CVE-2026-35273 sits in Oracle PeopleSoft's web tier and was patched, then wrapped in web application firewall rules to catch exploit attempts against it. Google's Threat Intelligence Group says ShinyHunters found that encoding the malicious URL a different way slides past those WAF signatures unchanged, and the group has resumed dropping web shells on internet-facing PeopleSoft instances it had already compromised once. The rule caught the string it was written for. It did not catch the string doing the same thing.

The mechanism matters more than the label. A WAF rule written against one URL-encoding of a payload is a rule against that encoding, not against the underlying request the application will still parse and execute identically. Any bank running PeopleSoft HR or financials modules on an internet-facing endpoint, patched or not, is exposed if it treated the WAF rule as the fix rather than a stopgap around the actual patch. ShinyHunters has spent 2026 running exactly this playbook against Oracle E-Business Suite and now PeopleSoft: find the widely-deployed enterprise app, exploit before patch parity, then out-encode whatever gets bolted on after.

Google names the campaign as targeting "multiple sectors globally" through web shells planted via the same PeopleSoft weakness, which puts the ownership of the fix back on Oracle's patch and on whoever operates the exposed PeopleSoft server, not on the firewall vendor whose rule got walked around. Oracle's original advisory for CVE-2026-35273 is the artifact that matters now. The WAF rule was never it.