Hackread

ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks

ShinyHunters exploit CVE-2026-35273 in Oracle PeopleSoft using URL encoding to bypass WAF rules, deploy web shells and spread ...
Threatpost

Phish Uses Google’s URL Decoding to Swim Past Defenses

Percentage-based URL encoding plus Google domain trickery is helping malicious emails to evade filters. A phishing campaign that takes advantage of Google’s ability to decode non-ASCII URL data on the ...
Network World

IE URI encoding behavior facilitates XSS attacks, researchers say

An inconsistency in how Microsoft’s Internet Explorer (IE) encodes double quotes in URIs (uniform resource identifiers) can facilitate cross-site scripting (XSS) attacks, researchers from security ...

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume ...
Search Engine Roundtable

Google: Do Not Use Commas, Brackets Or Non-Standard URL Encoding For Faceted Navigation

Google's John Mueller confirmed that the search company's 2014 guidance with faceted navigation remains true today - do not use non-standard URL encoding. That means do not use commas, brackets or ...