{"uuid": "65801110-a868-44e2-b1a4-99c3f88b71a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "seen", "source": "https://t.me/pphm_HackerNews/2281", "content": "\ud83d\udd34 Clop ransomware targets Windchill, FlexPLM in data theft attacks\n\nThe Clop ransomware gang (also tracked as Cl0p) is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign.\n\nClop has reportedly been exploiting a critical improper input validation vulnerability tracked as CVE-2026-12569, which allows attackers to execute arbitrary code on vulnerable Windchill and FlexPLM instances.\n\nAs cybersecurity company ReliaQuest reported on Thursday, Clop operators have been deploying JSP webshells that allow them to exfiltrate sensitive data from targeted companies' compromised PLM platforms.", "creation_timestamp": "2026-08-21T23:00:07.746602Z"}