> TritonInfoSec News
Home / Jul 26, 2026 / Story
0
#2 The Hacker News general July 25, 2026 at 10:14 UTC

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

By [email protected] (The Hacker News)

AI Summary

Cl0p ransomware affiliates (tracked as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) are actively exploiting chained unauthenticated RCE vulnerabilities in internet-exposed PTC Windchill and FlexPLM deployments in a new data extortion campaign. The attack chain combines a pre-authentication information disclosure flaw in the FlexPLM WSDL endpoint with a server-side vulnerability in the Windchill login servlet. Industrial organizations using these PLM platforms should immediately audit external exposure and apply available patches.

Read full article → https://thehackernews.com/2026/07/cl0p-affiliates-…

Relevance score: 87.0/100

# More from July 26

  1. 1
    Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available The Hacker News
  2. 3
    Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git The Hacker News
  3. 4
    BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery The Hacker News
  4. 5
    Default Azure Automation Setting Enables Cross-Tenant Identity Takeover Dark Reading
  5. 6
    Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable The Hacker News
  6. 7
    Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts BleepingComputer
  7. 8
    Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks The Hacker News
  8. 9
    Golden Chickens Resurfaces With Four New Malware Families and Modular Implants The Hacker News
  9. 10
    Hermes AI agent used to automate attack on Thai Finance Ministry BleepingComputer