The Hacker News30%
URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat 43%
By https:52% www.facebook.com52% thehackernews52% The Hacker News59%
7/11/2026, 1:17:21 AM
BS Summary: This article contains 2 faulty reasoning types, including Attempt to Sell a Product or Service, with Indoctrination as the most egregious example at 12.9% saturation with 123 hits. Analysis detected 145 faulty-reasoning hits from 953 analyzed words, generating a BS Score of 48.2% and a BS Rank of 43% (7,946 of 13,821 articles). This article is better (less manipulative) than 57.50% of the article peer group.
URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat
Swati Khandelwal Jul 10, 2026 Enterprise Security / Security Incident
Progress Software has told ShareFile customers to shut down the Windows servers running their Storage Zone Controllers, confirming to The Hacker News that it is responding to a "credible external security threat."
The company has temporarily disabled access to the affected accounts, a step it says it took "out of an abundance of caution" while it works with internal and external security experts.
It says it has no indication of unauthorized access to any ShareFile accounts or data, and that it notified customers after learning of the threat.
What Progress has not said is what the threat is or who is behind it.
The order became public when a customer posted the company's email to Reddit's r/sysadmin on July 10.
Progress confirmed the disruption on its status page, listing Storage Zone Controller customers as "not operational" and the incident as under investigation as of a 12:12 p.m.
EDT update.
Only the Storage Zone Controller is affected, not standard cloud-only ShareFile accounts.
The controller is a server that a company runs itself, so files can stay on its own storage while it still uses ShareFile's cloud to share and manage them.
The controller usually sits at the network's edge, reachable from the internet.
That exposure makes it both useful and a target.
Ordering customers to take it fully offline, rather than just patch it, is a notable step.
That choice is itself a tell.
If a fix for this threat existed, Progress would be telling customers to apply it; the shutdown order suggests there is none yet.
That usually means a newly found flaw the company is racing to close, though the same step would also fit a threat a patch cannot address, such as stolen keys or a problem on Progress's own side.
Its statement that no accounts or data were accessed is careful wording, too, and does not rule out trouble on the controllers themselves.
Follow the shutdown order first.
Keep the affected controllers offline until Progress says what the threat is and when it is safe to restart.
Separately, confirm your version is current: 5.12.4 or later on the 5.x line, or a 6.x release.
That closes the flaws fixed earlier this year, but Progress has not said it clears the current threat, so do not treat it as permission to restart.
If a controller is reachable from the internet, handle it as a possible incident.
Preserve the logs and start your incident-response process, then check for unfamiliar .aspx files in the web folders and storage paths you did not set.
A clean-looking server is not proof that it is clean.
ShareFile has faced this before.
In 2023, while the product still belonged to Citrix, attackers exploited an unauthenticated flaw in the same Storage Zones Controller (CVE-2023-24489).
CISA flagged it as actively exploited , and Citrix cut unpatched controllers off from the ShareFile cloud, the same access block Progress has now imposed.
Progress, which acquired ShareFile in 2024, had already weathered a mass file-transfer attack of its own: MOVEit, whose 2023 zero-day was exploited by the Clop group and hit more than 2,700 organizations.
The Storage Zones Controller also had two critical flaws that watchTowr disclosed in April and Progress patched in March, though the company has not connected the current threat to them, and neither has been reported as exploited.
The central question is still unanswered: Progress has pulled these systems offline and is working with outside experts, but has not said what the threat is or when customers can safely bring them back online.
Found this article interesting?
Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.
Cloud security , data security , enterprise security , Incident response , network security , security incident , server security , Software Security , Vulnerability , Windows Security
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories
Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards
FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys
Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw
Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts
⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More
Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks
WhatsApp is Finally Getting Usernames to Help Keep Phone Numbers Private
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials
AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks
282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study
GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks
Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data
RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS
⭐ Featured Resources
What 200+ Security Teams Reveal About Using IP Intelligence in 2026
Get Hands-On SANS Training for Today’s Cyber Defense and Offensive Security Challenges
See What’s Really Exposed Across Your IT, OT, IoT, Cloud, and Mobile Assets
Get Gartner’s Guide to AI Agent Supervision and Runtime Controls
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.