[CVE-2026-12569]

August 10, 2026

• PTC Artifactory RCE (CVE-2026-12569) is under active exploitation, with indicators aligning to Hazy Scorpius, the actor behind Cl0p ransomware. The flaw was documented in a June PTC advisory (Unit 42). · Threat Activity

in ResetNightmare PoC Drops at Black Hat: One Kerberos Flaw, Any Account's Password Reset

July 25, 2026

• Cl0p exploits PTC Windchill/FlexPLM (CVE-2026-12569). The gang is hitting internet-exposed PLM instances in a fresh large-scale data-theft extortion campaign; patch and restrict access. BleepingComputer, CyberInsider. · Threat Activity

in A Default-Config RCE Cracks GitLab, and the PoC Is Already Public

June 27, 2026

• PTC Windchill PDMLink / FlexPLM RCE (CVE-2026-12569) was added to CISA's KEV catalog after the first observed in-the-wild exploitation, with attackers dropping web shells. The Hacker News, SecurityWeek · Vulnerabilities & Exploits

in Amazon Q Coding Assistant Hijacked Through Malicious MCP Configs as Washington Starts Gating Frontier Models Customer-by-Customer