🚨 ACTIVE EXPLOITATION
- ShinyHunters uses %50 URL-encoding trick to bypass WAF rules in Oracle PeopleSoft attacks
CVE-2026-35273
ShinyHunters is bypassing WAF mitigations for the Oracle PeopleSoft CVE-2026-35273 flaw using percent-encoded URLs to resume exploitation and data theft.- Affects organizations running unpatched Oracle PeopleSoft servers, especially in education, healthcare, technology, IT services, government, agriculture, and transportation sectors.
- CVE-2026-35273 is an unauthenticated remote code execution flaw in the PeopleSoft Environment Management Hub (/PSEMHUB/*) endpoint, patched by Oracle in June 2026.
- Attackers send percent-encoded paths like /%50SEMHUB/ instead of /PSEMHUB/; many WAFs and reverse proxies match the literal path before decoding, while Oracle WebLogic decodes it and routes to the vulnerable endpoint.
- Before exploiting, attackers send 5-15 POST requests to /%50SEMHUB/hub with serialized Java objects to silently probe for vulnerable servers, then deploy JSP web shells (x.jsp, u.jsp, u2.jsp, tunnel.jsp) and the SIDEEYE backdoor via Ple64.exe, plus Neo-reGeorg tunneling and MeshAgent for persistence and lateral movement.
- ShinyHunters confirmed using the WAF bypass against FBI Jobs, while still claiming a separate unknown zero-day in the same PSEMHUB component.
🕵️ RESEARCH & DEEP DIVES
- Lunex Stealer MaaS Abuses Vulnerable AMD Driver (CVE-2023-20598) to Blind Security Tools
The Lunex malware-as-a-service platform uses a vulnerable AMD Radeon driver in a BYOVD attack to disable security monitoring before stealing browser credentials and crypto wallets from Ukrainian-speaking users.- Targets Ukrainian-speaking users via compromised legitimate websites (clinics, retailers, booksellers) injecting ClickFix-style fake Cloudflare CAPTCHA lures.
- Bogus MSI installers deliver LunexLoader, which bypasses UAC via the CMSTPLUA COM object and exploits the vulnerable AMD PDFWKRNL.sys driver (CVE-2023-20598) to blind security processes while leaving them running.
- Neither HVCI nor Microsoft's Vulnerable Driver Blocklist blocks the PDFWKRNL.sys variant used, despite its hash being in LOLDrivers since March 2026.
- Psychedelic/LunexStealer harvests credentials from seven Chromium browsers, desktop wallets (Bitcoin Core, Litecoin, Exodus, Atomic, Electrum), and extension wallets (MetaMask, OKX, SafePal), exfiltrating to C2 panel 193.178.159[.]128 over HTTP.
- Persistence via Registry Run key, hidden scheduled task "psychedelicloveUtils," a PowerShell Chrome native-messaging host granting remote filesystem access, and a malicious Chrome extension injected through Secure Preferences.
🔓 CVEs & KEV
- CVE-2026-82901 — themefic Ultra Addons for Contact Form 7 — CVSS 9.8 — Ultra Addons for Contact Form 7 through 3.5.50 - Unauthenticated Arbitrary File Up...