ShinyHunters evades WAF defenses to resume Oracle PeopleSoft exploitation
ShinyHunters is evading web application firewall protections for Oracle PeopleSoft CVE-2026-35273 by percent-encoding part of the vulnerable endpoint path. Mandiant and Google say WAFs that inspect literal paths may miss requests such as /%50SEMHUB/, while Oracle WebLogic decodes and routes them. The gang can again exploit unpatched servers, and Mandiant recommends patching rather than relying solely on WAF rules.
ShinyHunters, tracked as UNC6240, resumed attacks on Oracle PeopleSoft after WAF rules blocked the literal /PSEMHUB/ path. Encoding the first letter as %50 lets requests such as /%50SEMHUB/ slip past filters that examine paths before decoding, while Oracle WebLogic interprets the encoded character and sends the request onward to the exposed endpoint.
Mandiant and Google report renewed intrusions against unpatched systems across education, technology, healthcare, agriculture, transportation, and government. Attackers first probe using POST traffic that carries serialized Java objects, then deploy JSP web shells including x.jsp, u.jsp, and u2.jsp, and on Windows use Ple64.exe. Patching is advised over WAF-only mitigation.
The renewed exploitation could affect universities, hospitals, government agencies, and technology providers that rely on Oracle PeopleSoft. If intrusions succeed, stolen records may expose students, patients, employees, or citizens to identity theft and privacy loss. Organizations that treated WAF rules as sufficient mitigation may face costly incident response, service disruption, and regulatory scrutiny. The episode may also push security teams to prioritize vendor patches and log-based detection over perimeter controls alone.