Clop ransomware targets Windchill, FlexPLM in data theft attacks

Clop (Cl0p) is actively exploiting a critical unsafe deserialization vulnerability (CVE-2026-12569, CVSS 9.3) in PTC Windchill and FlexPLM to achieve unauthenticated remote code execution, deploy JSP webshells, exfiltrate sensitive product data, and extort victims; PTC and CISA have issued advisories and emergency patching guidance while victims have received extortion emails from addresses such as [email protected].