TL;DR for CISOs: The Clop extortion group is running a fresh mass data-theft campaign against internet-exposed PTC Windchill and FlexPLM systems, naming Shell, General Electric, and Philips among 43 claimed victims. The same 24 hours brought two more critical flaws under active exploitation within days of their patches, in SAP Commerce Cloud and VMware vCenter, and France's tax authority admitted a breach affecting 678,000 people and businesses that started with a stolen login rather than any software exploit.
- Enterprise engineering and product-lifecycle platforms are Clop's new file-transfer target. If PTC Windchill or FlexPLM faces the internet in your estate, treat it as a live target and hunt for webshells now rather than waiting for a leak-site listing.
- The window between disclosure and exploitation is now measured in days. SAP Commerce Cloud and VMware vCenter were both attacked within a week of their fixes. Your emergency-patch path for internet-facing systems, not your monthly cycle, is what matters here.
- A valid credential is still the quietest way in. The French tax breach used a stolen login and an MFA bypass with no exploit at all. Contractor access reviews and credential-exposure monitoring deserve the same urgency as your vulnerability program.
Clop names Shell, GE, and Philips in a 43-victim PTC Windchill data-theft campaign
PTC Windchill and FlexPLM · Product lifecycle management · Mass exploitation of CVE-2026-12569 for data theft and extortion
- The Clop gang has listed 43 new victims on its leak site, saying it stole data from internet-exposed PTC Windchill and FlexPLM instances by exploiting a critical improper input validation vulnerability tracked as CVE-2026-12569.
- Philips confirmed that an enterprise server was breached but said the incident was contained and did not affect customer environments. General Electric said it is aware of the claim and working to assess it. Both statements are the companies' own.
- Shell said on Friday that it is investigating a potential incident after Clop claimed to have taken 89 gigabytes of its data. Shell has not confirmed the gang's figures.
- PTC says more than 30,000 organizations use its products globally, including over 1,500 brand and retail customers on FlexPLM, across aerospace, defense, automotive, heavy machinery, retail, and medtech.
- PTC began releasing patches on June 17 and warned of heightened threat activity on June 26. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and set a federal remediation deadline; Germany's BSI issued an overnight warning to customers.
What happened
Windchill and FlexPLM are where manufacturers keep the crown jewels of how a physical product is designed and built: engineering drawings, bills of materials, test reports, and facility documentation. Clop, according to security reporting, has been treating internet-exposed instances of these platforms as a mass-exploitation target, the same playbook it ran against MOVEit, GoAnywhere, Cleo, and Oracle E-Business Suite. Independent confirmation has come from ReliaQuest and the Ransomware Information Sharing and Analysis Centre, which observed the attackers deploying JSP webshells on compromised platforms to pull data out. The 43-victim count and the specific volumes, including the 89 gigabytes attributed to Shell and the lists of blueprints and facility photos, are Clop's own claims. What the named companies have confirmed is narrower: Philips acknowledged a contained breach of one enterprise server with no customer impact, while GE and Shell say they are still investigating. The gap between what a gang claims and what a victim confirms is exactly where a CISO should read carefully.
Evidence
Verified against two independent sources:
- BleepingComputer: Philips and GE investigating Clop ransomware data theft claims
- Computer Weekly: Multiple organisations investigating fresh wave of Cl0p breaches
What this means for your team
Clop has spent years turning a single flaw in a widely deployed enterprise platform into an industrial-scale extortion pipeline, and it has now settled on product-lifecycle systems as this cycle's soft target. If your organization designs, manufactures, or supplies physical goods, the risk is not only that your own Windchill or FlexPLM instance is exposed; it is that a supplier or contract manufacturer holding your drawings and specifications is. The stolen material in these campaigns is intellectual property with a long shelf life, so the damage is not a one-week news story but a multi-year exposure of how your products are made. Because the patches have been available since mid-June, an unpatched internet-facing instance today is less a vulnerability-management gap than an incident waiting to be scoped.
- Inventory every PTC Windchill and FlexPLM instance you run, confirm none is internet-exposed, and apply PTC's CVE-2026-12569 patches immediately if any is unpatched.
- Hunt for JSP webshells and other indicators of compromise on those platforms now, using PTC's advisory and the ReliaQuest and Ransom-ISAC guidance, on the assumption that patching alone does not evict an attacker already inside.
- Ask suppliers and contract manufacturers that hold your engineering data whether they run these platforms and how they have responded, since your IP can leak through their environment.
- Prepare a holding position for legal and communications in case your organization appears on the leak site, and separate confirmed facts from Clop's claims before responding publicly.
Max-severity SAP Commerce Cloud flaw exploited three days after its patch
SAP Commerce Cloud · E-commerce platform · Unauthenticated remote code execution, CVE-2026-58231
- CVE-2026-58231 carries a maximum CVSS score of 10 and stems from insufficient authorization checks and input validation. It can be exploited to run arbitrary code and compromise internal components.
- SAP shipped the fix on August 11 as part of its monthly patch day. Threat-intelligence firm Defused reported honeypot exploitation attempts on August 14, three days later, with no public proof-of-concept at that point.
- KEVIntel independently confirmed exploitation attempts through its own sensors, and noted on August 15 that a proof-of-concept exploit had become available.
- As of publication, CISA had not yet added CVE-2026-58231 to its Known Exploited Vulnerabilities catalog, so federal timelines do not yet apply.
What happened
SAP Commerce Cloud sits underneath large business-to-business and business-to-consumer storefronts, which makes a pre-authentication code-execution flaw in it a direct line to order data, customer records, and the systems behind them. Two separate threat-intelligence organizations reported attackers probing the flaw within days of the patch, before any public exploit code existed, which points to adversaries reverse-engineering SAP's fix to locate the vulnerable path. By August 15 a working proof-of-concept was circulating, lowering the bar for less sophisticated actors to join in. The pattern here, exploitation arriving before most enterprises have finished testing the patch, is the recurring story of 2026 rather than an outlier.
Evidence
- SecurityWeek: Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure
- The Hacker News: SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts
What this means for your team
If you run SAP Commerce Cloud, the safe assumption is that opportunistic scanning for this flaw is already underway and that a proof-of-concept is in circulation. The exposure is not limited to the storefront itself; a foothold on the platform can reach the databases and internal components it connects to, which is where payment and customer data live. Retail and consumer-facing organizations that treat commerce infrastructure as a business system rather than a security-critical one will feel this gap most, because the teams that operate these platforms are often separate from the security function that needs to drive the emergency patch.
- Identify every internet-facing SAP Commerce Cloud instance and confirm the August 11 patch for CVE-2026-58231 is applied, escalating any that are not through your emergency-change process.
- Review web and application logs for the exposure window between August 11 and patch completion for signs of exploitation, rather than assuming a clean patch means no compromise.
- Restrict administrative and management interfaces to trusted networks and monitor for unexpected code execution or outbound connections from the platform.
Suspected state-linked campaign exploits VMware vCenter for persistent access
VMware vCenter Syslog Server · Virtualization management · Unauthenticated RCE, CVE-2026-59310
- CVE-2026-59310 is a critical directory-traversal flaw in the vCenter Syslog server, rated 9.8, that lets an unauthenticated attacker with network access execute arbitrary code. Broadcom disclosed it and shipped an emergency patch on July 29.
- Incident-response firm QUIRSO reported that exploitation began on August 3, five days after disclosure, and identified 361 victim IP addresses across 47 countries by August 7. Germany, the United States, Turkey, Iran, and France accounted for 185 of them.
- After exploitation, the attacker deploys the open-source reverse_ssh tool through a malicious cron job to establish persistence and an outbound command-and-control channel that can bypass firewalls.
- QUIRSO assessed with moderate confidence that a Chinese-speaking threat actor is behind the campaign, based on time-zone and language artifacts, while cautioning that firm attribution is not established. Coverage tying the activity to a suspected China-nexus group continued into August 17.
What happened
vCenter is the control plane for an organization's virtual infrastructure, which is why it is a perennial target: control it and you can reach the virtual machines, hosts, and permissions beneath it. This campaign moved fast, from a July 29 disclosure to active exploitation on August 3 and hundreds of compromised systems within a week, and the attacker's choice of a reverse SSH channel is a deliberate move to keep quiet, persistent access rather than to smash and grab. The suspected state alignment matters less than the mechanics for most defenders. What stands out is the speed and the target selection: an unauthenticated flaw in a management plane, weaponized before many organizations had scheduled the patch. We are attributing the state-nexus assessment to QUIRSO and treating it as a working hypothesis, not a settled fact.
Evidence
- BleepingComputer: Critical VMware vCenter RCE flaw exploited for reverse SSH access
- The Hacker News: Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
What this means for your team
A compromised vCenter is not one server; it is leverage over everything that runs on top of it, which is why an attacker willing to invest in stealthy persistence is a worse problem than a ransomware crew that announces itself. Because the campaign uses a legitimate open-source tool for its command-and-control, signature-based detection will miss it, and the same YARA rule that catches the malicious use will also flag sanctioned use of reverse_ssh in your environment. That ambiguity is the point: defenders need to know where reverse SSH is expected before they can spot where it is not. Any organization that left vCenter reachable and unpatched through early August should treat this as a hunt, not a patch.
- Confirm vCenter is updated to a fixed build (9.1.0.0300, 9.0.2.0100, or 8.0 U3k/U2f) and is not reachable from untrusted networks.
- Run QUIRSO's reverse_ssh YARA rule and review cron jobs and outbound connections on vCenter hosts, first establishing where legitimate SSH tooling is expected so alerts are meaningful.
- If any instance was exposed and unpatched before early August, scope it as a potential intrusion and check for persistence rather than assuming the later patch closed the door.
France's tax authority discloses breach of 678,000 people and businesses
DGFiP · Public sector · Stolen credentials and MFA bypass, no software exploit
- France's General Directorate of Public Finances (DGFiP) says an intrusion exposed data on 678,000 individuals and professionals. SecurityWeek reported the figure as 680,000; the exact number in the DGFiP statement is 678,000.
- The attacker gained access using valid login credentials and an MFA bypass technique, not a software vulnerability. DGFiP suspended the affected accounts once the intrusions were detected.
- Exposed data includes reference tax income, family quotient, and withholding tax rate for individuals, and company name and SIREN number for businesses, along with cadastral data such as addresses and property sizes.
- DGFiP says online tax portals were not compromised and that usernames and passwords were not taken. It has notified France's data protection authority, CNIL, and is working with the ANSSI cybersecurity agency.
What happened
The breach surfaced when an actor using the handle "ZeroBytes" claimed the intrusion on a cybercrime forum and listed a database for sale, prompting DGFiP's investigation. The agency's account is careful: it says access was gained through credentials and an MFA bypass, that it suspended those accounts, and that deeper analysis since August 12 established that data on 678,000 people and businesses had been consulted and extracted before the access was cut off. ZeroBytes has made far larger claims, saying the portal held data on roughly 20 million citizens and that they extracted 252,149 records covering more than two million people, but those numbers are the attacker's and are not confirmed by DGFiP. This is the latest in a run of incidents affecting French government systems this year.
Evidence
- Help Net Security: France's tax authority admits hackers made off with data on 678,000 individuals
- BleepingComputer: French tax authority data breach affects 678,000 individuals
What this means for your team
The most instructive detail is what did not happen: no zero-day, no unpatched server, just a working login and a way around multi-factor authentication. That should reframe how much of your defensive budget assumes the threat arrives as an exploit. An MFA bypass, whether through phishing-resistant gaps, session-token theft, or social engineering of a help desk, turns strong-on-paper authentication into a single point of failure. For any organization holding sensitive records for large populations, this case argues for watching how privileged and contractor accounts actually behave after login, because the controls at the door held up right until they did not.
- Review your MFA implementation for bypass paths, prioritizing phishing-resistant methods for high-value systems and tightening help-desk identity verification.
- Monitor for anomalous behavior after authentication, such as bulk data access or unusual query volumes, so a valid-but-stolen session is caught in use.
- Audit contractor and third-party accounts with access to sensitive data stores, confirming least privilege and prompt deprovisioning.
Also notable
- Cryptocurrency wallet maker SafePal is warning roughly 40,000 customers of a data breach that exposed order information after a flaw was exploited. SecurityWeek
- Attackers are exploiting a recent macOS Screen Sharing vulnerability to deploy a Monero cryptocurrency miner on compromised Macs. BleepingComputer
- A threat actor claims to have stolen 3.6 million Azure account records from major companies, part of a broader Azure data-theft campaign researchers are tracking. BleepingComputer
- Pokemon Center disclosed a data breach that exposed customer information and forced the cancellation of some orders. BleepingComputer
FAQ
What is CVE-2026-12569 and who is affected?
It is a critical improper input validation vulnerability in PTC Windchill and FlexPLM that the Clop gang is exploiting on internet-exposed instances to steal data. PTC says more than 30,000 organizations use its products across aerospace, defense, automotive, heavy machinery, retail, and medtech. Patches have been available since June 17.
Have Shell, GE, and Philips confirmed the Clop breach?
Philips confirmed a contained breach of one enterprise server with no customer impact. GE and Shell say they are investigating and have not confirmed Clop's specific claims, including the 43-victim count and the 89 gigabytes attributed to Shell, which remain the gang's assertions.
How urgent are the SAP Commerce Cloud and VMware vCenter flaws?
Both are being exploited in the wild within days of disclosure. SAP Commerce Cloud (CVE-2026-58231, CVSS 10) was targeted three days after its August 11 patch, and VMware vCenter (CVE-2026-59310, CVSS 9.8) has been exploited since August 3 across dozens of countries. Patch both on an emergency basis and check for compromise.
How did the French tax authority breach happen?
DGFiP says the attacker used valid login credentials and an MFA bypass, not a software exploit. Data on 678,000 individuals and businesses was extracted, including tax and cadastral information, but DGFiP says the online portals, usernames, and passwords were not compromised.
Is the VMware vCenter campaign confirmed to be a Chinese state operation?
No. Incident-response firm QUIRSO assessed with moderate confidence that a Chinese-speaking actor is responsible, based on time-zone and language artifacts. That is a working hypothesis, not a confirmed attribution, and should be treated as such.
Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.
Comments