Product

PTC Windchill

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 19, 2026 · last 18d ago

Timeline2 articles

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.

The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.

The Hacker NewsAug 28, 08:05 UTC · 18d agoThreat actor in the wildCVE-2026-194781

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.

ReliaQuest analyzed a custom Java web shell planted on vulnerable PTC Windchill and FlexPLM servers following exploitation of CVE-2026-12569 (CVSS 9.3). The implant decrypts Windchill keystore credentials including the LDAP manager password, enumerates the file vault for engineering data, and loads attacker-supplied Java classes in memory for post-exploitation. Commands let operators read and delete files, exfiltrate results, and deliver follow-on payloads such as ransomware. Ransom-ISAC, eCrime.ch and Defused previously attributed the campaign to the Clop data-theft extortion group.

The Hacker NewsAug 19, 15:27 UTC · 27d agoThreat actor in the wildCVE-2026-12569

Related CVEsby mentions

CVE-2026-125699.341%
Unauthenticated RCE in PTC Windchill and FlexPLM
PTC Windchill and FlexPLM contain an improper input validation flaw (CWE-20) with an associated deserialization of untrusted data weakness (CWE-502) that allows an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request over the network. An attacker who can reach a vulnerable Windchill or FlexPLM server can run arbitrary code on it, potentially gaining a foothold for lateral movement; CISA notes the flaw is being used in ransomware campaigns. All organizations running PTC Windchill or FlexPLM are affected, and the available data does not specify affected version ranges. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-25 with known ransomware use, and EPSS assigns a 40.6% probability of exploitation within 30 days (99th percentile). No CVSS score or public proof-of-concept is available yet, but the KEV listing confirms exploitation in the wild.
· PTC Windchill · PTC FlexPLM KEV ransomwaremoderate
CVE-2026-194789.16%
Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering
GitLab has patched a critical (CVSS 9.1) code injection flaw (CWE-94) in how GitLab Community Edition (CE) and Enterprise Edition (EE) process GraphQL directives. Under certain conditions, an unauthenticated remote attacker can abuse a GraphQL directive to modify or delete public projects and user data on affected instances, requiring no privileges or user interaction; the impact is to integrity and availability, not confidentiality. Affected versions span all GitLab CE/EE releases from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4, which covers self-managed installations as well as the same codebase that powers the GitLab.com SaaS. News reports indicate the flaw came under active exploitation within days of disclosure, and EPSS assigns a 5.8% probability of exploitation within 30 days (93rd percentile). It is not yet listed in CISA's KEV catalog and no public proof-of-concept is known, but defenders should treat it as an actively exploited, unauthenticated, high-impact issue.
· GitLab CE all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 · GitLab EE all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4mass

Appears with

organization ReliaQuest 2 threat actor Clop 1 threat actor UNC5976 1 threat actor UNC6293 1 threat actor UNC7005 1 malware Clop Windchill web shell 1 malware RedC2 1 organization Censys 1 organization Defused 1 organization eCrime.ch 1 organization Lumen 1 organization Ransom-ISAC 1 organization The Hacker News 1 organization watchTowr 1 organization ZoomEye 1 product Cloudflare Workers 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.