CYBER THREATCAST

Patch PTC Windchill, Windchill PDMLink, and FlexPLM exposed to the internet immediately, then hunt for compromise before returning systems to normal operation. Cl0p affiliates are actively exploiting CVE-2026-12569, an unauthenticated deserialization RCE, to deploy hex-named JSP web shells under /Windchill/login/, stage files, exfiltrate data, and pursue double extortion. Manufacturing, aerospace, automotive, and retail organizations running vulnerable Windchill or FlexPLM instances should also review suspicious login POST activity and block known attacker infrastructure where available.

Audit exposed ComfyUI, Gradio, Langflow, Jenkins, Docker, Kubernetes, Elasticsearch, and MCP deployments now, with priority on internet-facing cloud, DevOps, and AI services. NadMesh operators are using more than 20 attack vectors in an autonomous botnet campaign, then persisting with SSH keys, hidden binaries, and cron jobs while stealing cloud and AI-related data to command-and-control infrastructure. Operators of AI and cloud infrastructure should remove unnecessary exposure, review credentials, and search hosts for unauthorized SSH keys, hidden binaries, and cron persistence.

Inventory Spring Boot executable fat-JAR applications that include Alibaba Fastjson 1.2.68 through 1.2.83, then restrict or remove risky JSON parsing paths until a safe remediation is in place. The reported critical RCE is unpatched and actively exploited, and attackers can trigger unsafe type resolution by sending crafted JSON containing a malicious @type field. Teams running affected Fastjson 1.x builds should treat reachable JSON endpoints as exposed attack surface and monitor for attack traffic observed by multiple vendors.

Confirm WordPress sites have received the fixed releases for WP2Shell and immediately update any installations still on WordPress 6.9.0–6.9.4 or 7.0.0–7.0.1. CVE-2026-60137 and CVE-2026-63030 can be chained for unauthenticated RCE on vulnerable WordPress sites, active exploitation has been reported, and proof-of-concept exploit code is circulating. Site owners should not assume automatic updates completed successfully; verify the version and investigate vulnerable sites for signs of unauthorized code execution.

Remove the malicious easy-day-js dependency and rebuild affected npm environments from clean package sets, especially where @mastra/* libraries or other impacted packages were installed. More than 140 npm packages were reportedly compromised, and the tainted dependency can execute harmful code during installation, creating credential-theft and data-exfiltration risk on developer workstations and build systems. Affected teams should isolate suspect systems, rotate credentials that may have been exposed, reinstall clean versions, and preserve logs for investigation.