ShinyHunters (also tracked by Google as UNC6240) has resumed mass exploitation of Oracle PeopleSoft’s Environment Management Hub via CVE-2026-35273 (CVSS score: 9.8), using a simple URL‑encoding trick to bypass web application firewalls. Many organizations that could not patch immediately relied on WAF rules blocking /PSEMHUB/*. ShinyHunters now requests /%50SEMHUB/ (percent‑encoding the “P”), which many WAFs compare before decoding, while Oracle WebLogic decodes it and still routes to the vulnerable servlet. Researchers warn that the group can vary encodings and case, so string‑based WAF rules are unreliable. The renewed campaign targets higher education, technology, IT services, healthcare, agriculture, transportation, and government. The attack chain sends serialized Java objects to /%50SEMHUB/hub to fingerprint hosts, then abuses Java deserialization to drop JSP web shells (x.jsp for command execution, u.jsp/u2.jsp for chunked uploads). From there, ShinyHunters uploads a trojanized “Ple64.exe” that loads SIDEEYE, a C++ backdoor supporting credential theft, file and process management, reverse shells, and reverse proxying. They also deploy Neo‑reGeorg tunneling (tunnel.jsp/.jspx) to route SOCKS5 traffic over HTTP/HTTPS and use MeshAgent RMM for persistent access on Linux. Researchers also note that about a quarter of commands run as root or NT AUTHORITY\SYSTEM, giving full OS control. UNC6240 follows a consistent pattern of data‑theft extortion, such as stealing HR, payroll, student, and other records, then threatening to leak them if ransoms are not paid. In line with security recommendations, CTIX Analysts recommend that organizations patch CVE‑2026‑35273, disable or remove PSEMHUB where possible, search WebLogic logs for /PSEMHUB/ and encoded variants, inspect PSEMHUB.war for web shells, rotate credentials, review database audit logs for bulk exports, and monitor outbound traffic from PeopleSoft hosts, as opposed to purely relying on WAF rules alone.