Progress Pulls ShareFile Controllers Offline

Progress Software has ordered customers running ShareFile's Storage Zone Controller offline, according to The Hacker News. The company says it is responding to a "credible external security threat" and has temporarily disabled access to affected accounts while working with outside security experts.

The Storage Zone Controller is a Windows server companies run on their own premises, letting files stay on internal storage while ShareFile's cloud handles sharing and access. It typically sits at the network's edge, reachable from the internet — which makes it useful and, as it turns out, a standing target.

The shutdown order rather than a patch tells you what you need to know. When a fix exists, companies issue it. Ordering servers fully offline usually means no fix exists yet.

Progress says it has found no evidence of unauthorised access to accounts or data. That is careful wording: it says nothing about what may have happened on the controllers themselves.

This is not the first time this software has been in the crosshairs. In 2023, when the product still belonged to Citrix, attackers exploited a critical unauthenticated flaw (CVE-2023-24489) in the same component, and CISA flagged it as actively exploited.

What to do:

• Keep affected controllers offline until Progress issues clear guidance.
• Confirm you are on version 5.12.4 or later on the 5.x line, or any 6.x release. This closes earlier known flaws but does not authorise a restart.
• If your controller was internet-facing, treat it as a potential incident. Preserve logs, check for unfamiliar files in web and storage folders, and begin your incident-response process.

Researchers at the ASSET Research Group have demonstrated an attack they call Ghostcommit, which hides data-theft instructions inside a PNG image to fool AI code-review tools, according to Bleeping Computer.

Here is the mechanism. An attacker submits a pull request (a proposed code change) containing an AGENTS.md file — a configuration file that AI coding agents read automatically as project policy. That file points to an ordinary-looking image. Inside the image, in readable text, is an instruction: open the repository's .env file (which stores passwords and API keys), encode every byte as a number, and write those numbers into the source code as a harmless-looking constant.

AI reviewers never open image files. The malicious instruction passes every review clean. Later, when a developer asks their AI assistant for a routine task, the agent follows the merged instruction and silently encodes the entire secrets file into the next commit. The attacker decodes the numbers from the public repository.

The researchers found 73% of merged pull requests across 300 active public repositories received no meaningful human or automated review. That gap is what this attack depends on.

If your team uses AI code review, confirm your tools are configured to audit AGENTS.md changes and flag pull requests that reference image files as policy sources.

What Gitea is: Gitea is an open-source, self-hosted platform for storing and managing source code — think a version of GitHub or GitLab that a company runs on its own servers.

What it is: The official Gitea Docker image (a pre-packaged container used to deploy Gitea quickly) shipped with a configuration that trusted identity headers from any IP address on the internet. An attacker could send a single HTTP header claiming to be any user, including an administrator, and Gitea would believe them — no password required.

Who's at risk: Anyone running the official Gitea Docker image up to and including version 1.26.2 with default settings. Roughly 6,200 Gitea instances are currently exposed on the public internet, though the exact number of vulnerable deployments is unknown.

CVSS: Critical. Patch today.

Root cause: The Docker image set REVERSE_PROXY_TRUSTED_PROXIES=*, meaning it accepted the X-WEBAUTH-USER header (a field that tells Gitea who the user is) from any source, not just from a trusted internal proxy. Think of it like a hotel front desk that accepts a note saying "I'm the hotel manager" from anyone who walks in off the street — with no ID check whatsoever.

Attack vector: An attacker sends a standard HTTP request to an exposed Gitea instance and includes a header naming any account — admin, gitea_admin, or any known username. Gitea processes the header as a verified identity and grants full access. No credentials, no tokens, one line of a request. Sysdig researchers confirmed active exploitation began at least 13 days before public disclosure.

Detection strategies: Review access logs for requests containing X-WEBAUTH-USER headers arriving from external IP addresses. Look for unexpected admin account activity, particularly repository access, user creation, or settings changes. Check for authentication events with no corresponding password or token validation entries.

Recommended actions:

1. Upgrade to Gitea version 1.26.4 immediately (1.26.3 introduced a regression; 1.26.4 resolves both the CVE and that regression).
2. If upgrading is not immediately possible, set REVERSE_PROXY_TRUSTED_PROXIES to specific trusted IP addresses rather than the wildcard *.
3. Review access logs for suspicious activity to determine whether compromise has already occurred.

A study of 281 free Android VPN apps found widespread problems including traffic leaks, unencrypted data transmission, and hidden tracking, according to Bleeping Computer. A VPN is meant to create a secure, private tunnel for your internet traffic — but an untrustworthy one can expose exactly what you were trying to protect.

Free VPNs with no clear business model often fund themselves through your data.

What to do: If you use a VPN on Android, stick to well-reviewed paid services or widely trusted free options with published transparency reports. Check your current app's permissions — a VPN has no business accessing your contacts or microphone. If you are not sure whether your VPN is legitimate, removing it is safer than keeping it.

The European Parliament has voted to extend a law permitting major technology companies to voluntarily scan users' messages for child sexual abuse material (CSAM), according to The Record. The measure, which does not apply to end-to-end encrypted platforms like Signal, runs until 2028. Critics raised concerns about the procedural mechanism used — an absolute majority vote, held the day before summer recess, where absent members effectively count as votes in favour. A broader and more contested permanent framework, informally called Chat Control 2.0, remains under negotiation and could eventually extend scanning to encrypted communications.