.

That second case is where the FBI's wording starts to matter. "Whether a third-party or the FBI's enterprise" is not an idle distinction under the directive. BOD 26-04 binds federal civilian agencies, and it says in terms that "unless directed by the governing procurement contract, this Directive does not apply to contractors". Agencies are told to review their contracts and to obtain compliance from cloud providers, but a portal run by a vendor is patched on the vendor's schedule unless someone wrote the government's schedule into the contract. Japan's Digital Agency lost 246,000 records this month through a remote-access device whose flaw was neither new nor rated critical. The known flaw in the third party's box is the most ordinary breach there is.

None of that establishes what happened. The FBI has not said which system was entered, which vulnerability was used, or who operates the servers behind the portal, and FBIJobs.gov served this desk a bot challenge rather than a page on Monday. The cost of the answer is what makes it worth waiting for. Cynthia Kaiser, a former FBI cybersecurity official now at Halcyon, told Cybersecurity Dive that "foreign actors could use the information to target FBI employees and their families for intelligence collection". An applicant file carries the history an investigator would otherwise spend months assembling.

The question for this week is not whether the bureau edits its May advisory. It is whether the flaw has a number, and whether that number was on the list.