Mandiant and Google Threat Intelligence Group have identified renewed mass exploitation of CVE-2026-35273, the Oracle PeopleSoft flaw UNC6240 — ShinyHunters — used as a zero-day against academic institutions in June, after the actor modified its exploit to bypass the web application firewall rules that many operators deployed in place of the patch. The bypass is a single URL-encoded character: request /%50SEMHUB/ instead of /PSEMHUB/. String-based WAF and reverse-proxy rules match the literal path before URL-decoding, while Oracle WebLogic decodes %50 to P and routes the request to the vulnerable Environment Management Hub servlet, so access succeeds on systems whose operators believed their WAF had mitigated the exposure. Targeted servers first received five to 15 POST requests to /%50SEMHUB/hub carrying serialised Java objects — a quiet exploitability check that returns host operating-system information without writing files — followed by in-memory command execution or JSP web shells (x.jsp for execution, u.jsp and u2.jsp for uploads), deployed in bursts so every node behind a load balancer receives a copy. On Windows hosts the shells dropped Ple64.exe, masquerading as a signed media-player installer, which installs the SIDEEYE backdoor; the actor also used the open-source Neo-reGeorg tunnelling toolkit for SOCKS5-over-HTTP lateral movement and the legitimate MeshAgent remote-management agent for persistence on Linux. Mandiant's guidance is blunt: apply the Oracle Security Alert patch for CVE-2026-35273, since path blocking is not a substitute, and assume any percent-encoded, mixed-case or otherwise non-normalised variant of /PSEMHUB/ will follow.

• Source article