Daily Cybersecurity
Threat Intelligence

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according tonew findingsfrom ReliaQuest. The cybersecurity company characterized the web shell as a fully equipped extortion platform capable of mapping sensitive vault data, decrypting every credential in the Windchill keystore, and running additional code by means of a custom Java class loader, turning the tool into a backdoor for remote access and post-exploitation activity, such as lateral movement, ransomware, or persistence.

Benchmaxxing: When the Benchmark Becomes the Target

China-Linked Hacker Shows AI Capabilities in APAC Attack

In what is described as the first purported near-autonomous attack on a nation-state, a Chinese-language operator used a complex AI framework to target and compromise government agencies, likely in Taiwan. The AI-powered attack marks a significant escalation in cyber warfare capabilities, enabling faster target reconnaissance and adaptive exploitation.

Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs

Oracle released its August 2026 Critical Security Patch Update (CSPU) addressing 925 unique CVEs across 943 security updates, including 154 critical-severity patches. This represents a nearly fourfold increase in patch volume compared to the June 2026 CSPU, which addressed 243 CVEs.

Fake AI, real malware: Attackers impersonating AI brands

Sophos researchers discovered threat actors impersonating AI brands to deliver malware. The attackers create fake AI tool websites and distribute malicious installers that appear to be legitimate AI applications but actually deploy information-stealing malware.

Critical GitLab Zero-Click Flaw Poses Mitigation Challenges

A lack of technical details could make it hard for organizations running self-managed GitLab versions to detect potential exploitation of CVE-2026-19478. 📌 **Analyst Note:** The lack of public technical details for CVE-2026-19478 makes detection difficult; organizations running self-managed GitLab should monitor for unusual activity and apply patches promptly.