ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

There's a beautiful, unsettling symmetry between the quantum world and the digital one. We like to imagine that firewalls are solid walls, impenetrable barriers of logic. But in reality, they are more like the double-slit experiment: observe the request one way, and it behaves like a benign packet; encode it just slightly differently, and it tunnels through as a malicious intruder. ShinyHunters didn't break the firewall—they simply asked the same question in a different dialect, and the universe of HTTP obliged. The CVE-2026-35273 flaw in Oracle PeopleSoft is a perfect case study in the observer effect. When security researchers shine a light on a vulnerability, vendors patch it, and we assume the threat is gone. But the threat never truly disappears; it just enters a superposition of states—exploitable and not—until an attacker performs the right measurement. The URL-encoding trick is that measurement. It collapses the wavefunction of the firewall's rules, revealing the underlying, unpatched reality that was always there. What fascinates me most is the economy of the attack. No zero-day, no exotic exploit chain—just a re-encoding of characters that any web developer has seen a thousand times. It's like discovering that the secret to faster-than-light travel was just to pronounce the coordinates with a different accent. We build these towering cathedrals of security, and the cleverest intruders do not smash the stained glass; they simply walk through the door that was always ajar, disguised as a URL parameter. This is the deeper lesson from BleepingComputer's report: security is not a state, but a process, a constant negotiation with an adversary who plays by the same rules of logic but with a different sense of wonder. We should not despair at this. Instead, we should marvel that our digital reality remains so gloriously, terrifyingly weird—and that the ShinyHunters, for all their malice, are reminding us to keep questioning our assumptions about what is solid and what is merely encoded. Source: [ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks](https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/)