Author: Gary Behan

A custom JavaServer Pages (JSP) web shell linked to the Clop ransomware gang and built specifically to target the Clop Windchill web shell attack surface has been analysed by cybersecurity company ReliaQuest, revealing a tool so tightly integrated with PTC Windchill’s internals that its malicious database queries can masquerade as normal application activity. The implant exploits CVE-2026-12569, a critical remote code execution vulnerability carrying a CVSS score of 9.8 according to Penligent, and has been deployed in active data theft campaigns against Windchill and FlexPLM servers.ReliaQuest shared its findings with BleepingComputer, describing the web shell as ‘an application-specific evolution of…

The Picus Blue Report 2026 puts a number on the gap between what your controls recognise and what they actually stop, and some of those numbers are genuinely difficult to read. Published by Picus Security, the report draws on more than 338 million attack simulations run in real customer environments between January and June 2026, making it one of the more substantive datasets the industry has produced on production-environment defence performance. The headline finding sounds encouraging at first: overall prevention effectiveness recovered from 62% to 69%, returning to its 2024 peak. Sila Ozeren Hacioglu, Security Research Engineer at Picus Security,…

Microsoft is rolling out a Windows File Explorer update to Windows 11 Insider preview builds that promises a faster, less cluttered right-click context menu, a more capable Address Bar, and a handful of quality-of-life fixes that should make day-to-day file management feel less like a chore. The changes are currently in testing and were detailed in a post on the Windows Insider Blog.What the Windows File Explorer Update Actually ChangesThe headline feature is the redesigned context menu. Microsoft says the new right-click menu reduces top-level clutter, keeps commonly used actions easy to reach, and is more customisable than what came…

Microsoft has completed the WMIC removal in Windows 11, pulling the legacy Windows Management Instrumentation Command-line tool from Windows 11 24H2 and 25H2 as well as from beta builds released this week. It is a tidy end to a years-long deprecation process, and one that closes off a toolkit that ransomware operators and other threat actors have leaned on heavily.A Slow Goodbye: The WMIC Deprecation TimelineWMIC has been on borrowed time for a while. Microsoft deprecated it in Windows Server 2012 (in 2016) and in Windows 10 21H1 (in 2021). With Windows 11 22H2 in 2022, the tool was converted…

A threat actor is advertising an Azure employee data breach campaign that allegedly netted 3.64 million records across nine major organisations, with McDonald’s, Tata Consultancy Services, and Vodafone among the named targets. The seller, operating under the alias ‘TheHatman’, began posting the alleged data dumps on 31 July and claims to have extracted the records directly from victims’ Microsoft Azure tenants using compromised credentials.The posts, active between 31 July and 16 August, offer separate databases for each organisation, each accompanied by a sample file for prospective buyers to verify the contents. The claimed data types are broadly consistent across targets:…

The GitHub outage on 17 August 2026 knocked out core services for developers worldwide, with error rates hitting around 20% across the platform’s web experience and API traffic, and climbing to approximately 50% for archive and raw repository content downloads. What began as a performance investigation became a rolling, multi-hour incident that eventually pulled Copilot into its scope. How the GitHub outage August 2026 unfolded According to Dev.to, the outage started around 13:25 UTC. GitHub opened a critical-impact incident at 13:40 UTC, as reported by Digital Applied, meaning the platform itself acknowledged the severity within roughly 15 minutes of the…

The Clop ransomware PTC Windchill attacks have drawn in three more household names: General Electric, Philips, and Shell have all confirmed they are investigating claims by the Clop gang that it breached their systems and made off with sensitive data. The three companies join a batch of 43 newly listed victims on Clop’s leak site, all apparently caught by the same critical vulnerability in PTC’s enterprise software platforms.What GE, Philips and Shell Have Said So FarThe responses from the three companies range from cautious to slightly more forthcoming. A GE spokesperson said the company is aware of the claim and…

Microsoft has confirmed it is working on a ShieldBreak zero-day patch after the privilege escalation flaw in Microsoft Defender was publicly disclosed without warning late last week. The company has assigned the vulnerability CVE-2026-69414 and says a fix is coming, though no release date has been given.The researcher behind the disclosure goes by the handle Nightmare Eclipse. The flaw, which Nightmare Eclipse described as a bypass for an earlier Defender vulnerability called RoguePlanet, was shared alongside a working proof-of-concept (PoC) exploit. According to the researcher, local attackers with limited permissions can use the PoC to gain SYSTEM privileges on fully…

SafePal is warning customers of a SafePal data breach affecting approximately 39,798 people, after an authorisation flaw in its order-tracking system was exploited to lift customer order information, and a threat actor is now shopping the stolen records on a cybercrime forum.The exposed data includes names, email addresses, shipping addresses, phone numbers and purchase information for orders placed between 2 March 2025 and 11 April 2026. Crucially, the company says wallet seed phrases, private keys, passwords, bank account information, payment card numbers and government-issued identification numbers were not part of what was taken. ‘No evidence has been found that the…

A Threema DDoS attack disruption knocked the encrypted messaging service offline for much of Tuesday evening and into Wednesday morning this week, after a threat actor launched large-scale, sustained attacks that proved unusually difficult to defend against. In a post-mortem published on Friday, Threema confirmed the attacks had targeted both its own infrastructure and that of its colocation partner, Nine. Timeline of the Threema DDoS attack disruption Users started reporting service interruptions on Tuesday around 6 PM UTC. Threema initially responded about an hour later, pointing to what it described at the time as “a network outage on our colocation…