The WAF rule blocked one spelling of the path. ShinyHunters used another, 107 days after Oracle's patch

From zero-day to one letter

Mandiant and Google's Threat Intelligence Group published an update on 25 September 2026: the group they track as UNC6240, operating as ShinyHunters, is mass-exploiting CVE-2026-35273 in Oracle PeopleSoft again.

The flaw is in the Environment Management Hub, the PSEMHUB endpoint in PeopleTools 8.61 and 8.62. Oracle scores it 9.8 and classes it as missing authentication for a critical function. UNC6240 first used it as a zero-day between 27 May and 9 June, mostly against universities. Oracle issued an out-of-band Security Alert on 10 June. CISA added it to KEV on 12 June with a 15 June deadline, and records known ransomware campaign use.

The September wave works against organisations that did something, just not the thing that fixes it.

In June, many PeopleSoft operators who could not patch straight away blocked the vulnerable path with a web application firewall rule instead. The rule looked for the text /PSEMHUB/.

UNC6240 now requests /%50SEMHUB/. %50 is the URL-encoded form of the capital letter P. The WAF compares the literal text of the path, sees something that is not /PSEMHUB/, and lets it through. WebLogic, the application server behind it, decodes the path before routing, turns %50 back into P, and hands the request to the vulnerable servlet.

Mandiant's summary is exact: this reaches the endpoint "on systems whose operators may have believed their WAF rules had mitigated the exposure". And it names the pattern plainly. UNC6240 "adapted to published defensive guidance, targeting organizations that implemented WAF rules but did not patch the vulnerability."

What this does not establish

It does not establish that WAFs are useless here. Mandiant's own advice is to block on the normalised path, which a rule that decodes and case-folds the path before matching would do. The failure is a literal string match, not the idea of a perimeter rule.

It does not establish how many organisations were hit. Mandiant says web shells were deployed on dozens of systems globally, across higher education, technology, IT services, healthcare, agriculture, transportation and government. It gives no count, and nor does this briefing.

It does not mean patched systems are exposed. The bypass gets a request to the servlet. If Oracle's fix is applied, the servlet is no longer vulnerable.

And it does not mean the June guidance was wrong. According to the September post, it recommended patching and, where that was not possible, blocking external access to the path at the perimeter, while warning that WAF body-inspection rules alone were not enough. The September wave exploits how that block was implemented, not whether it was advised.

What happens once they are through

Mandiant's account of the attack lifecycle is worth reading for the detections it breaks, not just the ones it offers.

Before exploiting, the attackers send five to fifteen POST requests to /%50SEMHUB/hub carrying a serialised Java object. An unpatched server replies with its operating system and writes nothing to disk. So a host can be confirmed vulnerable, logged, and left for later, with nothing on it to find.

There are two exploitation methods. One drops single-line JSP web shells such as x.jsp into the PSEMHUB directory, repeated in bursts so every node behind a load balancer gets a copy. The other is fileless: commands run and their output comes back in the HTTP response, with nothing written. In Mandiant's words, detections that rely on JSP file creation will not identify this method.

Across compromised instances, a quarter of the attackers' commands ran as root or SYSTEM. Follow-on tooling includes a trojanised media player installer signed with a valid Extended Validation certificate that loads a backdoor Mandiant tracks as SIDEEYE, the open-source Neo-reGeorg tunnelling kit, and the legitimate MeshCentral remote management agent.

What to do about it

The question this leaves

An interim WAF rule is meant to last days. This one stood in for a 9.8 unauthenticated takeover flaw for over three months, long enough for the attackers to read the guidance that recommended it and design around it.

The bypass is not clever. Percent-encoding a character in a path is one of the oldest tricks in web security. What made it work is that a temporary control quietly became the permanent one.

So the question for your own estate: which of your mitigations were meant to be temporary, and how many of them are still the only thing standing in front of an unpatched system?