A notorious cyber extortion gang is once again exploiting a critical vulnerability in Oracle’s PeopleSoft software, thanks to a clever trick that allows them to bypass web application firewalls (WAFs). The ShinyHunters gang has been targeting organizations worldwide, using a zero-day flaw to steal sensitive data and deploy malware on compromised servers. What makes this attack particularly concerning is the ease with which the attackers can evade security measures put in place by affected companies.
The vulnerability in question, CVE-2026-35273, was fixed by Oracle back in June after BleepingComputer first reported on ShinyHunters’ exploitation of it. The flaw allowed unauthenticated remote code execution, giving attackers complete control over vulnerable servers. At the time, Google’s Mandiant advised organizations to either apply security updates or block external access to the Environment Management Hub (PSEMHUB) endpoint. However, it appears that some companies took only half-measures, believing their WAFs had mitigated the exposure.
In reality, many WAFs and reverse proxies compare literal request paths before decoding them, causing rules designed to block “/PSEMHUB/” to miss percent-encoded versions of this path. The ShinyHunters gang has taken advantage of this weakness by modifying its exploit to send requests to “%50SEMHUB/”, where “%50” is the percent-encoded version of the letter “P”. This allows the attackers to reach the vulnerable endpoint on systems whose operators may have thought their WAF rules had protected them.
The result is a new wave of attacks that has seen ShinyHunters deploy web shells on dozens of servers worldwide, targeting higher education, technology, IT services, healthcare, agriculture, transportation, and government organizations. Once inside, the attackers use these shells to execute commands directly in memory or upload larger files. On compromised Windows servers, they have been deploying an executable named “Ple64.exe”, which masquerades as a signed media player installer but installs a backdoor tracked by Google as SIDEEYE.
This malware is used for a range of malicious activities, including stealing credentials, managing processes and files, creating interactive reverse shells, and setting up reverse proxy functionality. To make matters worse, the attackers are also using an open-source tunneling toolkit called Neo-reGeorg to spread laterally into the internal network. This allows them to use compromised PeopleSoft servers as a springboard for further attacks.
What’s clear is that relying solely on WAFs to protect against this type of attack is not enough. Organizations running Oracle PeopleSoft must take immediate action to install the latest security update and block access to the PSEMHUB endpoint. Mandiant recommends searching WebLogic access logs for requests to “/PSEMHUB/” and encoded variants such as “%50SEMHUB%” to detect signs of exploitation.
In practical terms, this means that organizations should not only prioritize applying security updates but also closely monitor their systems for any suspicious activity. This includes checking for unusual network traffic patterns or unauthorized access attempts. By taking a proactive approach to security, companies can reduce the risk of falling victim to these types of attacks and protect sensitive data from being stolen by malicious actors like ShinyHunters.
Source: Bleeping Computer — 2026-09-26