ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks

Mandiant and Google Threat Intelligence Group observed active exploitation of Oracle PeopleSoft CVE-2026-35273 by UNC6240 (ShinyHunters), where attackers used URL-encoding (/PSEMHUB/ -> /%50SEMHUB/) to bypass WAFs and chain into a vulnerable PeopleSoft servlet; post-exploitation artifacts included JSP web shells (x.jsp, u.jsp), a signed trojanized installer Ple64.exe delivering the SIDEEYE backdoor, Neo-reGeorg tunneling, and MeshAgent, with infections across higher education, technology, healthcare, and other sectors and Oracle releasing an emergency patch on June 10.