[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (PTC Trust Center update Nov 11, 2026, 10:30 AM ET; CVE record); CVSS 4.0 9.2; PTC hasn't said it is exploited

PTC patches a new critical Windchill and FlexPLM deserialization RCE (CVE-2026-126325), five months after Cl0p exploited the last one

  • Do now: a Windchill administrator applies CS483249; keep Windchill/FlexPLM off the internet or behind VPN.
  • Check anyway: reuse the CVE-2026-12569 hunting PTC published: POSTs to new JSP files under /Windchill/login/ (16 or 6 hex-character names, dpr_ prefixes, ?cmd=whoami/id) and unexpected child processes of the Windchill service.
  • PLM servers hold CAD models and product IP, which is what the June-July extortion campaign took.

Sources: PTC Trust Center: Remote Code Execution Vulnerability in Windchill and FlexPLM (update Nov 11, 2026, 10:30 AM ET) · CVE-2026-126325 record (OpenAdvisories mirror of the PTC CNA entry) · The Hacker News: PTC Patches Critical Windchill and FlexPLM Flaw (Nov 12, 2026)