ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

T1Critical 95Covered by 1 source · first reported by BleepingComputer at 26 Sept, 19:03 UTC

The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. [...]

security

Sources

• T1ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacksBleepingComputer26 Sept, 19:03

Vulnerabilities

• CVE-2026-35273