r/StopBadBots

TL;DR: FBI just got an Accenture contractor fired after a ShinyHunters breach leaked thousands of FBI employees' personal data. The guy allegedly skipped a security patch he was explicitly told to install. Platform was Oracle PeopleSoft. Two ShinyHunters members already arrested, more coming.

So get this. The FBI basically got an Accenture contractor fired — dude allegedly ignored a security patch he was explicitly told to install, and boom, ShinyHunters walked right in and grabbed personal data on thousands of FBI employees.

Reuters broke it. Two sources familiar with the matter.

Brett Leatherman, assistant director of the FBI's cyber division, didn't mince words:

"The incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform. As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce."

Translation: patch was sitting there. Nobody installed it. Game over.

The third-party org? Reuters says it's Oracle PeopleSoft. ShinyHunters literally bragged they exploited it to breach the FBI's job portal last month.

And here's the wild part — Mandiant (Google's crew) says ShinyHunters pulled off a CVE-2026-35273 bypass using a URL-encoding trick to slip past a WAF rule that was supposed to block the vulnerable PSEMHUB endpoint. Sneaky as hell.

FBI and Oracle haven't commented yet. Accenture? Their statement was peak corporate:

"Proud to support the mission of the FBI and will continue to do so."

Cool story, bro. Didn't answer a single question about the contractor or the missed patch though.

Meanwhile ShinyHunters is having a rough month — two members already arrested, FBI says more arrests are coming. They're "actively working with partners to obtain and execute more leads."

Bottom line: one skipped patch. Thousands of employees exposed. One contractor gone. And the FBI isn't done hunting.

TL;DR: High-level IT guy tries to shake down his own company for $750k in Bitcoin, gets busted by the FBI. Now he's doing 32 months.

​Imagine making great money, having total access to the keys to the kingdom, and deciding to blow it all up for a quick payday. That's exactly what Daniel R., a senior infrastructure engineer, pulled off. Except his "mastermind" ransomware plot ended in the worst way possible.

​Daniel thought he was playing 3D chess. He tried to extort his own employer for 20 Bitcoins by locking down thousands of devices, deleting admin accounts, and threatening to wipe 40 servers a day until they paid up.

​It sounded terrifying on paper. But in reality? The execution was embarrassingly sloppy. Here's how he completely blew his cover and handed the FBI an easy conviction:

​The "Hidden Virtual Machine" Illusion Daniel set up a hidden VM to fire off the attacks, convinced it'd make him invisible. He forgot the most basic rule of corporate networks: traffic leaves a footprint. Forensic investigators traced the network activity straight back to his physical machine anyway.

​The Google Search Trail Before pulling the trigger, Daniel used his work laptop to search stuff like "command line to change local administrator password" and "how to remotely shutdown a computer using cmd." If you're a high-level engineer resorting to basic Google searches on company hardware to pull off a heist, you've already lost.

​Physical Security Caught Him Red-Handed While he was running these malicious scripts from his hidden setup, badge logs and security cameras showed him sitting right at his desk in the office. You can't fake an alibi when your badge swipes match the exact minute the malicious commands were executed.

​Pure Tech Arrogance When you hold privileged access, it's easy to get cocky and think you're smarter than the security team. But having access isn't the same as being invisible. Immutable logs, network auditing, and forensic analysis operate way deeper than standard OS permissions.

​Bottom line: insider threats are real, but arrogance usually gets the better of these guys. Daniel traded a comfortable career for 32 months behind bars.

​Was this pure greed, or just an unbelievable lapse in judgment? Drop your thoughts below.

TL;DR: LibreOffice and OpenOffice have a dirty bug where just opening a bad spreadsheet auto-runs hacker code via Java without any macro warnings. Libre already patched it, but OpenOffice is still totally exposed. Disable Java in OpenOffice ASAP or you're cooked.

Security researchers just exposed an insane flaw in LibreOffice and Apache OpenOffice. Basically, a malicious spreadsheet can straight-up run hacker code on your machine the exact second you open it. No macro popup, no "Enable Editing" warning, no nothing.

Here's the wild part: it's not even a complex exploit, it just chains normal Java features against you. The spreadsheet pulls a remote database file, which tricks the app into downloading a fake Java driver JAR from an attacker's server and running it locally.

If you're on LibreOffice, just update immediately to 26.2.5 / 26.8.0 or higher since they already patched it. But if you're rocking OpenOffice? You're sitting duck status right now because their fix isn't out yet. Go to your settings and turn Java off right this second unless you want random spreadsheets popping remote shells on your rig!

​Join us at r/stopbadbots and help protect the people who build the internet.

​

WordPress 7.1.3 addresses seven security vulnerabilities. Updating your site ensures all seven of these reported vulnerabilities are fully patched.

idk how you guys do it but every single time a new minor patch drops my heart just jumps straight into my throat. like I know security updates are crucial and I know I gotta keep my sites safe, but hitting that update button is pure anxiety.

every. single. time.

I just stand there staring at the screen praying nothing breaks, no plugins explode, and no client comes screaming at me in my DMs five minutes later.

​

TL;DR: OpenAI’s rogue agents spammed Wikipedia with MILLIONS of API requests and crashed their servers back in May. Non-profit infra gets wrecked while AI corps profit. Are these bots outta control?!

Bro, I cannot make this up. Wikimedia just confirmed OpenAI’s rogue agents went totally unhinged, spamming MILLIONS of requests and crawling Wikidata like crazy.

They ran so many heavy queries back-to-back that they literally triggered a traffic storm and crashed Wikipedia for actual humans back in May.

Wikipedia is a non-profit keeping knowledge free, while multi-billion dollar AI corps unleash wild bots that burn their bandwidth and wreck their servers. Wikimedia's CTO basically said: "If you're profiting off these agents, pay for the damn damage."

Are these AI companies out of control, or what?!