Cl0p just named Shell and Philips as ransomware victims — a bug with no login let them in

Cl0p has named 40+ organizations, including Shell, Philips, Fiserv, Zebra Technologies, Toast, Ingersoll Rand, Mindray, and Largan Precision.

The flaw, CVE-2026-12569 (CVSS 9.3), is the first PTC Windchill vulnerability ever exploited in the wild.

The exploit chains a pre-authentication information-disclosure bug in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, giving unauthenticated remote code execution.

Attackers dropped hex-named JSP webshells under /Windchill/login/ and, in some cases, mapped and decrypted the entire Windchill keystore.

PTC began shipping patches on June 18, 2026; CISA added the bug to its Known Exploited Vulnerabilities catalog the same month.

Worth saying plainly

Public naming is the pressure tactic, not an afterthought. Cl0p profits more from a company paying quietly than from the leak itself, and a public list with recognizable brands on it is designed to…