The most urgent threat this week is an active data extortion campaign by the Cl0p ransomware group targeting internet-exposed PTC Windchill and FlexPLM systems with an unauthenticated RCE.

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Details

Affiliates of the Cl0p ransomware group are actively exploiting a vulnerability chain in PTC products. Attackers combine a pre-authentication information disclosure flaw in the FlexPLM WSDL endpoint with a server-side vulnerability in the Windchill login servlet to achieve unauthenticated remote code execution.

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

Details

Working proof-of-concept exploit code has been publicly released for a remote code execution vulnerability in GitLab. Any authenticated user who can push to a project can achieve RCE by committing a specially crafted Jupyter notebook and opening its commit diff, which triggers the exploit.

[CRITICAL] "Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available"

Details

A critical remote code execution vulnerability exists in Alibaba's Fastjson 1.x library. In affected Spring Boot applications, an unauthenticated attacker can send a malicious JSON request to execute arbitrary code with the privileges of the Java process. There is currently no patch available for the 1.x branch.

Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable

Details

A novel malvertising campaign named SourTrade avoids detection by sending malware in fragments. Malicious JavaScript on fake landing pages for brands like TradingView and Solana instructs the victim's web browser to assemble the final executable in memory using a legitimate Bun runtime as a base.

ShinyHunters data leaks fuel $2,000 sextortion email scam

Details

Threat actors are using email addresses and potentially old passwords exposed in previous data breaches, notably those leaked by the ShinyHunters group, to conduct large-scale sextortion campaigns. The emails threaten to release compromising material unless a $2,000 Bitcoin payment is made.