One URL-encoded letter gets ShinyHunters past PeopleSoft WAF rules on unpatched servers

%50 is the URL-encoded form of the letter P. A WAF rule that matches the literal string /PSEMHUB/ does not match /%50SEMHUB/, and the request still reaches the Environment Management Hub endpoint ^[11]. Mandiant's analysts wrote that the change "allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure" ^[11]. They had warned about this during the first wave. "Relying solely on Web Application Firewall (WAF) body-inspection rules is insufficient, as these controls can be bypassed," Mandiant noted then ^[9].

The bypass only matters for sites that stopped at a filter. At the time, Oracle's advice was to apply the emergency patch. Sites that could not patch were told to restrict PeopleSoft application and web servers to trusted internal networks and to block external access to the vulnerable endpoints at the perimeter ^[8]. Mandiant wrote that the group "adapted to published defensive guidance, targeting organizations that implemented WAF rules but did not patch the vulnerability" ^[12]. Patched servers are outside the target set Mandiant describes ^[12].

On the FBI side, the outage and the investigation are on the record ^[1][2]. The rest comes from the group. ShinyHunters says it also reached FBI-managed servers on AWS GovCloud and took personnel files on current, former and prospective employees ^[4]. It claims personal data on tens of thousands of agents and applicants, plus the agents' medical data ^[5]. According to the BBC, the group claims access to FBIJobs, the BEAST background-check system, the MedLink medical-records system and the BICS investigative platform ^[14]. Reuters matched the career details of eight people in the leak to court filings, news articles and public profiles. It could not verify that all the job assignments were authentic or current ^[15].

Help Net Security's report does not tie the FBI intrusion to CVE-2026-35273 or to the tools Mandiant documented. If the group's zero-day is a separate bug, Oracle's CVE-2026-35273 patch would not cover it ^[3].

The group says it is not after money. It says the attack answers a recent public service announcement that advised victims not to pay the ransom, and it has threatened to publish the files unless the FBI retracts what it calls "false allegations" ^[6].

A PeopleSoft hunt does not have to wait for Oracle to confirm a new flaw. Mandiant documented what the group does once inside: it deploys web shells, installs the MeshAgent remote management tool and runs commands filelessly ^[13]. MeshAgent is legitimate software ^[13]. On a PeopleSoft web server, the thing to look for is an install that nobody in IT can explain. The entry signature Mandiant published is a request for /%50SEMHUB/ in place of /PSEMHUB/ ^[11].