[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu38pzvADkyGe_Zc02DowRTJ3FTA6g5jdppZVLegIEPs":3},{"article":4,"iocs":55,"watch_terms":71,"solutions":72,"lesson":172},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"a5af380b-e300-4008-b4c9-5d7a68a6ffd1","ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks","shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks-77ddfb","The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. [...]","The ShinyHunters extortion gang is actively exploiting Oracle PeopleSoft CVE-2026-35273 by using a URL-encoding trick to bypass Web Application Firewall (WAF) rules. This technique allows them to target unpatched servers that were previously protected by WAFs blocking the vulnerable PSEMHUB endpoint. The attackers deploy web shells and executables to gain further access and steal data from compromised organizations.","ShinyHunters gang bypasses WAFs to exploit Oracle PeopleSoft CVE-2026-35273.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fshinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F03\u002F21\u002FOracle.jpg","2026-09-26T19:03:34+00:00","2026-09-26T20:00:17.615202+00:00",9,[17,20,22,25,28,30],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":19},"UNC6240",{"name":23,"type":24},"Oracle PeopleSoft","product",{"name":26,"type":27},"Oracle","vendor",{"name":29,"type":24},"WebLogic",{"name":31,"type":27},"Google","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,60,63,66,68],{"type":57,"value":58,"context":59},"cve","CVE-2026-35273","Oracle PeopleSoft vulnerability exploited by ShinyHunters.",{"type":52,"value":61,"context":62},"x.jsp","Web shell deployed by ShinyHunters for command execution.",{"type":52,"value":64,"context":65},"u.jsp","Web shell deployed by ShinyHunters for file uploads.",{"type":52,"value":67,"context":65},"u2.jsp",{"type":52,"value":69,"context":70},"Ple64.exe","Executable deployed by ShinyHunters on Windows servers.",[26,31,23],{"controls":73,"vendors":161},[74,103,132],{"slug":75,"name":76,"problem":77,"products":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":104,"name":105,"problem":106,"products":107},"patch-management","Automated patch management","Known holes get closed in days, not months.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":133,"name":134,"problem":135,"products":136},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[137,145,153],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",[162,167],{"slug":163,"name":31,"logo_path":164,"roles":165},"google","\u002Fvendor-logos\u002Fgoogle.png",[166],"reported_by",{"slug":168,"name":26,"logo_path":169,"roles":170},"oracle","\u002Fvendor-logos\u002Foracle.png",[171],"affected",{"slug":173,"title":174,"body":175,"framework_refs":176,"framework_notes":187},"waf-bypass-exposes-unpatched-peoplesoft-servers-to-shinyhunters","WAF Bypass Exposes Unpatched PeopleSoft Servers to ShinyHunters","ShinyHunters exploited CVE-2026-35273 in Oracle PeopleSoft by using URL-encoding tricks to bypass WAF protections, reaching vulnerable endpoints that security teams believed were already shielded. This attack illustrates a critical and common misconception: WAFs are a compensating control, not a substitute for patching. Organizations that delayed applying the patch while relying solely on WAF rules created a false sense of security. Once the WAF was bypassed, attackers deployed web shells and exfiltrated data with minimal friction, demonstrating how a single unmitigated vulnerability can lead to full compromise.",[177,178,179,180,181,182,183,184,185,186],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST SI-7: Software, Firmware, and Information Integrity","OWASP Top 10: A05 Security Misconfiguration","ITIL: Change and Release Management (patching workflows)","GDPR Article 32: Security of Processing (obligation to implement appropriate technical measures)",{}]