The critical unsafe deserialization flaw allows attackers to execute arbitrary code remotely, without authentication.

The post PTC Windchill Vulnerability Exploited in Ransomware Campaign appeared first on SecurityWeek.

Sergiu Gatlan reports: The Clop ransomware gang (also tracked as Cl0p) is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign. Clop has reportedly been exploiting a critical improper input validation vulnerability tracked as CVE-2026-12569, which allows attackers to execute arbitrary code on vulnerable Windchill and FlexPLM instances. As cybersecurity company...

Source

Hackers exfiltrated personal, financial, and health information from the company’s Oracle EBS instance in August 2025.

The post Estée Lauder Discloses Impact From Oracle EBS Zero-Day Hack appeared first on SecurityWeek.