All Articles

TL;DR for CISOs: A public exploit now turns any ordinary Active Directory account into a domain controller through an AD CS flaw, while Clop runs a fresh data-theft extortion wave against internet-facing PTC Windchill systems and researchers detail how a single link could spawn a rogue ChatGPT agent inside your tenant.

Certighost: a public exploit turns any domain user into a domain controller

What happened

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 for a flaw they call Certighost. The chain lets a low-privileged Active Directory user request a certificate that identifies a domain controller and then authenticate as that machine. Because domain controller accounts hold directory replication rights, the resulting Kerberos credential can pull the krbtgt secret through DCSync, which is the practical definition of full domain compromise.

The weakness sits in an AD CS enrollment fallback known as a chase. When the certification authority cannot resolve an end entity on its own, the enrollment protocol lets the request name the directory server and machine object to contact. The researchers found the CA would follow the requester-supplied host over SMB and LDAP without first proving that host was a genuine domain controller, so an attacker running rogue listeners could feed the CA a domain controller's identity and have it signed into a certificate. In testing, a normal Domain Users account was enough, using a computer account created under the default machine-account quota of ten.

Microsoft addressed the issue on July 14 and classed it as improper authorization with a CVSS score of 8.8. Exploitation needs network access and a domain account but no administrator rights and no user interaction, which is what makes it dangerous in any environment with a large user population and an Enterprise CA on the default Machine template.

Evidence

Verified against two independent sources:
• The Hacker News, July 24, 2026
• Cyber Security News

What this means for your team

AD CS is one of the highest-value targets in an enterprise directory because a single mis-issued certificate can be laundered into domain dominance. The barrier here is a standard user credential, so phishing one help-desk account or reusing one already-compromised login is enough to start the chain. The absence of the flaw from the KEV catalog is not reassurance: a public exploit shortens the window between disclosure and opportunistic use, and quiet exploitation would not necessarily surface in reporting yet.

Clop runs a new extortion wave against PTC Windchill and FlexPLM

What happened

The Clop extortion group is hitting internet-exposed PTC Windchill and FlexPLM servers in a data-theft campaign. According to threat-intelligence firm ReliaQuest, attackers are exploiting CVE-2026-12569, an unsafe deserialization flaw rated CVSS 9.3, to gain unauthenticated remote code execution and drop JSP webshells that exfiltrate sensitive product records. ReliaQuest stopped short of naming the actor with certainty, noting the tradecraft matches earlier Clop operations. Affected organizations have begun receiving extortion emails from a fresh address the group is now using, consistent with its habit of rotating contact details before each wave.

Windchill and FlexPLM are product lifecycle management platforms used to design and track products through manufacturing. PTC reports more than 30,000 customers globally, including over 1,500 brand and retail customers on FlexPLM, and the systems are common across aerospace, defense, automotive, heavy machinery, retail, and medical technology. The urgency has been visible at the government level: after PTC warned of heightened threat activity, CISA added the flaw to its catalog and Germany's federal security office reportedly contacted customers overnight to push patching.

Evidence

Verified against two independent sources:
• BleepingComputer, July 24, 2026
• GBHackers on Security

What this means for your team

Clop's pattern is well established from MOVEit, Cleo, and Oracle E-Business Suite: find a single widely deployed enterprise platform, exploit it at scale, exfiltrate quietly, then pressure many victims at once. Product design and supply-chain data is exactly the kind of intellectual property that carries board-level consequences if leaked. Backups do not neutralize a double-extortion model, because the leverage is the stolen data, not the encryption.

AgentForger: one link could forge a rogue ChatGPT agent inside your tenant

What happened

Researchers at Zenity Labs disclosed a flaw in OpenAI's ChatGPT Workspace Agents that they call AgentForger. A crafted initialization link carried two over-permissive parameters: one selecting a powerful agent template and one supplying an initial prompt that the Agent Builder treated as instructions to execute. If a logged-in employee with an authorized connector clicked the link, the process could stand up a hidden autonomous agent that inherits the employee's connected applications, disables approval prompts, and accepts follow-up commands from the attacker by email. Because the victim had already authorized a connector, no new consent screen appeared. As Zenity's Michael Bargury put it, the result is less a forged request than a forged insider. OpenAI accepted the report and shipped a fix within days, and there is no indication the flaw was abused before the patch.

Evidence

Verified against two independent sources:
• SecurityWeek, July 23, 2026
• Zenity Labs research

What this means for your team

The specific bug is fixed, but the pattern is the point. Enterprise AI agents inherit real human identity and standing access to email, files, and collaboration tools, and a forged agent behaves like a trusted employee that existing controls were not designed to see. This belongs on the CISO agenda alongside identity governance, not filed under future risk. Our GenAI security community discussions keep returning to the same gap: agent creation and connector authorization are rarely inventoried.

Also notable

• The Golden Chickens malware-as-a-service operation resurfaced with four new malware families, a sign the crew is expanding rather than winding down. (The Hacker News)
• Chick-fil-A disclosed a data breach after credential-stuffing attacks reached customer accounts, a reminder that password reuse remains a durable entry point. (SecurityWeek)
• A new strain tracked as Dolphin X reportedly uses AI to rank high-value targets inside a compromised network. (BleepingComputer)
• Australian energy provider Origin said a data breach exposed client data, keeping critical-infrastructure suppliers in the spotlight. (BleepingComputer)

FAQ

What is Certighost and why does it matter?

Certighost is the researchers' name for CVE-2026-54121, an Active Directory Certificate Services flaw that lets a low-privileged domain account obtain a certificate impersonating a domain controller and reach full domain compromise. It matters because the entry requirement is only a standard user credential.

Is Certighost being exploited in the wild?

As of July 24, 2026, there was no confirmed in-the-wild exploitation and the flaw was not in the CISA KEV catalog. A full public proof-of-concept exists, so the risk of opportunistic use is real even without confirmed reports.

How urgent is the PTC Windchill vulnerability?

Urgent for any internet-exposed instance. CVE-2026-12569 allows unauthenticated remote code execution at CVSS 9.3, it is on the CISA KEV catalog, and Clop is actively exfiltrating data and sending extortion demands.

Does the AgentForger fix mean AI agents are now safe?

The specific flaw is patched, but the underlying exposure remains: enterprise AI agents inherit human identity and access. Treat agent creation and connector authorization as governed, logged actions.

Where can security leaders discuss these issues with peers?

The CISO Platform Breach Intelligence hub and the community's vendor-neutral taskforces are where practitioners compare notes on incidents like these.

Related community reading: Active Directory security discussions, ransomware playbooks and frameworks, and the daily Breach Watch archive.