All Articles

TL;DR for CISOs: A working exploit is now public for a remote code execution flaw in self-managed GitLab, and the fix shipped in June with no CVE and no security advisory, so CVE-driven patch programs likely missed it. Alongside it, the Clop extortion campaign against internet-exposed PTC Windchill and FlexPLM has escalated into a coordinated advisory with fresh indicators, and parcel carrier OnTrac began notifying customers of a network breach.

Public exploit runs code as git on unpatched self-hosted GitLab

What happened

A researcher at depthfirst released a proof-of-concept that runs commands as the git service account on an unpatched self-managed GitLab server. The trigger is ordinary: an authenticated user commits two crafted Jupyter notebooks to a project and requests the commit diff. GitLab passes the repository-controlled notebook JSON to the Oj parser inside a long-lived worker process, and a pair of memory-safety bugs in that parser are chained so that one corrupts a callback pointer while the other leaks a heap address to defeat memory-layout randomization. The chain needs no administrator rights, no CI runner access, no interaction from a victim, and no access to another user's project.

Because the code runs as git, its reach depends on how the deployment is isolated, but it can extend to source code, application secrets, service credentials, CI/CD data, and internal services the application can reach. The underlying flaws sit in Oj, a widely used Ruby JSON parser, and had persisted for years before depthfirst reported them in May. GitLab confirmed the chain in June and released fixed versions on June 10. A review of those release notes found the security fix folded into the general bug-fix list with no CVE identifier, no CVSS score, and no description of the code execution risk.

Evidence

Two independent, verified sources:

• The Hacker News: Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
• depthfirst: Achieving GitLab RCE via two Ruby memory-corruption vulnerabilities (researcher disclosure)

What this means for your team

The governance lesson is larger than the bug. A remote code execution fix reached customers with no CVE, no score, and no advisory language, which means any patch program that prioritizes strictly off scored vulnerability feeds would have treated this as an optional minor upgrade. Self-hosted developer platforms deserve the same patch discipline you apply to an internet-facing appliance, and that discipline has to read vendor release notes and dependency changes, not only the CVE stream. The second point is scope: "authenticated user" is a low bar in most engineering organizations, where any developer or contractor with push access to a single project meets it. If you run self-managed GitLab, this is a same-week upgrade, not a next-cycle one, and our earlier Breach Watch editions on active exploitation show how fast a public proof-of-concept turns into scanning.

Clop's PTC Windchill and FlexPLM extortion escalates with a coordinated advisory

What happened

Attackers are chaining a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet to reach unauthenticated remote code execution, then dropping hex-named JSP web shells under the /Windchill/login/ path. From that foothold they enumerate the file system, stage engineering and design data, and run double-extortion data theft, with extortion emails sent to hundreds of users inside a victim organization from previously compromised accounts. PTC began releasing patches on June 17, warned customers of heightened threat activity on June 26, and Germany's Federal Office for Information Security contacted customers directly to press them to patch.

This is a continuation of a campaign we have tracked over the past several days, but the picture has hardened: ReliaQuest confirmed active exploitation, and the joint advisory from Ransom-ISAC, eCrime.ch, and DEFUSED gives defenders concrete indicators to hunt on. The pattern fits Clop's established approach of breaking into one widely deployed enterprise platform at scale, as seen in its campaigns against MOVEit Transfer, Cleo, and Oracle E-Business Suite, then extorting the organizations whose data it steals.

Evidence

• BleepingComputer: Clop ransomware targets Windchill, FlexPLM in data theft attacks
• The Hacker News: Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

What this means for your team

Product lifecycle management systems hold the designs, bills of material, and supplier data that define a manufacturer, yet they rarely sit in the same risk conversation as email, ERP, or the VPN. This campaign is a reminder that an internet-exposed PLM platform is a data-theft target of the first order, and that a named crew with a track record of mass extortion is working it right now. If you run Windchill or FlexPLM, the question for your board is not whether the platform is important but whether it is exposed, patched, and monitored to the standard you would demand of any other crown-jewel system.

OnTrac tells customers hackers accessed their personal data

What happened

OnTrac notified customers that an attacker breached its corporate network and accessed files containing personal information over a three-day window in March. The company said it engaged a third-party specialist to scope the incident and took steps to, in its words, ensure the data was re-secured and not distributed. As BleepingComputer noted, that phrasing suggests a possible negotiated outcome with the attacker, though OnTrac has not confirmed a ransom, the number of affected people, or the full set of data elements involved. The company said it is not aware of any resulting fraud or publication of the stolen information.

Evidence

• BleepingComputer: OnTrac notifies customers of data breach after network hack
• Fox News: OnTrac data breach exposes 40,000 customers' personal information

What this means for your team

Two details are worth carrying into your own program. The first is the four-month gap between a March incident and a July notification. That is not unusual for a breach investigation, but it is a reminder that "no evidence of misuse" describes what the company can see, not the risk to the people whose birth dates and license numbers are now in someone else's hands. The second is the re-secured and not distributed language, which points toward a payment made to suppress a leak. Whether or not that happened here, it is a scenario your board should have a documented position on before it lands on your desk during an active incident.

Also notable

• The wp2shell WordPress Core exploit chain (CVE-2026-63030 and CVE-2026-60137) remains under active exploitation to install web shells and rogue admin accounts. Patch to 7.0.2, 6.9.5, or 6.8.6 and inspect the /wp-content/cache/ directory. BleepingComputer
• SonicWall SMA1000 flaws were exploited as zero-days for weeks to deliver custom malware before a patch was available. BleepingComputer
• A critical Palo Alto Networks GlobalProtect VPN flaw is now being exploited by the Qilin ransomware group, so treat unpatched internet-facing gateways as urgent. BleepingComputer

FAQ

Is there a CVE for the GitLab remote code execution flaw?

No. GitLab shipped the fix on June 10 as a dependency update (Oj 3.17.3) listed under bug fixes, with no CVE identifier, no CVSS score, and no security advisory describing the code execution risk. That is why teams relying only on scored vulnerability feeds may have missed it.

Which GitLab versions are affected and which are fixed?

Self-managed Community and Enterprise Edition are affected across 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. The fixed releases are 18.10.8, 18.11.5, and 19.0.2. GitLab.com was patched by June 10 and GitLab Dedicated needs no action.

Is the GitLab flaw being exploited in the wild?

As of July 24, the researcher who published the proof-of-concept said it was not aware of in-the-wild exploitation. A public exploit exists, which historically shortens the time to opportunistic scanning, so treat patching as time-sensitive.

How do I check for the Clop PTC Windchill and FlexPLM activity?

Look for hex-named JSP web shells under the /Windchill/login/ path, and check network and mail logs against the four published indicator IP addresses and the extortion sender support@cryptohox.com. CVE-2026-12569 carries a CVSS score of 9.3 and is in the CISA Known Exploited Vulnerabilities catalog.

What should CISOs prioritize from this edition?

Upgrade self-managed GitLab and patch or isolate internet-exposed PTC Windchill and FlexPLM. Both are decisions you control today. Then review whether OnTrac or LaserShip handles your logistics data and align your notification posture.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.