PTC Windchill Webshell Creation (CVE-2026-4681)

Danny Y@zendannyy

•updated Apr 1, 2026•5•0•196

Detects the creation of specific webshell files (GW.class, payload.bin, or dpr_<8-hex-digits>.jsp) associated with CVE-2026-4681 weaponization on PTC Windchill and FlexPLM servers, or suspicious web requests containing patterns which could indicate exploitation attempts.