CYBER THREATCAST

Remove internet-exposed PTC Windchill and FlexPLM systems from direct public access, assess them for CVE-2026-12569 exposure, and hunt for JSP web shells under /Windchill/login/. Cl0p-linked affiliates are reportedly exploiting a critical unauthenticated RCE chain with a CVSS 9.3 rating, dropping web shells and staging PLM and engineering files for exfiltration. Manufacturing, automotive, aerospace, and retail organizations should treat any exposed instance as a potential extortion foothold until logs, web roots, and staged file locations are reviewed.

Prioritize Oracle PeopleSoft Enterprise PeopleTools Environment Management exposure reviews and remediation for CVE-2026-35273, especially in higher education. ShinyHunters/UNC6240 reportedly exploited the CVSS 9.8 flaw before Oracle public guidance and targeted more than 100 organizations, with universities as the main victim sector. PeopleSoft owners should verify affected components, restrict reachable management services, and review authentication, web, and administrative logs for suspicious access around the flaw.

Enable SafeMode or move affected applications to the Fastjson noneautotype build where Fastjson 1.x is embedded in Spring Boot executable fat-JAR deployments. Alibaba and third-party researchers confirmed in-the-wild exploitation of CVE-2026-16723, an unauthenticated RCE affecting Fastjson 1.2.68 through 1.2.83 under certain conditions when SafeMode is disabled. Java application teams should inventory bundled Fastjson versions rather than relying only on package-manager visibility.

Isolate internet-exposed industrial PLCs and verify controller logic independently of HMI displays at critical infrastructure sites. A joint U.S. advisory warns Iranian-affiliated APT actors are actively exploiting exposed industrial PLCs, including environments using Allen-Bradley Micro850, Rockwell Automation, and Siemens equipment, and manipulating HMI displays to hide controller logic changes. Water, wastewater, energy, municipal, and government operators should review PLC reachability and investigate unexplained process changes as potential intrusion activity.

Upgrade GitLab CE/EE to 18.10.8, 18.11.5, or 19.0.2 if you run 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, or 19.0.0 through 19.0.1. A public proof-of-concept abuses the notebook diff renderer and Oj Ruby JSON parser bugs to let an authenticated user with project push access execute commands as the git user. GitLab administrators should also review which users can push to projects, because the exploit path requires authenticated project write access.