1 CVEs published in the last four months and 8 stories. Exploited flaws first.
| CVE | CVSS | Severity | Product | Summary | Published |
|---|---|---|---|---|---|
| CVE-2026-12569exploited | 9.8 | critical | flexplm | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. | 125d ago |
| CVE | CVSS | Severity | Product | Summary | Published |
|---|---|---|---|---|---|
| CVE-2026-12569exploited | 9.8 | critical | flexplm | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. | 125d ago |
A recent internal document from AI developer Anthropic has shed light on the ongoing challenges large language models face when interacting with CAPTCHA systems. The document, which details a security incident, includes a transcript showing Anthropic's Claude model struggling significantly with a basic image identification CAPTCHA.
A new variant of a long-standing scam has emerged, leveraging the familiar interface of a CAPTCHA challenge to trick users into downloading and executing malicious software. This technique represents an evolution in social engineering, exploiting user expectations regarding security verification steps to deliver payloads.
Researchers at Bern University of Applied Sciences have demonstrated that while large language models (LLMs) can struggle with visual CAPTCHA challenges, their performance can be significantly improved when paired with specialized tools, though some models exhibit an unexpected tendency to override correct answers. The study focused on three types of CAPTCHAs: rotation puzzles, open-circle…
A newly identified malware variant, dubbed TerminalFix by Microsoft, has been observed leveraging deceptive Cloudflare CAPTCHAs to trick users into executing malicious commands. This particular variant is notable for its method of operation, which involves manipulating users into running harmful instructions through Windows Terminal or PowerShell.
The Cl0p ransomware group claims to have compromised over 40 organizations by exploiting a critical vulnerability in PTC's Windchill and FlexPLM product lifecycle management (PLM) software. This vulnerability, identified as CVE-2026-12569, is a remote code execution (RCE) flaw with a CVSS score of 9.3, stemming from the deserialization of untrusted data. It affects all CPS versions and…
A cybercrime group known as Clop has reportedly exploited a critical zero-day vulnerability in PTC's Windchill and FlexPLM software, leading to claims of data theft from numerous organizations. The vulnerability, identified as CVE-2026-12569, allows unauthenticated attackers to execute code remotely.
The Cl0p ransomware group has reportedly named over 40 organizations as victims in a recent campaign, specifically targeting instances of PTC Windchill. This public naming on their dark web leak site is a common tactic employed by ransomware groups to exert pressure on victims to pay the ransom, threatening to release stolen data if demands are not met.
Russian state-sponsored threat actors, identified as UAC-0145, have reportedly been employing a technique dubbed "ClickFix CAPTCHAs" to compromise devices belonging to Ukrainian targets. This activity has led to the self-infection of machines with data-stealing malware. The Computer Emergency Response Team of Ukraine (CERT-UA) has attributed this campaign to UAC-0145, further linking it to…