Attackers are increasingly abusing exposed infrastructure, trusted software ecosystems, and AI-assisted tooling, with active exploitation seen against Siemens PLCs, GitLab, PTC Windchill, and trojanized npm packages. Researchers also highlighted fresh techniques and leaks affecting Visa contactless payments, Cloudflare Workers, Unisoc modem firmware, and corporate cloud credentials. #Siemens #S7Series #GitLab #PTCWindchill #RedC2...

August’s security briefing covers ChainDrop’s rapid npm supply chain poisoning, Ghostjacking attacks against AI coding agents, and incidents where Claude Code was used in ransomware intrusions. It also highlights Sysdig’s finding that most AI-enabled attacks relied on ordinary command execution, along with Cl0p’s exploitation of PTC Windchill and broader governance updates from OWASP, CIRCIA, and NIST. #ShaiHulud #ChainDrop #ClaudeCode #PTCWindchill #Cl0p #NIST #CIRCIA

📅 Source : ReliaQuest Threat Research Team, publié le 18 août 2026. Cette analyse technique décrit une campagne d'extorsion de masse attribuée avec haute confiance au groupe Clop (aka Cl0p).

Clop ransomware targets PTC Windchill and FlexPLM, exploiting CVE-2026-12569. Companies must prioritize transparency to mitigate existential risks.

Clop (also known as Cl0p) is exploiting CVE-2026-12569 to attack Internet-exposed PTC Windchill and FlexPLM instances, using JSP web shells to steal sensitive product data in a new extortion campaign. The activity has prompted urgent patching and mitigation steps from PTC, CISA, and German authorities as the gang continues its long-running pattern of targeting enterprise platforms for data theft. #Clop #Cl0p #CVE-2026-12569 #PTCWindchill #PTCFlexPLM #CISA #BSI

CVE-2026-12569 enables Clop ransomware to exploit PTC Windchill and FlexPLM, posing critical risks for organizations. Immediate patching is essential.

This advisory describes an active Cl0p ransomware affiliate campaign targeting internet-exposed PTC Windchill and FlexPLM systems by chaining a FlexPLM WSDL information disclosure flaw with a Windchill login servlet vulnerability to gain unauthenticated remote code execution. It also details post-exploitation webshell deployment, data theft, and extortion emails sent to affected organizations across Manufacturing, Automotive, Aerospace, and Retail/Apparel sectors. #Cl0p #PTCWindchill #FlexPLM #CVE-2026-12569

CISA has ordered federal agencies to patch two actively exploited critical vulnerabilities by June 28: CVE-2026-20230 in Cisco Unified Communications Manager Server and CVE-2026-12569 in PTC Windchill and FlexPLM. The first flaw is a server-side request forgery issue used to write arbitrary text files, while the second is a remote code execution bug affecting multiple PLM versions. #CVE-2026-20230 #CiscoUnifiedCommunicationsManager #CVE-2026-12569 #PTCWindchill #FlexPLM