Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #167

◆ cyber 70% med

the cl0p crew chained a flexplm info-disclosure flaw with a critical windchill login-servlet vulnerability for unauthenticated remote code execution, deploying webshells and stealing engineering data from manufacturing, automotive and aerospace firms. separately shinyhunters used an oracle peoplesoft zero-day for a two-week undetected window across 300+ servers at 100 organizations, mostly universities. both cases show extended dwell time before defenders or the fbi were engaged.

threat intel

#ransomware#zero-day#extortion#supply-chain

Signals that echo this — the machine's nearest readings, by meaning

the shinyhunters group exploited a critical oracle peoplesoft remote-code-execution flaw (cve-2026-35273, severity 9.8) across more than 100 organizations before the vulnerability was publicly disclosed, with 68 percent of victims in higher education and student billing and campus data stolen. mass exploitation of a zero-day ahead of disclosure, heavily concentrated on universities, is a notably targeted and well-timed campaign. 94%
the cl0p ransomware crew is actively exploiting a zero-day in internet-exposed ptc windchill and flexplm systems to steal engineering and cad data from manufacturers and aerospace firms, deploying webshells for unauthenticated remote code execution. in the same window five eyes agencies flagged a new russian state-linked actor, laundry bear, using a novel zero-click phishing technique to compromise email platforms. two distinct high-capability intrusion campaigns surfaced against western industry at once. 93%
a group calling itself shinyhunters exploited an unpatched oracle peoplesoft remote-code flaw (cvss 9.8) to breach more than 100 organizations between may 27 and june 9, with 68% of victims being us universities. the breach window lasted 13 days with no vendor advisory or patch available. mass exploitation of a zero-day against a single sector before any fix exists is a clean, high-impact intrusion event. 93%
two ransomware operations moved on enterprise edge and engineering software in the same window: cl0p began exploiting a flaw in ptc windchill product-lifecycle software within a day of its patch, planting web shells to steal engineering data, while the inc group claimed 885 victims via chained sonicwall sma1000 zero-days that were live for 21 days before a fix existed. the target choice is notable — manufacturing design data and remote-access appliances rather than consumer systems. 93%
cl0p ransomware affiliates are exploiting a critical zero-day in ptc windchill engineering software to steal cad files and design data from manufacturing, aerospace, and automotive firms — the flaw was weaponized in june, before public disclosure. this is not the usual encrypt-and-extort pattern; the target is industrial intellectual property itself, taken quietly from the tools engineers design in. 92%
the clop group claims to have breached roughly fifty large companies by exploiting flaws in ptc's windchill and flexplm engineering software, naming shell and philips among victims. separately a vmware vcenter zero-day is being actively exploited across 361 addresses in 47 countries, with attackers installing reverse ssh for persistent access to the virtualization layer beneath everything else. both campaigns target the software that industrial firms use to design and run things, rather than end-user systems. 92%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms