Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return

Part of the CVE-2026-12569 story · since 25 Jun

Quiet for 12 weekslast report 21 Aug11 articles5 outlets
25 Jun · CISA first12 Aug5 Sep29 SepNowThis article3rd of 11
  • Thu 25 Jun, 22:21 UTC. CISA, first report. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 03:31 UTC. SecurityOnline, its first report on the story. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV. This article, 3rd of 11.
  • Fri 26 Jun, 06:19 UTC. CISA. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 08:31 UTC. SecurityWeek, its first report on the story. PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 11:31 UTC. Security Affairs, its first report on the story. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Fri 24 Jul, 12:51 UTC. DataBreaches, its first report on the story. Clop ransomware hits Windchill via CVE-2026-12569 flaw. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 13:31 UTC. SecurityWeek. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 11:32 UTC. SecurityWeek. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign. Cites a CVE in CISA KEV.
  • Fri 21 Aug, 08:20 UTC. Security Affairs. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips. Cites a CVE in CISA KEV.

The content reports on two active vulnerabilities detected today: CVE-2026-12569 affecting PTC Windchill and FlexPLM due to improper input validation, and CVE-2026-20230 linked to a server-side request forgery vulnerability in Cisco Unified Communications Manager.

Furthermore, discussions have emerged regarding the potential return of Claude Fable 5, following a glitch that led many users to believe it was accessible. Anthropic confirmed this was a UI issue and clarified that Claude Fable 5 remains unavailable for use. Despite this, hints of a possible resurgence have arisen, particularly with Amazon AWS reintroducing the model into its platform, although an official launch timeline is not yet disclosed.

How the story developed

All 11 articles
Quiet for 12 weekslast report 21 Aug11 articles5 outlets

11 articles from 5 outlets since 25 Jun. Quiet since 21 Aug. This was the 3rd report, 7 hours after the first.

Now25 Jun23 Jul2825811141721First reportCISA · 25 Jun, 22:21
  • Thu 25 Jun, 22:21 UTC. CISA, first report. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 03:31 UTC. SecurityOnline, its first report on the story. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV. This article, 3rd of 11.
  • Fri 26 Jun, 06:19 UTC. CISA. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 08:31 UTC. SecurityWeek, its first report on the story. PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 11:31 UTC. Security Affairs, its first report on the story. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Fri 24 Jul, 12:51 UTC. DataBreaches, its first report on the story. Clop ransomware hits Windchill via CVE-2026-12569 flaw. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 13:31 UTC. SecurityWeek. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 11:32 UTC. SecurityWeek. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign. Cites a CVE in CISA KEV.
  • Fri 21 Aug, 08:20 UTC. Security Affairs. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 11 articles as a list
  1. Thu 25 JunDay 01
    1. Critical PTC Windchill flaw CVE-2026-12569 under active attack22:21 · CISA · official · First report · CISA alert · Known exploited CVE
  2. Fri 26 JunDay 16
    1. Cisco and PTC flaws under active attack, CISA adds to KEV list03:31 · SecurityOnline · Known exploited CVE
    2. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return05:40 · SecurityOnline · Known exploited CVE · This article, 3rd of 11
    3. Critical PTC Windchill flaw CVE-2026-12569 under active attack06:19 · CISA · official · Known exploited CVE
    Show 3 more from 26 Jun
    1. PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-1256908:31 · SecurityWeek · Known exploited CVE
    2. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list11:31 · Security Affairs · Known exploited CVE
    3. Cisco SD-WAN Zero-Day Exploited in Attacks14:21 · SecurityOnline · Known exploited CVE

  3. Quiet for 4 weeks

    Fri 24 JulDay 291
    1. Clop ransomware hits Windchill via CVE-2026-12569 flaw12:51 · DataBreaches · Picked up again · Known exploited CVE

  4. Quiet for 3 days

    Mon 27 JulDay 321
    1. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw13:31 · SecurityWeek · Picked up again · Known exploited CVE

  5. Quiet for 3 weeks

    Wed 19 AugDay 551
    1. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign11:32 · SecurityWeek · Picked up again · Known exploited CVE

  6. Quiet for 2 days

    Fri 21 AugDay 571
    1. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips08:20 · Security Affairs · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in