On September 25, 2026, Kiteworks CISO Frank Balonis asked every customer to power down their servers for six hours on Saturday after federal intelligence authorities warned of an imminent attack. If you run a managed file transfer appliance, read this as a signal: MFT appliances remain the top target of extortion gangs.

On August 14, 2026 Shell confirmed it is investigating a breach after Clop claimed it stole 89GB of data, including engineering drawings, through CVE-2026-12569 in PTC Windchill and FlexPLM. Exposed PLM teams need to check their instances and hunt for the JSP webshells dropped into the login directory.