The **ShinyHunters** extortion gang is leveraging a URL-encoding trick to bypass web application firewall (WAF) rules intended to mitigate the **Oracle PeopleSoft CVE-2026-35273** flaw. This sophisticated technique allows the threat actors to resume widespread exploitation of vulnerable servers. **Google's Mandiant** and **Threat Intelligence Group (GTIG)** have reported that this new method has enabled **ShinyHunters** (tracked as **UNC6240**) to once again target **PeopleSoft** servers that had not applied security updates but instead relied on WAFs to block access to the vulnerable `/PSEMHUB` endpoint. ## Background on the PeopleSoft Exploitation On June 10, it was first reported that **ShinyHunters** was targeting **Oracle PeopleSoft** servers using a zero-day vulnerability, leading to data theft from numerous organizations. The very next day, **Oracle** addressed this zero-day, assigning it **CVE-2026-35273** and confirming it allowed unauthenticated remote code execution. At the time, **Mandiant** advised organizations unable to immediately install security updates or disable the **Environment Management Hub** to block external access to the vulnerable `/PSEMHUB/*` endpoint via WAFs or other network controls. ## The WAF Bypass Technique In a new report, **Google** reveals that **ShinyHunters** has modified its exploit to bypass WAF rules that look for the literal path, rather than encoded versions of it. For instance, instead of sending requests to `/PSEMHUB/`, the attackers are now requesting `/%50SEMHUB/`.  *Source: Mandiant* The `%50` sequence is the percent-encoded version of the letter 'P'. **Mandiant** explains that many WAFs and reverse proxies compare the literal request path *before* decoding it. This causes rules designed to block `/PSEMHUB/` to miss the encoded variant. Conversely, **Oracle WebLogic** (which underpins **PeopleSoft**) decodes the encoded 'P' and correctly routes the request to the vulnerable endpoint, effectively bypassing the WAF rule. "This allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure," **Mandiant** states. **Google** warns that **ShinyHunters** may not always use the `'%50'` bypass and could switch to other percent-encoded, mixed-case, or alternative variations of `/PSEMHUB/` to circumvent WAFs. Organizations are strongly urged to install the latest security updates for **CVE-2026-35273** rather than relying solely on WAFs. Additionally, administrators should search **WebLogic** access logs for requests to `/PSEMHUB/` and encoded variants like `/%50SEMHUB/` to detect potential exploitation. ## New Data-Theft Attacks and Malware Deployment This new wave of attacks has resulted in the deployment of web shells on dozens of systems globally, impacting organizations in higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors. Before launching full exploitation, attackers typically send between five and 15 POST requests to `/%50SEMHUB/hub` containing serialized Java objects. On vulnerable systems, these requests return information about the host operating system without writing files or disrupting service, allowing **ShinyHunters** to quietly ascertain if a server is exploitable. Once a system is confirmed vulnerable, the threat actors exploit the flaw again to execute commands directly in memory or deploy JSP web shells. **Google** has observed the deployment of an `'x.jsp'` web shell for command execution and `'u.jsp'` and `'u2.jsp'` shells for uploading larger files. On compromised Windows servers, **ShinyHunters** deployed an executable named `'Ple64.exe'`, which masquerades as a signed **Light Alloy** media player installer but actually installs a backdoor tracked by **Google** as **SIDEEYE**. This malware is used for credential theft, process and file management, creating interactive reverse shells, and reverse proxy functionality. The threat actors also deployed the open-source **Neo-reGeorg** tunneling toolkit via `'tunnel.jsp'` and `'tunnel.jspx'` files. This toolkit enables SOCKS5 proxy traffic to be tunneled over normal HTTP and HTTPS connections, allowing the compromised **PeopleSoft** server to be used for lateral movement into internal networks. For persistent access on Linux systems, **Mandiant** observed **ShinyHunters** using the legitimate **MeshAgent** remote management software. ## Previous Claims and FBI Involvement These renewed attacks follow previous claims by **ShinyHunters** that they breached **FBI** systems using what they described as a new **Oracle PeopleSoft** zero-day. In September, the group alleged they used a remote code execution vulnerability to access the **FBI Jobs** platform and then moved laterally into the **FBI's AWS GovCloud** infrastructure. **ShinyHunters** claimed to have stolen between 2TB and 3TB of data related to current and former **FBI** employees, job applicants, and other internal systems. While the **FBI** confirmed an investigation into unauthorized activity affecting **FBIjobs.gov**, it did not confirm a breach or data theft. **ShinyHunters** has since confirmed that they utilized this WAF bypass against **FBI Jobs** but continues to claim exploitation of an "NEW unknown vulnerability in the same **PSEMHUB** component."