exploit · Sat 25 Jul 2026 · 10:16 UTC
Cl0p-linked attackers are actively exploiting a critical unauthenticated RCE in internet-exposed PTC Windchill and FlexPLM systems. They chain two flaws, drop hex-named JSP webshells, and steal engineering data for double extortion. Manufacturing, automotive, aerospace, and retail firms are the main targets. Full details → https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html
Filed UTCSource X ↗
<p>🚨 Cl0p-linked attackers are actively exploiting a critical unauthenticated RCE in internet-exposed PTC Windchill and FlexPLM systems.<br /> <br /> They chain two flaws, drop hex-named JSP webshells, and steal engineering data for double extortion.<br /> <br /> Manufacturing, automotive, aerospace, and retail firms are the main targets.<br /> <br /> Full details → <a href="https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html">thehackernews.com/2026/07/cl…</a></p> <img src="https://nitter.net/pic/media%2FHOEOcMfbgAARC8A.jpg" />…
Indicators
checking abuse.ch ThreatFoxChecking indicators against ThreatFox…
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.