- Published
- Source
- BleepingComputer
- Filed under
- Ransomware, Attacks
- Vulnerabilities
- 1 CVE Exploited
The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers.
If you run the affected product
- Find every instance – especially the ones reachable from the internet.
- Apply the vendor's patch or mitigation now: exploited flaws are fixed in days, not at the next patch cycle.
- Then check for signs it was used before you patched: web shells, new accounts, unusual outbound traffic.
More helpCISA's Known Exploited Vulnerabilities catalogue (opens in a new tab)
The vulnerabilities in this story
CVE-2026-35273 in the NVD (opens in a new tab)
- CVSS9.8Critical
- CISA KEVExploitedon the list since 12 Jun · used in ransomware
Exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog (CC0). Exploit prediction: EPSS by FIRST. This product uses the NVD API but is not endorsed or certified by the NVD.
MyCyberWay training
Blue Team Specialist
Breaches like this get investigated, not just reported.
Blue Team Specialist takes the Analyst curriculum and adds the investigator's work: one incident owned end to end, hypothesis-led threat hunting with MITRE ATT&CK and KQL, breach analysis, and a root cause report people can act on.
- Scope, attacker path and dwell time
- Threat hunting with ATT&CK and KQL
- Root cause analysis and reporting
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
