TECH NEWS

ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks

Mandiant and the Google Threat Intelligence Group (GTIG) have identified renewed exploitation of a critical Oracle PeopleSoft vulnerability, with attackers using a simple URL trick to bypass web application firewall (WAF) rules deployed against the flaw.

The activity is linked to UNC6240, aka ShinyHunters. The group exploited CVE-2026-35273 as a zero-day between May 27 and June 9. Oracle released an emergency security update on June 10; however, the latest activity is a continuation of this earlier campaign.

URL Encoding Defeats WAF Rules

The vulnerability affects PeopleSoft’s Environment Management Hub (PSEMHUB). In the latest campaign, attackers changed /PSEMHUB/ to /%50SEMHUB/, replacing the letter “P” with its URL-encoded equivalent.

For context, many WAF and reverse-proxy rules match the path before URL decoding, so they may not recognize the altered request. WebLogic then decodes the path and routes it to the vulnerable servlet, allowing exploitation to proceed.

Mandiant found web shells...

Copyright of this story solely belongs to hackread.com. To see the full text click HERE

https://media.thenextweb.com/2026/09/trump-xi-handshake-temple-of-heaven.jpg

Xi ends Washington visit with trade truce extended to January

Chinese President Xi Jinping left Washington on Friday at the end of a state visit that extended the US-China trade truce but produced no major new agreements. Treasury Secretary Scott Bessent said the two countries had agreed to extend their trade truce to 10 January, NBC News reported. Artificial intelligence

https://media.thenextweb.com/2026/07/hollywood.jpg

Hollywood studios want film graduates who already use AI, Semafor reports

Hollywood studios are turning to film schools for graduates who already know how to use AI video tools, rather than training their own staff, Semafor reported on Thursday. “How do we find people who already know how to use this?” studios are now asking, Runway chief executive Cristóbal Valenzuela told

https://cdn.mos.cms.futurecdn.net/fYD5iB2yRfA2UKtkHhqqpH-2560-80.jpg

Is VR back from the dead? After the terrible year 2026 has been so far the Meta VR Glasses give me hope

Since the Oculus Quest 2, the VR industry has been chasing a high point that seems impossible to re-summit — let alone surpass. I mean, how can you compete with popularity propelled by global pandemic-caused lockdowns and ultra-low costs when people are no longer trapped in their homes and facing down

https://images.axios.com/Hh1Jo9nPZb06rqHhMQY0qvMUnt4=/0x26:3653x2080/1366x768/2026/09/26/1790421225769.jpeg

The US and China create a “Super Intelligence Dialogue” on AI risks and a separate AI incident hotline, likened to a Cold War-era “red telephone”

Sponsor Posts Subquadratic: the LLM built for 12M-token reasoning — SubQ can reason across entire codebases and document sets in one pass with no RAG workarounds. Read how SubQ 1.1 Small holds near-perfect retrieval out to 12M tokens. Cloudflare Connect 2026: The Agentic Conference — Stop preparing for agents. Start running

URL Encoding Defeats WAF Rules

Read more

Xi ends Washington visit with trade truce extended to January

Hollywood studios want film graduates who already use AI, Semafor reports

Is VR back from the dead? After the terrible year 2026 has been so far the Meta VR Glasses give me hope

The US and China create a “Super Intelligence Dialogue” on AI risks and a separate AI incident hotline, likened to a Cold War-era “red telephone”