ShinyHunters Beats The Firewall Twice

The story this morning was that ShinyHunters got back into Oracle PeopleSoft. The story tonight is how, and it turns out the how is the more embarrassing part. Kai Tanner's desk has the mechanism: CVE-2026-35273 was patched, then wrapped in web application firewall rules written to catch the exploit string that was going around. Google's Threat Intelligence Group says ShinyHunters simply encoded the same malicious URL a different way, and the WAF let it through unchanged, because the rule was written against a string, not against the request the application would still execute identically either way. That is not a new vulnerability. That is a lock that only recognizes one specific key shape, picked with a different-shaped key.

What makes this worth twelve hours of anchor time rather than a one-line update is what it says about how enterprise security actually gets patched under pressure. A WAF rule is supposed to be a stopgap while the real fix rolls out, not a substitute for it. Any bank running PeopleSoft HR or financials on an internet-facing endpoint that treated the firewall rule as the fix, rather than a bridge to it, is exposed right now, regardless of whether they applied Oracle's patch. ShinyHunters has run this exact playbook all year against Oracle E-Business Suite and now PeopleSoft: hit the widely deployed enterprise app before patch parity, then out-encode whatever gets bolted on afterward. Google is calling the campaign multi-sector and global, which puts the responsibility back where it belongs, on Oracle's actual advisory and on whoever is running the exposed server, not on the firewall vendor whose signature got walked around.

Elsewhere, Rachel Lam's desk has the Insurance Authority's HK$19.5 million fine against FWD Life, and the number that matters there is not the fine, it's the four separate anti-money laundering control failures the enforcement order lists, which reads less like one bad afternoon and more like a framework that failed in pieces. In Washington, Mei Chen reports that Xi Jinping asked Trump directly to state opposition to Taiwan independence and got three days of talks on trade and AI instead, a silence that Taiwan's Ministry of National Defense and the Philippine Coast Guard are already answering for him in the strait and at Second Thomas Shoal. And in Hong Kong, Cheung Kwok-keung's desk catches the government delaying its AI copyright law in favor of 'guidelines' the same week the Financial Secretary pitches Hong Kong as the world's AI governance referee.

The through-line across the security stories tonight, from PeopleSoft to FWD, is the same one: a control that exists on paper gets treated as a control that exists in practice, and nobody tests the gap until someone else does it for them. Oracle wrote a patch. Someone wrapped it in a firewall rule instead of verifying the patch was deployed. The Insurance Authority found four gaps in one insurer's screening process, not one. In both cases the failure wasn't a lack of a rule, it was mistaking the rule for the fix.