ShinyHunters PeopleSoft attacks are back. A one-letter WAF bypass lets the group exploit CVE-2026-35273 and plant web shells on unpatched servers.

#ShinyHunters #PeopleSoft #WAFBypass #CVE202635273 #UNC6240 #Oracle #DataExtortion #CyberSecurity

@mandiant.com
UNC6240 bypasses WAFs to exploit PeopleSoft and deploy web shells, MeshAgent, and SIDEEYE.
-
IOCs: 5[.]199[.]162[.]157, 162[.]219[.]30[.]165, winmanage-me[.]network
-
#CVE202635273 #ShinyHunters #ThreatIntel