bypass

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

by
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

The ShinyHunters extortion gang uses a URL encryption trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 vulnerability, allowing threat actors to re-exploit the vulnerability on vulnerable servers. Mandiant and Google’s Threat Intelligence Group (GTIG) say this new technique allowed the threat actor to once again target PeopleSoft servers that had … Read more

Malicious NPM packages bypass the installation script defenses at runtime

by
Malicious NPM packages bypass the installation script defenses at runtime

An ongoing NPM malware campaign using the indexed-btree package shows how threat actors are evading supply chain defenses by hiding malicious code in the normal runtime behavior of a package rather than in installation scripts. The package discovered by Checkmarx researchers attempts to mimic the legitimate sorted-btree library and has already been downloaded 2 million … Read more