[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-shinyhunters-find-new-way-around-oracle-peoplesoft-defenses":10,"sections":34},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":29,"feedback":33,"feedback_at":22,"cost_usd":33,"total_tokens":33},8385,"shinyhunters-find-new-way-around-oracle-peoplesoft-defenses","ShinyHunters Find New Way Around Oracle PeopleSoft Defenses","Hackers exploiting a critical Oracle PeopleSoft flaw found a way past firewall blocks and are now hitting dozens of organizations worldwide.","ShinyHunters found a crack in Oracle's patch job for PeopleSoft - and they're exploiting it globally.\n\nIn June 2026, Oracle patched a critical Java deserialization bug in PeopleSoft's Environment Management Hub, CVE-2026-35273, rated 9.8 out of 10. For organizations that couldn't apply the fix right away, Oracle offered a stopgap: web application firewall rules blocking the vulnerable \u002FPSEMHUB\u002F endpoint. Google's Threat Intelligence Group and Mandiant now say the group behind the original attacks, tracked as UNC6240, simply URL-encoded one character in the request path - swapping \u002FPSEMHUB\u002F for \u002F%50SEMHUB\u002F - to slip past those WAF rules undetected. The trick works because many firewalls check the literal path before decoding, while PeopleSoft's own server decodes it anyway and routes the request straight to the vulnerable servlet.\n\nThis isn't a new vulnerability - it's proof that a workaround isn't a fix. Unpatched systems that thought they were covered by WAF rules are exposed again, and this time the target list has grown from mostly universities to technology, healthcare, government, agriculture, and transportation companies. ShinyHunters aren't just breaking in for fun; they use the access to steal HR and payroll data and run extortion campaigns.\n\nOracle's actual patch, issued back in June, still closes the hole - so the fix here isn't clever detection, it's just applying the update everyone was supposed to install three months ago.","[\"security\",\"oracle\",\"peoplesoft\",\"shinyhunters\"]","2026-09-29T12:05:00.000Z","2026-09-29T12:36:36.694Z","2026-09-29T12:36:43.913Z","published",null,[],"security",[24,26,27,28],"oracle","peoplesoft","shinyhunters",[30],{"name":31,"url":32},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fshinyhunters-hackers-are-going-after-oracle-systems-once-again-heres-what-we-know",0,{"sections":35},[36,41,45,50,55,60,65,70,75,80,85,90,95,100],{"name":37,"slug":38,"count":39,"latest_published_at":40},"AI","ai",4929,"2026-09-29T14:10:02.000Z",{"name":42,"slug":24,"count":43,"latest_published_at":44},"Security",774,"2026-09-29T14:10:00.000Z",{"name":46,"slug":47,"count":48,"latest_published_at":49},"Policy","policy",411,"2026-09-29T13:23:55.000Z",{"name":51,"slug":52,"count":53,"latest_published_at":54},"Deals","deals",282,"2026-09-29T13:30:00.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Hardware","hardware",194,"2026-09-29T13:16:04.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Science","science",154,"2026-09-28T13:19:18.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Consumer Tech","consumer-tech",139,"2026-09-28T17:09:47.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Software","software",91,"2026-09-25T20:55:00.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Dev Tools","dev-tools",88,"2026-09-29T08:26:28.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Startups","startups",81,"2026-09-29T09:00:00.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"General","general",49,"2026-09-28T16:44:57.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Gaming","gaming",48,"2026-09-25T18:35:21.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Reviews","reviews",31,"2026-09-28T14:31:34.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]