Clop is working through PTC Windchill + FlexPLM. A new data-theft campaign hits internet-exposed instances of the product-lifecycle platforms used across aerospace, automotive, manufacturing, and retail — chaining a pre-auth RCE (CVE-2026-12569, CVSS 9.3, patched since mid-June) to drop JSP webshells under /Windchill/login/. CISA put it on the KEV list and gave federal agencies three days — that tells you the urgency read. Run either product? Patch, then hunt for hex-named .jsp files (per Ransom-ISAC) — patching doesn’t evict a shell that’s already planted.

Another AI agent ran an intrusion. Hunt.io researchers found exposed operator logs showing the open-source Hermes agent in unattended “YOLO mode” — automating reconnaissance, credential theft, privilege escalation, and lateral movement in an alleged compromise of Thailand’s Ministry of Finance. Issue #1’s AI-run ransomware wasn’t a one-off; the tooling is now off-the-shelf. Machine-speed attacks are exactly why this issue is a rehearsal: your response can’t be slower than their playbook.

KEV alert: your firewall MANAGER has a built-in password. CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog Jul 29 — a hard-coded credential in Cisco Secure Firewall Management Center lets an unauthenticated attacker simply log in (CVSS 8.9, actively exploited). FMC sees your firewall rules, VPN configs, and device inventory — recon heaven. Patch, then audit local accounts and recent logins on the management plane while you’re in there.

THE 60-MINUTE TABLETOP
(roles: facilitator, note-taker, everyone else plays themselves)

0:00  Ground rules: no blame, no heroics,
      answers must name a PERSON and a PLACE
0:05  Inject 1 — "EDR alerts on 3 machines. Encryption in
      progress. It's 2 AM Saturday." → Who gets the alert?
      Who wakes whom? Where's the call tree?
0:20  Inject 2 — "It spread. Backups console unreachable.
      Biggest client calls." → Isolate how? Who talks to
      the client? Who CAN'T we reach (PTO test)?
0:35  Inject 3 — "Vendor says 72h to restore. Insurer wants
      the timeline. A reporter emails." → Who invokes
      insurance? Who's authorized to speak?
0:50  Debrief: 3 gaps → 3 owners → 3 dates.
      That's the whole output.

⚠️ The tabletop is an exercise format, not professional incident response services — and not legal, compliance, or audit advice. In a REAL incident, follow your IR plan and engage counsel and your insurer per its terms.

“I want to run a one-hour exercise: we pretend it’s a bad Saturday and walk through who does what. No consultants, no downtime — one conference room. Last time an org like ours skipped this, they discovered mid-incident that the person with the backup passwords was on a cruise. The exercise costs an hour and finds those surprises while they’re funny instead of expensive. I’ll bring back three gaps, three owners, three dates.”

Pick the one that stings most. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.