[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foG2b3-tAK2m7x0sYZAiICFiSqyEgeUbO6y0asKT95vA":3},{"article":4,"iocs":54,"watch_terms":71,"solutions":72,"lesson":173},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"3aab4e91-4245-49fd-9368-78ed6e820531","ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks","shinyhunters-bypass-waf-rules-to-resume-oracle-peoplesoft-attacks-70c80a","ShinyHunters exploit CVE-2026-35273 in Oracle PeopleSoft using URL encoding to bypass WAF rules, deploy web shells and spread the SIDEEYE backdoor.","The threat actor ShinyHunters (UNC6240) is actively exploiting CVE-2026-35273 in Oracle PeopleSoft, using URL encoding to bypass WAF protections. Attackers deploy web shells and the SIDEEYE backdoor, impacting various sectors including higher education, technology, and government.","ShinyHunters exploit CVE-2026-35273 in Oracle PeopleSoft using URL encoding to bypass WAF rules.","https:\u002F\u002Fhackread.com\u002Fshinyhunters-bypass-waf-rules-oracle-peoplesoft-attacks\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fshinyhunters-bypass-waf-rules-oracle-peoplesoft-attacks.jpg","2026-09-26T13:36:11+00:00","2026-09-26T20:00:19.001323+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":19},"UNC6240",{"name":23,"type":24},"Oracle PeopleSoft","product",{"name":26,"type":27},"Oracle","vendor",{"name":29,"type":30},"WAF","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55,59,62,65,68],{"type":56,"value":57,"context":58},"cve","CVE-2026-35273","Vulnerability in Oracle PeopleSoft exploited by ShinyHunters.",{"type":51,"value":60,"context":61},"SIDEEYE","Backdoor deployed by ShinyHunters.",{"type":51,"value":63,"context":64},"x.jsp","JSP web shell used for command execution.",{"type":51,"value":66,"context":67},"u.jsp","JSP web shell used for file uploads.",{"type":51,"value":69,"context":70},"Ple64.exe","Trojanized Light Alloy installer delivering SIDEEYE backdoor.",[26,23],{"controls":73,"vendors":161},[74,103,132],{"slug":75,"name":76,"problem":77,"products":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":104,"name":105,"problem":106,"products":107},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":133,"name":134,"problem":135,"products":136},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[137,145,153],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",[162,168],{"slug":163,"name":164,"logo_path":165,"roles":166},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[167],"reported_by",{"slug":169,"name":26,"logo_path":170,"roles":171},"oracle","\u002Fvendor-logos\u002Foracle.png",[172],"affected",{"slug":174,"title":175,"body":176,"framework_refs":177,"framework_notes":190},"shinyhunters-exploit-oracle-peoplesoft-flaw-by-bypassing-waf-defenses","ShinyHunters Exploit Oracle PeopleSoft Flaw by Bypassing WAF Defenses","The ShinyHunters threat actor (UNC6240) is actively exploiting CVE-2026-35273 in Oracle PeopleSoft, leveraging URL encoding techniques to evade WAF rules and gain unauthorized access. Once inside, attackers deploy web shells and the SIDEEYE backdoor, establishing persistent footholds across higher education, government, and technology sectors. This incident highlights a critical over-reliance on WAF solutions as a sole defensive layer — WAFs can be circumvented through encoding tricks, making unpatched vulnerabilities just as exposed as if no WAF existed. It also underscores the urgent need for timely patching of internet-facing enterprise applications, which represent high-value targets for sophisticated threat actors.",[178,179,180,181,182,183,184,185,186,187,188,189],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-4: Information Flow Enforcement","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF ID.RA-1: Asset Vulnerabilities Are Identified and Documented","NIST CSF DE.CM-4: Malicious Code Is Detected","OWASP Top 10 A05:2021 – Security Misconfiguration","ITIL Change Management: Emergency Change Procedures","GDPR Article 32: Security of Processing (for EU-regulated entities)",{}]