ShinyHunters is exploiting CVE-2026-35273, an Oracle PeopleSoft flaw, again. Mandiant's account, relayed through Google, says the gang reached dozens of systems worldwide by URL-encoding the malicious request strings that web application firewalls were configured to block. The original mitigation was a signature match on the attack pattern's plaintext form. Encode the same payload and the pattern no longer matches. The WAF passes it through as if it were routine traffic.

The mechanism exposes what a WAF rule actually is: a bet that attackers submit requests the way the rule author imagined. Oracle's PeopleSoft runs HR and financials for governments and large enterprises, the kind of system a bank keeps behind change control precisely because it touches payroll and vendor payment data. A firewall signature bought time after the first wave of attacks. It did not close CVE-2026-35273. Mandiant's dozens-of-systems count is a floor, not a ceiling, since it reflects only what Google's telemetry can see.

The pattern matches ShinyHunters' method elsewhere this week: the same group defaced Clop's ransomware leak site through an unpatched Grav CMS path traversal flaw, meaning the gang treats other criminal infrastructure as fair target practice for techniques it later runs against enterprises. Oracle has not shipped a patch that closes the encoding bypass as of this filing. The unresolved fact is CVE-2026-35273 itself, still open, with a WAF rule standing in for a fix that has not arrived.