CYBER THREATCAST

Take internet-exposed PTC Windchill and FlexPLM systems out of direct reach, validate current vendor fixes and mitigations, and hunt for JSP web shells and suspicious access from 104.243.35.63, 216.152.148.54, 216.152.151.204, and 5.180.41.35. Cl0p-linked affiliates are chaining a FlexPLM pre-authentication information disclosure with a Windchill login servlet flaw for unauthenticated RCE, and PTC reported continued heightened threat activity after CISA KEV inclusion. Manufacturing, automotive, aerospace, and retail organizations should treat exposed engineering and product-data repositories as extortion targets.

Remove industrial PLCs, Rockwell Automation and Allen-Bradley equipment, and HMI systems from direct internet exposure, then verify controller logic against known-good baselines rather than relying only on operator displays. Iranian-affiliated APT actors are actively exploiting exposed PLCs and OT devices used by water, energy, government, and municipal infrastructure, and the advisory says attackers manipulate HMI displays to hide controller-logic changes. Critical infrastructure operators should prioritize any Allen-Bradley Micro850 and other externally reachable PLC environments.

Patch Windows systems for Microsoft Defender CVE-2026-33825 immediately and investigate recent privilege-escalation behavior on hosts used in ransomware incidents. Microsoft patched the BlueHammer flaw on April 14, 2026 after public exploit code appeared, CISA added it to the Known Exploited Vulnerabilities catalog, and CISA later warned ransomware operators were actively using it to gain SYSTEM-level access. Endpoint teams should confirm Defender update coverage across servers, workstations, and any systems already showing signs of compromise.

Audit WordPress sites for exposure to CVE-2026-63030 and CVE-2026-60137, apply available fixes, and review web logs for scanning or exploitation attempts. Researchers report active exploitation of the wp2shell vulnerabilities, public exploit code has lowered the barrier to attack, and the chain can lead to unauthenticated remote code execution on vulnerable WordPress installations. WordPress operators running business-critical sites should also check for unexpected files, new administrator accounts, and modified plugin or theme code.

Find Spring Boot executable fat-JAR deployments using Fastjson 1.x, especially Fastjson 1.2.68 through 1.2.83, and enable SafeMode or move to the noneautotype build where applicable. Alibaba and third-party researchers confirmed in-the-wild exploitation of CVE-2026-16723, an unauthenticated RCE flaw affecting these deployment patterns. Application owners should treat internet-facing Java services using affected Fastjson versions as high-risk until mitigated and checked for compromise.