ShinyHunters encodes PeopleSoft requests to evade WAF filters
For unpatched organizations, a WAF rule matching the usual route is no substitute for Oracle’s security update.
Google’s Mandiant and Threat Intelligence Group report that ShinyHunters has adapted attacks on unpatched Oracle PeopleSoft installations affected by CVE-2026-35273, substituting `/%50SEMHUB/` for `/PSEMHUB/` to get around WAF filters keyed to the unencoded route. Although a firewall may inspect the encoded path, Oracle WebLogic converts `%50` to `P` and sends the request to the vulnerable handler; Google says intruders have planted web shells on dozens of systems worldwide in sectors including education, healthcare and government. The operators use JSP shells for command execution and file uploads, and on Windows systems have deployed `Ple64.exe`, a fake Light Alloy installer that installs Google-tracked SIDEEYE malware. Mandiant says organizations should install Oracle’s update rather than depend on WAF blocking, and inspect WebLogic logs for both standard and encoded PSEMHUB requests. In a separate allegation, ShinyHunters said it broke into the FBI Jobs platform in September and took 2TB to 3TB of data, but that account was not independently verified and it remains unknown whether the claimed incident used CVE-2026-35273.
Why it matters
The reports show why filtering a visible URL may not be enough: the application server can decode a request before routing it. For organizations running affected systems, the key distinction is whether they have installed Oracle’s update—not simply whether a firewall rule matches the familiar route.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.