Patch Critical PTC Windchill Flaw; MS Extends Windows Hotpatch Support and Security Updates; Akrites Project Aims to Secure Critical OSS

Last week, the US Cybersecurity and Infrastructure Security Agency (CISA) added a critical improper input validation flaw in PTC Windchill and FlexPLM to the Known exploited Vulnerabilities (KEV) database. PTC Windchill is a product lifecycle management (PLM) platform for manufacturing environments; FlexPLM is a PLM platform for retail environments. The vulnerability, CVE-2026-12569, was added to the KEV on Thursday, June 25 with a mitigation deadline for Federal Civilian Executive Branch (FCEB) agencies of Sunday, June 28. On Monday, June 29, Help Net Security noted that "PTC’s advisory keeps getting updated with indicators of compromise and advice for defenders, confirming that attackers are dropping JSP webshells on vulnerable systems." PTC initially disclosed the flaw on June 17 and released a fix on June 18. At that time, Germany's Federal Office for Information Security (BSI) began contacting organizations in that country to warn them of active exploitation of the vulnerability and urge them to apply the patch. PTC's advisory includes suggested remediation steps as well as indicators of compromise. PTC eSupport is available to customers with established accounts.

Microsoft has announced that it will extend hotpatching for certain versions of Windows Server 2022 for a year. Hotpatches will now be available for Windows Server 2022 for specific versions through October 2027. Normally hotpatching ends on the mainstream end date, which for Windows Server 2022 is October 13, 2026; the product's extended end date is October 14, 2031. Microsoft writes, "Hotpatch update support for Windows Server 2022 Datacenter: Azure Edition has been extended through October 2027. Devices enrolled in Hotpatch updates will continue to receive monthly security updates without requiring a restart." Microsoft explains, "Because Hotpatches patch the in-memory code of running processes without needing to restart them, your applications aren't affected." Quarterly cumulative updates will still require a reboot. In a separate story, Microsoft has also extended security updates for Windows 10. Support for Windows 10 officially ended on October 14, 2025. At that time, users were offered an extended support package for a cost, business users were given the option to purchase three years of additional support, and consumers were the option to purchase one year of additional patches through October 13, 2026; that date has now been extended through October 12, 2027.

The Linux foundation has announced the formation of Akrites, a program whose mission is to centralize the disclosure and remediation of flaws in critical open-source software, such as the systems underpinning banks, hospitals, power grids, telecoms, governments, and AI labs. The effort comprises "a single, standardized Coordinated Vulnerability Disclosure (CVD) process operated by a shared Security Incident Response Team (SIRT), built on confidentiality-first principles and the industry’s established standards and tooling (CVE, TLP, CWE, CVSS, EPSS, SSVC, VEX)." Initial funding commitments have been made by Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone and Zscaler. One stated factor motivating the creation of Akrites is the use of AI by both attackers and defenders. A letter accompanying the announcement states that the success of the project "will be measured in patch deployment, not publication," including an emphasis on confidentiality, and that Akrites aims to prioritize helping with downstream security efforts as much as upstream coordination.

The US Federal Communications Commission (FCC) has approved new cybersecurity rules for the country's emergency alert systems and for undersea cables. The new rules for the Emergency Alert System (EAS) and Wireless Emergency Alerts (WEA) aim to protect the systems from being hijacked. Both EAS and WEA share essential information about severe weather, AMBER alerts, and other emergencies. The new rules direct the systems to use strong passwords, apply security updates in a timely manner, and deploy firewalls. The new EAS/WEA rules also establish a system to verify alerts before they are sent. The new cybersecurity rules for undersea cables are intended to "enhance submarine cable security and adopt a range of measures to streamline and accelerate the deployment of secure submarine cable infrastructure." Until now, providers of undersea cables have been required to undergo security licensing reviews; the new rules would "exempt applications from applicants that have operated cables without incident, can certify to the highest national security standards, and agree to ongoing oversight and monitoring." The rules also introduce a licensing requirement for submarine line terminal equipment (SLTE) owners and operators and "updat[e] safeguards that address vulnerabilities related to principal equipment, third-party service providers, and other areas of concern."

The US Supreme Court has ruled in Chatrie v. United States that broad surveillance using a geofence to track the locations of all mobile devices in a given area violates US citizens' Fourth Amendment rights, and that those same rights protect a reasonable expectation of privacy for users' mobile app data as a form of "personal property." Per this decision, law enforcement must obtain a warrant establishing specific probable cause for searching every individual in the area, rather than the previous geofence warrant process that could reveal the location data of large numbers of uninvolved bystanders. Chatrie contended that location data used in connection with a trial for bank robbery had been collected under a request that violated the Fourth Amendment. The Electronic Frontier Foundation notes that this is "the first digital surveillance decision by the Court since its landmark 2018 ruling Carpenter v. United States, which involved prolonged tracking of people’s movements using cell phone location data."

Companies are continuing to disclose data breaches stemming from the compromise of market research platform Klue and its third-party integrations in enterprise software such as Salesforce. Klue reports that a legacy credential created for a pilot program in 2022 was compromised, allowing an attacker to obtain OAuth tokens and steal customer data from Salesforce instances and other platforms where Klue was integrated, but not from the Klue platform itself. Upon detecting unauthorized activity on June 12, 2026, Klue revoked the affected credentials, removed unauthorized code, disabled potentially impacted integrations, and began an investigation alongside law enforcement and CrowdStrike. The company is communicating directly with customers about the investigation and steps for remediation, and is undertaking a review of internal security controls, credential management, monitoring, and deployment. TechCrunch reports that Klue has notified customers about ongoing negotiation with the threat actor: “We continue to communicate with the threat actor we have been in contact with (‘Icarus’), ... Icarus told us they are taking steps to delete the data taken from Klue customers. The Icarus site remains down and we have indications that Icarus is indeed taking steps to delete data taken from Klue customers.” Communications have reportedly also stated that a second threat actor is attempting to extort Klue customers directly, and that "Icarus has asked [Klue] to inform Klue customers to not make payment to this other party." The information stolen varies by customer, and may include personally identifiable information and business information; companies who have published security announcements include BeyondTrust, LastPass, HackerOne, Huntress, Insurity, Jamf, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium. Salesforce and Gong have both disabled the Klue integration for now.

Nissan North America and the US National Association of Insurance Commissioners (NAIC) have both disclosed that their systems were compromised through a vulnerability in Oracle PeopleSoft. The California State Attorney General's office has examples of breach notification letters Nissan sent to current and former employees. According to the notifications, Nissan learned of the incident from Oracle and is currently investigating the breach, which may have compromised "contact and banking information, Social Security Number / Social Insurance Number / National Identification Number, financial and tax data, and dependent / beneficiary information." The Nissan breach appears to have affected current and former employees in Brazil, Canada, Mexico, and the US. In a post on its website, NAIC writes that "Unauthorized access to a portion of the NAIC’s environment was identified on June 11 via an Oracle PeopleSoft vulnerability. While in PeopleSoft, the unauthorized party was able to obtain information needed to gain temporary access to certain data storage areas." NAIC is working with a third-party consultant "to compare the scope and type of data the group posted with our own preliminary analysis." Compromised NAIC data include publicly available statutory financial reporting information and credit rating agency data.

Japanese telecommunications company KDDI has acknowledged that threat actors exploited a vulnerability in third-party software to gain access to a KDDI email system. KDDI detected the breach on June 17 and took steps to mitigate the situation. The compromised email system is also used by five other internet service providers (ISPs): STNet Inc.; JCOM Co. Ltd.; Chubu Telecommunications C. Inc.; NIFTY Corporation; and BIGLOBE Inc. The incident may have compromised email addresses and passwords of 14.2 million accounts, so customers are advised to change their account passwords. The investigation is ongoing.

Japan's Self-Defense Forces procured flash drives in March 2024 that were carrying a virus with ties to Chinese nation-state threat actors. In February 2025, military personnel began reporting that their devices were running unusually slowly, and infections were discovered following a computer malfunction at a regional command in Itami. A subsequent investigation conducted by the Japanese army's Cyber Defense Unit found that six of eight flash drives contained malware and more than 50 of 480 computers were infected; of those, about half were running on closed, internal networks. Investigators believe that the infected drives were manufactured in China. The Defense Post writes that while the devices were "marketed as 1-terabyte storage devices, investigators found they actually contained 240-gigabyte microSD cards, and some had reportedly been preloaded with malware before use [and] despite multiple antivirus screening procedures, the devices were not scanned before deployment, allowing the malware to remain undetected."