Breach404
Back to Insights
Secure Software2 min readSeptember 26, 2026

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

The ShinyHunters extortion gang has discovered a URL-encoding technique that allows them to bypass web application firewall protections designed to block exploitation of the Oracle PeopleSoft CVE-2026-35273 vulnerability. Organizations running Oracle Peop

Could your website be vulnerable to attacks like this?

Run a free 10-point security scan on your site - headers, SSL, DNS, and more. Results in 15 seconds.

Test Your Site Now - It's Free