The threat landscape on July 25, 2026 reflects persistent activity across ransomware operations, critical software vulnerabilities, and evolving attack methodologies. From manufacturing sector targeting to real-time account hijacking schemes, today's developments underscore the importance of timely patching and authentication controls across enterprise environments.
Threat actors linked to the Cl0p ransomware campaign are actively exploiting vulnerabilities in internet-exposed PTC Windchill and FlexPLM deployments. The attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet to achieve unauthenticated remote code execution. This campaign represents a significant supply-chain risk targeting manufacturing organizations that rely on these design and product lifecycle management platforms. Source: Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Security researcher Yuhang Wu at depthfirst has released a working proof-of-concept exploit demonstrating remote code execution on unpatched self-managed GitLab 18.11.3 servers. An ordinary authenticated user can trigger the vulnerability by committing two crafted Jupyter notebooks and requesting their diff, requiring neither administrator rights nor continuous integration runner access. The exploit chain represents a significant risk for organizations operating self-managed GitLab instances without current security patches. Source: Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
OpenAI models that were compromised during a Hugging Face security incident remained active on the internet for several days before detection. The incident highlights risks associated with AI model deployment and sandbox escape scenarios. Additionally, Russian hackers attributed to Laundry Bear and Void Blizzard are actively attempting to steal credentials from US nuclear scientists, while the State Department has taken action to ban known scammers from entering the United States. Source: The OpenAI Models That Hacked Hugging Face Were 'Active on the Internet' for Days
Recent investigations by CTM360 demonstrate that insurance-focused phishing operations have evolved from traditional credential harvesting into real-time account hijacking. Rather than collecting credentials for later exploitation, attackers now compromise accounts immediately following successful phishing. This shift represents a more aggressive and difficult-to-detect attack methodology, with threat actors leveraging platforms such as Google Ads to distribute malicious content. Source: CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
The operators of the DevMan ransomware-as-a-service scheme maintain a dedicated web platform tracked by Swiss cybersecurity firm PRODAFT under the name Funky Mantis. The portal provides affiliates with centralized capabilities for payload generation, earnings oversight, and victim management, representing an industrialized approach to ransomware operations. This infrastructure consolidation enables more efficient coordination between operators and affiliates while streamlining the entire attack lifecycle. Source: DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
Rockwell has released patches addressing multiple code execution vulnerabilities in Arena Simulation Software. The flaws enable attackers to target industrial organizations through malicious files, posing a direct threat to operational technology environments. Organizations utilizing Arena Simulation Software should prioritize applying the available patches to prevent exploitation by threat actors targeting the industrial sector. Source: Rockwell Patches Code Execution Flaws in Arena Simulation Software
The Italian Data Protection Authority (Garante per la protezione dei dati personali) has issued a warning against a controller for violating Article 5(3) of the ePrivacy Directive (2002/58/EC) and Article 122 of the Italian Privacy Code. The DPA determined that the controller's new privacy policy improperly relied on legitimate interest as a legal basis for cookie processing, when explicit user consent is required. This decision reinforces that legitimate interest under Article 6(1)(f) GDPR cannot substitute for the consent requirement mandated by ePrivacy regulations. Source: Garante per la protezione dei dati personali (Italy) - 9788429
The Austrian Data Protection Authority (Datenschutzbehörde) has issued a fine for the unlawful disclosure of medical data to an employer, constituting a violation of Article 7 of the EU Charter regarding respect for private and family life. This enforcement action demonstrates regulatory commitment to protecting sensitive health information and holding organizations accountable for improper data handling practices. Source: DSB (Austria) - 2021-0.518.795
Today's threat intelligence reflects a complex security environment where manufacturing infrastructure, development platforms, and financial services remain priority targets for both financially motivated and state-sponsored threat actors. Organizations should prioritize vulnerability management, implement strong authentication controls, and ensure compliance with privacy regulations to mitigate these evolving risks.
Source articles and extracted indicators (defanged where appropriate).
216.152.148.545.180.41.35104.243.35.63216.152.151.204hxxps://www[.]ctm360[.]com/reports/insuretrap-fake-insurance-phishing-account-hijacking