Hackers Found a Sneaky Way Around Oracle PeopleSoft's Defenses

Michael Miller · 2026-09-26

### The Trick That Caught Everyone Off Guard Imagine you're trying to sneak a prohibited item past a security guard. Now imagine you write the item's name in a secret code the guard doesn't recognize. That's essentially what the ShinyHunters gang pulled off against Oracle PeopleSoft servers — and it worked. According to recent reports, this extortion crew figured out a URL-encoding trick that lets them slip past web application firewall (WAF) rules. Those rules were supposed to block attacks targeting a critical flaw called CVE-2026-35273. But by encoding their malicious requests in a way the firewall didn't catch, they resumed widespread exploitation. If your organization runs PeopleSoft, this is a wake-up call. ### Why This Bypass Matters More Than You Think Web application firewalls are like the bouncers of the internet. They stand at the door, checking every request that comes in. But they're not perfect. They rely on patterns — signatures of known attacks. Change the pattern just enough, and the bouncer waves you right through. That's exactly what happened here. The URL-encoding trick essentially disguises the attack payload. The WAF sees a harmless-looking string of characters, but the vulnerable application decodes it and executes the malicious command. It's a classic case of "the firewall sees one thing, the server sees another." > "Security controls are only as good as their configuration. When attackers find a gap, they exploit it relentlessly." This isn't just about one gang. Once a bypass technique becomes known, other cybercriminals copy it. The clock is ticking for anyone who hasn't patched yet. ### What You Can Do Right Now If you're responsible for Oracle PeopleSoft in your organization, don't wait. Here's a practical checklist: - **Apply the patch immediately.** Oracle released a fix for CVE-2026-35273. If you haven't installed it, that's priority number one. - **Review your WAF rules.** Make sure they're up to date and can handle encoded variations. Generic signatures won't cut it anymore. - **Monitor for unusual activity.** Look for strange URL patterns in your logs — especially anything with odd percent-encoding. - **Limit exposure.** If PeopleSoft doesn't need to be public-facing, put it behind a VPN or zero-trust gateway. - **Educate your team.** Share this case with your IT and security staff. Awareness is half the battle. ### The Bigger Picture ShinyHunters has been busy. They've targeted multiple organizations, and this latest trick shows they're not slowing down. The lesson? Security is a moving target. You can't just set it and forget it. Think of it like locking your front door. You wouldn't leave the key under the mat just because you installed a deadbolt. You need layers — patching, monitoring, and smart configuration working together. If there's one takeaway from this story, it's that attackers are creative. They'll find the crack in the armor. Your job is to seal it before they do. And if you're using an antidetect browser for legitimate multi-account management, remember that the same principles apply: stay updated, stay vigilant, and never assume you're fully protected. The post ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks appeared first on Help Net Security.