ShinyHunters Bypasses WAF in PeopleSoft Attacks

ShinyHunters is using a URL-encoding trick to bypass web application firewall rules protecting Oracle PeopleSoft servers from CVE-2026-35273, a zero-day Oracle patched on June 11. Google's Mandiant says the gang has deployed web shells on dozens of systems worldwide across education, healthcare, technology, and government, resuming data-theft attacks against organizations that believed their WAF rules had mitigated the flaw.