ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

The ShinyHunters extortion group is actively exploiting Oracle PeopleSoft systems using a URL-encoding technique to bypass web application firewall (WAF) protections. The bypass circumvents mitigations for CVE-2026-35273, allowing attackers to resume widespread exploitation of vulnerable servers. This technique enables the threat actors to evade defensive controls that organizations may have deployed as a temporary fix while awaiting patching. The campaign highlights the risk of relying solely on WAF rules as a compensating control for known vulnerabilities. Organizations running Oracle PeopleSoft are urged to apply official patches immediately rather than depending on WAF-based mitigations. ShinyHunters is a well-known financially motivated threat actor with a history of large-scale data theft and extortion operations.