Daily · 2026-07-24
🔴 Clop Windchill RCE, 🎯 Laundry Bear Zimbra Espionage, ⚠️ AgentForger ChatGPT Flaw, 🛡️ Nuclear Malware Benchmark, 📋 FedRAMP 20× Transition
Clop ransomware exploits CVE-2026-12569 targeting PTC Windchill/FlexPLM; international advisory on Laundry Bear Zimbra zero-click espionage; AgentForger ChatGPT Workspace Agent CSRF disclosed; SentinelOne Fast16 nuclear-sabotage malware benchmark shows only GPT-5.6 Sol completes all stages; FedRAMP 20× transition shifts to continuous machine-readable evidence.
The Laundry Bear campaign is the day's defining story because of its reach. A zero-click Zimbra flaw exploited since July 2025 has been stealing email archives, passwords and 2FA tokens from government, defense and energy organizations across NATO states, Ukraine and Africa. Laundry Bear is now the subject of a joint CISA-FBI advisory, and the pattern of Ukrainian targeting first and global deployment second matches previous Russian campaigns. Any Zimbra instance unpatched since November 2025 should be treated as compromised.
Clop runs a parallel extortion campaign against PTC Windchill and FlexPLM, exploiting a KEV-listed RCE with JSP webshells and demands sent from spoofed support addresses. The Windchill campaign targets internet-exposed product lifecycle systems where stolen design data carries competitive value.
The agent trust boundary gains another data point. AgentForger turns a single phished link into an invisible ChatGPT Workspace agent that obeys attacker email commands, and Microsoft is mandating passkeys by February 2027 after conceding that SMS and voice MFA fail against AI-driven phishing.
Watchlist: Zimbra patch status, Windchill and FlexPLM webshell hunts, and connector grants on ChatGPT workspaces.