ShinyHunters Bypasses Oracle PeopleSoft Patch Workaround

ShinyHunters is exploiting CVE-2026-35273 in Oracle PeopleSoft, targeting organizations that applied workarounds but not the June 10 patch. Mandiant says the group deployed web shells on dozens of systems globally across higher education, technology, healthcare, government and agriculture. The bypass uses a URL-encoded request path to evade firewall rules. Dutch police arrested a suspected member in Amsterdam on Monday.