ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
2026-09-27T07:23:20Z•5bfcdd49a30b9a03bcff6443e4443f7068138f7370ea13856214283be9dbd788
CVE-2026-35273CVE-2026-5430CSRFElementorGitHub ActionsGrav CMSKiteworksMini Shai-HuludOracle PeopleSoftShinyHuntersURL encodingWAF bypassWSO2WordPressactive exploitationauthentication bypassdata breachpath traversalransomwaresupply chain compromisezero-day
What happened
BleepingComputer security feed highlights active exploitation of multiple enterprise vulnerabilities, including Oracle PeopleSoft CVE-2026-35273 with a URL-encoding WAF bypass used by ShinyHunters, WSO2 CVE-2026-5430 authentication bypass exploitation, and a Grav CMS path traversal attack. It also reports compromised GitHub Actions retaining malicious Mini Shai-Hulud payloads, an Elementor WordPress CSRF flaw enabling administrator account creation, and potential zero-day threats against Kiteworks servers.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 5bfcdd49a30b9a03bcff6443e4443f7068138f7370ea13856214283be9dbd788
- Enrichment time
- 2026-09-27T07:23:20Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.