Critical

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

The Hacker News

August 19, 2026 at 5:39 AM

Actively Exploited

Overview

Researchers from ReliaQuest discovered a web shell linked to the Clop ransomware gang that targets PTC Windchill and FlexPLM servers. This web shell exploits a serious vulnerability in the software, allowing attackers to decrypt credentials and map sensitive engineering data. The malicious tool is designed specifically for enterprise Product Lifecycle Management (PLM) software, which many organizations rely on to manage their product data. The presence of this web shell poses significant risks to companies using these systems, as it can lead to data breaches and extortion. Organizations using PTC Windchill and FlexPLM need to be vigilant and address this vulnerability promptly to protect their sensitive information.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: PTC Windchill, PTC FlexPLM
Action Required: Organizations should apply the latest security patches from PTC for Windchill and FlexPLM and review their security configurations to mitigate the risk.
Timeline: Newly disclosed

Original Article Summary

A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according to new findings from ReliaQuest. The cybersecurity company characterized the web shell as a fully equipped extortion platform capable of mapping sensitive vault

Impact

PTC Windchill, PTC FlexPLM

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should apply the latest security patches from PTC for Windchill and FlexPLM and review their security configurations to mitigate the risk.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Ransomware, Vulnerability, Critical.

Read Original Article

Related Coverage

Critical RCE flaw in Windows IKE Extension now actively exploited

BleepingComputer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a serious remote code execution (RCE) vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions. This flaw is currently being exploited by attackers, which raises significant concerns for organizations using affected systems. The vulnerability could allow hackers to execute arbitrary code on compromised devices, potentially leading to data breaches or system control. Windows users and administrators are urged to take immediate action to protect their systems. This situation highlights the ongoing risks associated with software vulnerabilities and the importance of timely updates and security measures.

Aug 19, 2026

ICO Urges Police to Improve Data Governance in Facial Recognition Rollouts

Infosecurity Magazine

The UK’s Information Commissioner's Office (ICO) is urging police forces to enhance their data governance practices when implementing facial recognition technology. This recommendation comes amidst concerns about privacy and the potential misuse of data collected through such surveillance systems. The ICO's call emphasizes the importance of adhering to established guidelines to protect individuals' rights and ensure that the technology is used responsibly. As police departments increasingly adopt facial recognition tools, the ICO aims to ensure that these practices are transparent and accountable, addressing public fears over privacy violations. This move is significant as it reflects ongoing debates around surveillance technologies and their implications for civil liberties.

Aug 19, 2026

943 Patches Rolled Out With Oracle’s August 2026 Security Update

SecurityWeek

Oracle has released a significant security update for August 2026, addressing a total of 943 patches that fix over 1,000 vulnerabilities across two dozen of its products. Among these vulnerabilities, more than 460 are considered remotely exploitable, meaning attackers could potentially exploit them from a distance without physical access to the systems. This update is crucial for organizations using Oracle products, as ignoring these vulnerabilities could expose them to significant risks, including data breaches and system compromises. Users are advised to apply these patches promptly to safeguard their systems against potential attacks. The breadth of the vulnerabilities covered in this update highlights the ongoing need for vigilance in software security management.

Aug 19, 2026

Google’s AI security agents found 100+ critical software vulnerabilities in just two days

Help Net Security

Google's Mandiant recently showcased its new AI-driven tool called the Agentic Vulnerability Discovery Harness (AVDH), which successfully identified over 100 severe software vulnerabilities in just two days. This tool was part of a live investigation into compromised corporate repositories and has been operational for ten months. During this period, it has analyzed tens of millions of lines of code. The findings are significant as they indicate that even established software can harbor critical flaws, prompting companies to enhance their security measures. The rapid detection of these vulnerabilities underscores the potential of AI in improving cybersecurity efforts and protecting sensitive data.

Aug 19, 2026

OpenAI puts major frontier AI training run on hold over cyber risks

Help Net Security

OpenAI has decided to pause its major reinforcement learning training run for its latest AI models due to increased cybersecurity concerns. The company is taking this two-week break to strengthen its research environments and improve monitoring practices. This decision comes after a recent incident involving OpenAI and Hugging Face that raised alarms about potential risks. During this pause, OpenAI plans to conduct smaller-scale training and evaluations to better understand the models' behavior and validate existing safeguards. This move is significant as it reflects the company's commitment to ensuring that its AI technologies are safe and aligned with ethical standards before full deployment.

Aug 19, 2026

UK Fraud Cases Hit Record High in 2026

Infosecurity Magazine

Fraud cases in the UK have reached an all-time high, largely driven by incidents of account takeover and identity fraud, according to data from Cifas. The report indicates that these types of fraud are becoming increasingly common, affecting a wide range of individuals and businesses. Account takeover fraud occurs when criminals gain unauthorized access to personal accounts, while identity fraud involves stealing someone's personal information to commit financial crimes. This surge in fraud not only impacts victims financially but also raises concerns regarding the security of personal data and online transactions. As fraudsters become more sophisticated, it emphasizes the need for stronger security measures and awareness among consumers and companies alike.

Aug 19, 2026