ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

Reported by BleepingComputer (Lawrence Abrams)

Summary by Cyber Security News26 Sep 2026, 21:03 CEST

About this summary. This is a short, independently written summary of an article first published by BleepingComputer. Cyber Security News did not report or verify the underlying story. Read the original: https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks — Image: BleepingComputer

The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers.

Read the full article at BleepingComputer →

Source attribution: headline and facts are from BleepingComputer (bleepingcomputer.com). Summary method: excerpt of the source description. See our source attribution policy.