Cl0p Ransomware Exploits Critical Vulnerability in PLM Software, Compromising 40+ Firms

The Cl0p ransomware group has exploited a critical vulnerability, CVE-2026-12569, in PTC Windchill, affecting over 40 industrial companies, including Shell, Philips, and key Apple suppliers. This attack involved mass exploitation tactics, allowing Cl0p to simultaneously compromise multiple organizations by targeting widely used enterprise software. The vulnerability was published on June 18, 2026, and was added to the CISA KEV list for active exploitation on June 25, 2026. The attack highlights the ongoing threat posed by ransomware groups leveraging critical software flaws to steal sensitive engineering data. The situation remains urgent as organizations scramble to assess and mitigate the impact of this breach.

Key Points: • Cl0p exploited CVE-2026-12569 in PTC Windchill, affecting over 40 companies. • The attack involved mass exploitation tactics targeting widely used enterprise software. • Sensitive engineering data from major firms like Shell and Philips was compromised.