Cl0p ransomware exploits zero‑day in PTC Windchill, targeting engineering data
A Cl0p affiliate is weaponizing CVE‑2026‑12569, an unsafe‑deserialization RCE flaw in PTC Windchill and FlexPLM, to drop JSP webshells and steal engineering data from aerospace, automotive and manufacturing firms. Patched on June 17, the bug is still being abused, leading CISA to list it in its KEV catalog. Apply PTC’s patches and hunt with the published IoCs.