> TritonInfoSec News
Home / Sep 27, 2026 / Story
0
#2 BleepingComputer general September 26, 2026 at 19:03 UTC

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

By Lawrence Abrams

AI Summary

ShinyHunters is bypassing WAF mitigations for Oracle PeopleSoft CVE-2026-35273 using a URL-encoding trick, effectively re-enabling mass exploitation against servers that were considered protected. This is significant for defenders who applied WAF rules as a temporary mitigation rather than patching, as those controls are now rendered ineffective.

Read full article → https://www.bleepingcomputer.com/news/security/shi…

Relevance score: 90.0/100

# More from September 27

  1. 1
    Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells The Hacker News
  2. 3
    SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild The Hacker News
  3. 4
    Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack The Hacker News
  4. 5
    Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise The Hacker News
  5. 6
    Army soldier sentenced for spree of attacks on AT&T, Snowflake and other major companies CyberScoop
  6. 7
    CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks BleepingComputer
  7. 8
    Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials The Hacker News
  8. 9
    Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link The Hacker News
  9. 10
    Roundcube Webmail Vulnerability in Attackers’ Crosshairs SecurityWeek