[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftIThzIVpI9RkHaoAPrRAhAKK229U-p5wjXzCJWcVN98":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":56},"fd8d3ab7-42b5-49b9-9b44-36b1bec41b7e","waf-bypass-exposes-unpatched-peoplesoft-servers-to-shinyhunters","a5af380b-e300-4008-b4c9-5d7a68a6ffd1","WAF Bypass Exposes Unpatched PeopleSoft Servers to ShinyHunters","ShinyHunters exploited CVE-2026-35273 in Oracle PeopleSoft by using URL-encoding tricks to bypass WAF protections, reaching vulnerable endpoints that security teams believed were already shielded. This attack illustrates a critical and common misconception: WAFs are a compensating control, not a substitute for patching. Organizations that delayed applying the patch while relying solely on WAF rules created a false sense of security. Once the WAF was bypassed, attackers deployed web shells and exfiltrated data with minimal friction, demonstrating how a single unmitigated vulnerability can lead to full compromise.","**Immediate actions:**\n- Apply Oracle's official patch for CVE-2026-35273 on all PeopleSoft instances immediately, regardless of WAF coverage.\n- Audit all internet-facing PeopleSoft servers for signs of web shell deployment or unauthorized executables.\n- Review and update WAF rule sets to detect URL-encoding and other obfuscation bypass techniques.\n\n**Long-term improvements:**\n- Establish a formal patch management policy with defined SLAs for critical CVEs on internet-facing systems (e.g., patch within 24–72 hours).\n- Never treat WAFs, IDS\u002FIPS, or other perimeter controls as a permanent substitute for vulnerability remediation.\n- Implement network segmentation to isolate PeopleSoft and other ERP systems from the broader corporate network.\n\n**Detection measures:**\n- Deploy file integrity monitoring on PeopleSoft servers to detect unauthorized web shell creation or binary drops.\n- Enable detailed logging of all requests to sensitive endpoints (e.g., PSEMHUB) and alert on anomalous URL encoding patterns.\n- Conduct regular authenticated vulnerability scans and penetration tests against ERP systems to validate patch status and WAF effectiveness.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST SI-7: Software, Firmware, and Information Integrity","OWASP Top 10: A05 Security Misconfiguration","ITIL: Change and Release Management (patching workflows)","GDPR Article 32: Security of Processing (obligation to implement appropriate technical measures)",{},"published","2026-09-26T20:20:22.824001+00:00","2026-09-26T20:20:22.705+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fshinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks\u002F","shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks-77ddfb","ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":44,"name":45,"slug":46,"description":47,"color":48},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[50],{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"13c8d089-3c57-4fc1-a760-c0f278e03864","2026-09-27","morning","ThreatNoir Weekend Brief — September 27","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-27\u002Fthreatnoir-morning-brief-2026-09-27.mp3",[57,60,63],{"slug":34,"name":58,"problem":59},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":46,"name":61,"problem":62},"Automated patch management","Known holes get closed in days, not months.",{"slug":64,"name":65,"problem":66},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them."]