ShinyHunters Bypasses WAF Defenses in Ongoing Oracle PeopleSoft Attacks
The ShinyHunters extortion gang is actively exploiting a URL-encoding trick to bypass web application firewall rules that were meant to block attacks against the Oracle PeopleSoft flaw tracked as CVE-2026-35273. Google's Mandiant and Threat Intelligence Group reports that the technique allows the threat actors to resume attacks on servers whose operators relied on WAF rules instead of applying security updates.
ShinyHunters, tracked by Google as UNC6240, first began exploiting the vulnerability as a zero-day in June, stealing data from roughly 100 organizations, particularly in the education sector. Oracle patched the flaw, which enables unauthenticated remote code execution, the following day. At the time, Mandiant advised organizations that could not patch immediately to block external access to the vulnerable /PSEMHUB/* endpoint using a WAF.
The new bypass works because many WAFs and reverse proxies compare the literal request path before decoding it. By requesting /%50SEMHUB/ — where %50 is the percent-encoded form of the letter 'P' — attackers slip past rules matching the literal path, while Oracle WebLogic decodes the request and routes it to the vulnerable endpoint. Mandiant warns attackers may switch to other encoded variations and urges organizations to install the latest security updates and disable the Environment Management Hub rather than relying on firewalls.