ShinyHunters sidestep WAF rules in Oracle PeopleSoft attacks
By encoding part of a vulnerable endpoint, attackers are bypassing basic WAF filters and compromising more Oracle PeopleSoft systems.
Google’s Mandiant and Threat Intelligence Group report that ShinyHunters has adapted attacks on unpatched Oracle PeopleSoft installations affected by CVE-2026-35273, substituting `/%50SEMHUB/` for `/PSEMHUB/` to get around WAF filters keyed to the unencoded route. Although a firewall may inspect the encoded path, Oracle WebLogic converts `%50` to `P` and sends the request to the vulnerable handler; Google says intruders have planted web shells on dozens of systems worldwide in sectors including education, healthcare and government. The operators use JSP shells for command execution and file uploads, and on Windows systems have deployed `Ple64.exe`, a fake Light Alloy installer that installs Google-tracked SIDEEYE malware. Mandiant says organizations should install Oracle’s update rather than depend on WAF blocking, and inspect WebLogic logs for both standard and encoded PSEMHUB requests. In a separate allegation, ShinyHunters said it broke into the FBI Jobs platform in September and took 2TB to 3TB of data, but that account was not independently verified and it remains unknown whether the claimed incident used CVE-2026-35273.
Why it matters
The tweak to ShinyHunters’ exploit shows how easily basic, path‑based WAF rules can be outmaneuvered when underlying flaws remain unpatched. Because WebLogic still routes the encoded path to the same vulnerable handler, attackers have already managed to plant web shells on dozens of systems in sectors such as education, healthcare and government, raising the stakes for organizations that have delayed applying Oracle’s fix and relied mainly on perimeter filtering for protection.
Signal or noise?
Does this story matter, or is it hype? Decide before you see what everyone else thinks.
Sources
- BleepingComputer