Progress Software Urges Businesses to Immediately Shut Down ShareFile Storage Zone Controller Servers Over Credible External Threat
Progress Software has taken the unusual step of asking customers to immediately shut down servers running ShareFile Storage Zone Controller after detecting a credible external threat, underscoring the severity of the situation.
Corporate storage systems are rarely powered down except in cases of serious risk, yet the company has now instructed organizations to manually disable these controllers as an extra layer of protection while it investigates.
Progress Software has temporarily blocked ShareFile accounts that rely on Storage Zone Controller and launched an internal review. These controllers allow organizations to keep data within their own infrastructure or with a third-party provider, giving them full control over storage management rather than depending exclusively on cloud-hosted options.
The company has not revealed the nature of the threat or provided any timeline for lifting the restrictions. At the time of the notification, Progress Software stated it had found no signs of unauthorized access to ShareFile accounts or customer data.
Possible Connection to Recently Patched Vulnerabilities
Some users have suggested the incident may be related to two critical vulnerabilities patched in March: CVE-2026-2699 (CVSS 9.8) and CVE-2026-2701 (CVSS 9.1). Although no official confirmation exists, the combination of these flaws could allow attackers to change controller settings without authentication, upload malicious files, and execute commands on the server.
While the investigation continues, Progress Software recommends that customers manually power off any servers hosting Storage Zone Controller. The company views this shutdown as an additional safeguard until more details become available.
Related articles
PHP Foundation Reveals Two Critical RCE Vulnerabilities Fixed After 2024 Discovery Delays
The PHP Foundation has disclosed details surrounding two severe remote code execution vulnerabilities in PHP that were addressed in updates released on October 21, 2026. The issues, tracked as CVE-2026-109618 and CVE-2026-109619, affect memory management and error handling routines used in nearly every request. Although signs of one flaw were identified during an external audit in 2024, resource constraints and prioritization of other issues delayed remediation. The foundation had planned a coordinated disclosure, but information leaked prematurely, causing confusion among stakeholders. Updated versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are now available, and immediate patching is strongly recommended for all users. The vulnerabilities' broad impact and the challenges in balancing security fixes with performance considerations made the response particularly complex.
CISA Urges Immediate Patching of Critical PHP Remote Code Execution Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding two severe vulnerabilities in the PHP programming language that allow unauthenticated remote code execution. Identified as CVE-2026-109618 and CVE-2026-109619, the flaws affect all environments processing web requests with PHP and have been nicknamed php2shell. CISA recommends applying patches to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 without delay, or taking affected systems offline if updates cannot be applied immediately. Although no exploitation has been observed yet, organizations are instructed to inventory PHP usage, prioritize internet-facing systems, and monitor for suspicious activity such as shell processes spawned from PHP workers. Web application firewalls may offer partial protection but are not considered a substitute for patching.
GitLab Issues Critical Patches for CVE-2026-110264 Affecting Wide Range of Versions
GitLab has released emergency security updates to address multiple vulnerabilities, including one rated critical that allows unauthenticated remote code execution. The flaw, tracked as CVE-2026-110264, stems from an integer overflow in the regular expression compiler and carries a maximum CVSSv3.1 base score of 10.0. It impacts GitLab Community Edition and Enterprise Edition starting from version 7.0, with patches now available for both current and older branches. The company strongly urges immediate updates due to the severity and potential for arbitrary code execution on affected servers. Additional lower-severity issues were also resolved in the same release cycle.
PHP Issues Emergency Patches for Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released urgent patches for two critical vulnerabilities collectively known as PHP2Shell that enable unauthenticated remote code execution on affected servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, score 9.2 on CVSS v4.0 and have already seen active exploitation attempts with malicious payloads adjusted to bypass WAF rules. The issues affect multiple PHP deployment methods including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, and do not require complex application code to be exploitable. CVE-2026-109618 involves a memory corruption chain leading to code execution under the web process privileges, while CVE-2026-109619 stems from an obsolete global state issue causing use-after-free conditions that can result in memory disclosure and code execution. Patched versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with administrators advised to restart all persistent workers after updating. Temporary mitigations such as setting memory_limit to -1 and disabling session.upload_progress.enabled are available for environments that cannot patch immediately.