Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

Attackers linked to ShinyHunters (UNC6240) are exploiting CVE-2026-35273 in Oracle PeopleSoft by URL-encoding malicious characters to evade Web Application Firewall detection — a classic bypass technique that highlights the danger of treating WAFs as a primary defense rather than one layer in a defense-in-depth strategy. Once inside, threat actors deploy persistent web shells and backdoors like SIDEEYE, giving them long-term footholds in victim environments across education, healthcare, and technology sectors. The root cause is a failure to apply critical patches promptly on internet-facing enterprise systems, compounded by over-reliance on WAFs as a compensating control. This matters because unpatched ERP platforms like PeopleSoft often hold sensitive HR, financial, and student data, making them high-value targets with catastrophic breach potential.