🚨 ShinyHunters resumes mass exploitation of critical Oracle PeopleSoft flaw using simple WAF bypass. Mandiant and Google Threat Intelligence Group have identified renewed mass exploitation of CVE-2026-35273 by UNC6240, also known as ShinyHunters. ⠀ The critical vulnerability allows unauthenticated remote code execution in Oracle PeopleSoft PeopleTools and carries a CVSS score of 9.8. Oracle released an emergency patch on June 10. ⠀ The new campaign targets organizations that attempted to mitigate the flaw using web application firewall rules but did not install the patch. ShinyHunters bypassed rules blocking the vulnerable /PSEMHUB/ endpoint by encoding a single character and sending requests to /%50SEMHUB/. ⠀ Google says web shells were deployed on dozens of systems worldwide across: • Higher education • Technology • IT services • Healthcare • Agriculture • Transportation • Government ⠀ The actors deployed web shells, the SIDEEYE backdoor, Neo-reGeorg tunneling tools and MeshAgent for persistent remote access. Around one-quarter of the observed commands executed with root or SYSTEM privileges. ⠀ Organizations running PeopleSoft should patch immediately, disable or remove the Environment Management Hub where possible and investigate encoded variants of /PSEMHUB/ in access logs. WAF rules alone are not sufficient.