Daily Threat Briefing
← All briefings

PTC Windchill PLM platform and FlexPLM · All Go applications using golang.org/x/crypto

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-26 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

Two new CISA KEV entries demand immediate attention: CVE-2026-12569 (PTC Windchill/FlexPLM, unauthenticated RCE) and CVE-2026-20230 (Cisco Unified CM SSRF, file-write to root) — both with a patch deadline of 2026-06-28. A critical batch of golang.org/x/crypto/ssh vulnerabilities (CVSS 9.1-10.0) was published, affecting any Go application using the SSH library below version 0.52.0. Turla’s STOCKSTAY .NET backdoor has been newly detailed by Google Threat Intelligence, with confirmed targeting of government and military entities.

CRITICAL VULNERABILITIES

NEW

CVE-2026-12569 (PTC Windchill and FlexPLM)

  • Affected products: PTC Windchill PLM platform and FlexPLM (all versions with network exposure)
  • Severity: CVSS not yet formally published; CISA KEV confirmed
  • EPSS: Not yet available
  • Technical detail: An unauthenticated remote attacker can send a malicious network request exploiting improper input validation (CWE-20) and unsafe deserialization (CWE-502) to achieve arbitrary code execution. No authentication is required, making this exploitable from any network-reachable position. Windchill is widely deployed in manufacturing, aerospace, and defense supply chains; FlexPLM is used in retail and apparel product lifecycle management. Compromise of these systems can expose sensitive product design data and provide a pivot point into enterprise networks.
  • Exploitation status: Actively exploited in the wild; added to CISA KEV 2026-06-25.
  • Remediation: Apply PTC patches immediately. CISA BOD 26-04 deadline for federal agencies is 2026-06-28. Restrict Windchill and FlexPLM network interfaces to trusted hosts pending patching. Review access logs for anomalous unauthenticated requests.

golang.org/x/crypto/ssh — Multiple Critical Vulnerabilities (CVE-2026-46595, CVE-2026-42508, CVE-2026-39830 through CVE-2026-39834)

  • Affected products: All Go applications using golang.org/x/crypto below version 0.52.0
  • Severity: CVE-2026-46595 CVSS 10.0; CVE-2026-42508 CVSS 9.1; CVE-2026-39830/39831/39832/39833/39834 CVSS 9.1
  • EPSS: CVE-2026-46595 EPSS 0.39; CVE-2026-39834 EPSS 0.47; CVE-2026-39830 EPSS 0.39; CVE-2026-39832 EPSS 0.40
  • Technical detail: Seven vulnerabilities were published simultaneously against the Go SSH library. CVE-2026-46595 (CVSS 10.0) allows VerifiedPublicKeyCallback to skip permission enforcement entirely, enabling authentication bypass. CVE-2026-42508 allows revoked host keys marked @revoked in known_hosts to remain trusted, bypassing revocation checks. CVE-2026-39831 permits bypass of FIDO/U2F physical presence checks. CVE-2026-39832/39833 affect the SSH agent, failing to enforce key constraints when forwarding keys. CVE-2026-39834 causes an infinite loop on large channel writes, enabling denial of service. The breadth of this batch — spanning auth bypass, key management, and DoS — means any Go application using SSH for automation, CI/CD, or remote management is potentially affected. The library is embedded in a large number of open-source and enterprise tools.
  • Exploitation status: No confirmed in-the-wild exploitation; EPSS scores up to 0.47 indicate elevated risk.
  • Remediation: Update golang.org/x/crypto to version 0.52.0 or later in all Go projects. Audit dependency trees (go.mod/go.sum) for transitive inclusion. Prioritize internet-facing services and CI/CD pipelines using SSH.

STATUS CHANGE

CVE-2026-20230 (Cisco Unified Communications Manager)

  • Status change: Added to CISA KEV 2026-06-25 with patch deadline 2026-06-28. Previously reported as ONGOING. Heise Security confirmed active attacks observed in the wild. The SSRF flaw allows unauthenticated file writes to the underlying OS, enabling subsequent root escalation.
  • Action: Patch by 2026-06-28. Isolate Unified CM management interfaces immediately if patching cannot be completed in time.

ONGOING

  • CVE-2026-20245 (Cisco Catalyst SD-WAN Manager): zero-day, actively exploited; audit for rogue root accounts, apply patches.
  • CVE-2026-39955/39938/39893 (Cacti): CVSS 9.8 unauthenticated SQLi/LFI; upgrade to 1.2.31.
  • CVE-2026-52806/52813 (Gogs): CVSS 9.9/10.0 authenticated RCE and path traversal; upgrade to 0.14.3.
  • CVE-2026-13038/13032/13028 (Google Chrome): use-after-free and Android sandbox escape; update to 149.0.7827.197.
  • CVE-2026-46423/45689/55666 (Rocket.Chat): SAML/auth bypass CVSS 9.1-9.3; upgrade to patched branch release.
  • CVE-2026-20262 (Cisco Catalyst SD-WAN Manager): actively exploited; CISA KEV deadline 2026-06-29.
  • CVE-2026-34910/34909/34908 (Ubiquiti UniFi OS): CISA KEV deadline was 2026-06-26 — verify patching is complete.
  • CVE-2025-67038 (Lantronix EDS5000): CISA KEV deadline was 2026-06-26 — verify patching is complete.

EUROPEAN ADVISORIES

BSI published a new batch of advisories on 2026-06-25. New advisories (NEU) include:

WID-SEC-2026-2072 (Red Hat OpenShift — hoch): Multiple vulnerabilities enabling arbitrary code execution and information disclosure. Apply Red Hat OpenShift updates.

WID-SEC-2026-2079 (RabbitMQ — hoch): Multiple vulnerabilities allowing denial of service, security bypass, data manipulation, and information disclosure. Apply RabbitMQ updates; relevant for organizations using RabbitMQ as a message broker in enterprise or cloud environments.

WID-SEC-2026-2077 (Linux Kernel — hoch): Multiple new kernel vulnerabilities enabling security bypass, denial of service, and unspecified impacts. Apply distribution kernel updates.

WID-SEC-2026-2074 (Jenkins Plugins — hoch): Multiple vulnerabilities in Jenkins plugins allowing arbitrary code execution, security bypass, and data manipulation or disclosure. Audit installed Jenkins plugins and apply available updates; relevant for CI/CD pipeline operators.

WID-SEC-2026-2071 (Google Chrome — hoch): Covered in Critical Vulnerabilities ONGOING (CVE-2026-13038 et al.).

WID-SEC-2026-2070 (GitLab CE/EE — hoch): Multiple vulnerabilities enabling security bypass, data manipulation, information disclosure, and XSS. Apply GitLab updates; relevant for organizations self-hosting GitLab.

WID-SEC-2026-2069 (ProFTPD — hoch, UNGEPATCHT): An authenticated remote attacker can bypass security controls and manipulate files. No patch is currently available. Restrict ProFTPD access to trusted users and networks as a mitigation.

WID-SEC-2026-2067 (n8n — hoch): Multiple vulnerabilities including SQL injection, security bypass, information disclosure, data manipulation, and denial of service. Apply n8n updates; relevant for organizations using n8n for workflow automation.

Updated advisories (UPDATE): Gogs (WID-SEC-2026-2013, WID-SEC-2026-1739 — kritisch), Oracle PeopleSoft (WID-SEC-2026-1881 — kritisch), IBM WebSphere Application Server (WID-SEC-2026-2001), PostgreSQL (WID-SEC-2026-1544), Mozilla Firefox/ESR/Thunderbird (WID-SEC-2026-1959), OpenSSL (WID-SEC-2026-1852), Atlassian suite (WID-SEC-2026-1955), and Linux Kernel Dirty Frag (WID-SEC-2026-1430) — apply outstanding patches per vendor guidance.

ACTIVE THREATS AND CAMPAIGNS

NEW — Turla STOCKSTAY Backdoor Google Threat Intelligence Group published detailed analysis of STOCKSTAY, a .NET backdoor continuously developed and deployed by the Russia-linked Turla group (also tracked as SUMMIT, Secret Blizzard, VENOMOUS BEAR) since at least December 2022. Confirmed targets include government and military organizations in Ukraine and entities with interest in Italian foreign policy. STOCKSTAY is used for ongoing cyber espionage and shares code characteristics with other Turla tooling. European government and defense-adjacent organizations should treat this as a relevant threat. IOCs are available in the GTIG publication.

NEW — CL-STA-1062 Targeting Southeast Asian Government and Critical Infrastructure Unit 42 published analysis of CL-STA-1062, a threat cluster targeting government entities and critical infrastructure in Southeast Asia for espionage purposes. The actor employs a hybrid toolkit including the custom TinyRCT backdoor. While geographically focused, the TTPs and tooling are relevant for European government and critical infrastructure defenders as a reference for similar espionage tradecraft.

NEW — Bluekit Phishing-as-a-Service: Browser-in-the-Middle Capability Added The Bluekit PhaaS platform has added browser-in-the-middle (BitM) functionality, enabling real-time credential and session token theft that bypasses MFA. Nearly 70 new hostnames were identified in the past week, indicating active scaling. Organizations should update proxy and DNS blocklists and enforce phishing-resistant MFA (FIDO2/passkeys) where possible.

NEW — Shopify Shop App Abused for Callback Phishing Threat actors are inserting fake purchase receipts into the Shopify Shop order-tracking app to lure victims into callback phishing flows, ultimately targeting credential theft or remote access tool installation. Relevant for organizations whose employees or customers use Shop for order tracking.

ONGOING — Operation Endgame (Amadey/StealC): infrastructure disrupted; check exposed credentials and rotate as needed. ONGOING — Mistic Backdoor / KongTuke IAB: targeting insurance, education, IT, and professional services; monitor for unusual persistence. ONGOING — Malicious Edge extension (Edgecution): Native Messaging API abuse for ransomware delivery; enforce extension allowlisting. ONGOING — FortiBleed credential-harvesting campaign: rotate all credentials on FortiGate-connected systems.

SECURITY NEWS AND CONTEXT

A popular Chrome ad-blocking extension for YouTube (Adblock for YouTube, 10M+ installs, Chrome Web Store Featured badge) was found to contain dormant arbitrary JavaScript execution capability, raising supply-chain concerns for enterprise browser fleets. Review and consider blocking this extension ID (cmedhionkhpnakcndndgjdbohmhepckk) pending further investigation.

A newly discovered Rust-based macOS implant dubbed Gaslight embeds prompt injection payloads designed to deceive AI-assisted malware analysis tools into aborting analysis — a novel anti-analysis technique relevant for SOC teams using AI-augmented triage workflows.

Polish authorities arrested four members of a SIM-swapping gang linked to millions in cryptocurrency theft, following telecommunications partner breaches and email account hijacking.

Microsoft has quietly extended free Windows 10 ESU support for consumers to October 2027, providing additional time for organizations still managing Windows 10 endpoints.

RECOMMENDED ACTIONS

  1. Patch PTC Windchill and FlexPLM immediately — CVE-2026-12569 is actively exploited; CISA KEV deadline 2026-06-28. Restrict network access pending patching.
  2. Patch Cisco Unified CM for CVE-2026-20230 by 2026-06-28 — actively exploited SSRF with file-write-to-root path; isolate management interface if patching is delayed.
  3. Update golang.org/x/crypto to 0.52.0 in all Go projects — audit go.mod/go.sum for transitive dependencies; prioritize internet-facing and CI/CD SSH-using services.
  4. Verify Ubiquiti UniFi OS and Lantronix EDS5000 patching is complete — CISA KEV deadline was 2026-06-26.
  5. Apply Jenkins plugin updates — arbitrary code execution risk in CI/CD pipelines (WID-SEC-2026-2074).
  6. Apply GitLab updates for newly published BSI advisory (WID-SEC-2026-2070); restrict ProFTPD access pending unavailable patch (WID-SEC-2026-2069).
  7. Block Chrome extension ID cmedhionkhpnakcndndgjdbohmhepckk (Adblock for YouTube) via enterprise browser policy pending investigation.
  8. Review Turla STOCKSTAY IOCs from GTIG publication; apply to SIEM and EDR for government and defense-adjacent environments.
  9. Enforce phishing-resistant MFA (FIDO2/passkeys) to counter Bluekit BitM credential theft capability.
  10. Continue remediation of previously reported items: CVE-2026-20245 (Cisco SD-WAN zero-day), CVE-2026-20262 (Cisco SD-WAN KEV deadline 2026-06-29), Cacti CVE-2026-39955/39938/39893, Gogs CVE-2026-52806/52813, Chrome CVE-2026-13038, Rocket.Chat auth bypass, Operation Endgame credential rotation, FortiBleed credential rotation.